CISCO IPS - IDS MODE-TCP RESET

Unanswered Question
Sep 28th, 2009
User Badges:

I would like to issue TCP resets thru promiscuous interface of cisco IPS 4240. As per the current setup (which is explained in the attached drawing) there is only one vlan between firewall and switch and its working fine with following configurations in switch


monitor session 1 source interface fastethernet0/5

monitor session 1 destination interface fastethernet0/14 ingress vlan 145


My problem is, if we have multiple vlan in between switch and firewall. How the configuration should be? any extra configuration required in IPS as well?





Attachment: 
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
dhananjoy chowdhury Wed, 09/30/2009 - 07:11
User Badges:
  • Silver, 250 points or more

On the switch, instead of using interface as the monitor source, use VLANS and in the monitor destination any one vlan is required.

The IPS will send the TCP RST packet via that vlan.


monitor session 1 source vlan 145,146,147

monitor session 1 destination interface f0/14 ingress vlan 145


There is no change on the IPS.


rhermes Wed, 09/30/2009 - 09:03
User Badges:
  • Gold, 750 points or more

You are limited to only sending TCP resets to one VLAN when you send them out the sniffing interface.

manuadoor Wed, 09/30/2009 - 18:23
User Badges:

Can I know why we are using vlan 145 after ingress command.

dhananjoy chowdhury Fri, 10/02/2009 - 10:56
User Badges:
  • Silver, 250 points or more


vlan 145 is used after ingress command because the IPS will send the TCP RST packet via that vlan.


manuadoor Fri, 10/02/2009 - 11:37
User Badges:

Is that because, a tcp reset will be sent to vlan 145 against any traffic without a vlan tag.

Actions

This Discussion