Excellent document Siddharth,

In ur architecture:

• Data flow between IDSM2 and 6500 happens via ports on the  back-plane.

• 6500 dataport 1 connects to IDSM gig0/7.   6500 dataport 2 connects to IDSM gig0/8

• IDSM will  bridge gig0/7 and gig0/8 together.
• Vlan assignment to  ports can be done only on Cat6500 side.
• If Dataport1  is in vlan x and Dataport 2 is in Vlan y then, IDSM is in fact bridging  Vlan x & y due to the architecture.

Question 1:The above RED HIGLIGHTED line is confusing me ,We can assign vlan's in inline Interface pair mode as u have suggested me to use in ur above mail???  If so, then can we use as much real vlan on port gig0/7 and as much virtual vlan on gig0/8,so that IDSM-2 will bridge between them.Uptill now what i m thinking is in inline interface pair mode supports only 1 set of vlan and that to they are access ports.

Question 2:ON what scenarios we need INLINE VLAN PAIR MODE THEN??

Question 3: In 1 virtual sensor  traffic is passed how many times to IDSM-2.for Example in  inline vlan pair mode.if i want to allow inter-vlan routing from vlan 100 to vlan 200.

INLINE VLAN PAIR: vlan 1 and vlan2 are real SVI interface  and vlan 100 and vlan 200 are virtual just for pairing.

vlan 1 to  100

vlan 2 to 200

USER-PC                      SWITCH SVI           SWITCH SVI                       USER-PC

vlan  100----IDSM--------int vlan1 SVI --- ----int vlan2  SVI-------IDSM----vlan 200

Please correct the above steps for traffic flow.from 1 vlan to another.I hope the traffic is passing 2 times to IDSM-2

ALSO

Question 4:I m also going to place IDSM-2 with FWSM,any different configuration or traffic flow will be the same, as it was hitting the switch SVI now it will hit to FWSM SVI

Thanks

Hi, i came across this thread and i am finding it very useful I have a custmer who has an e-commerce environment which contains a 6509 service chassis, with 2x layers of FWSM, CSM/SSL and IDSM-2. The IDSM-2 has never been used but now there is a PCI compliance requirement to enable the module.

The information you have provided will help with the configuration, however, i have a question and probably a very simple one at that :-) what can be used to view the output of the ISDM-2? The customer is lookiing for as cheap a solution as possible, so that probably rules out CS-MARS.. What do most people use?

Also, the requirement is to only capture traffic destined to certain secure zones, i believe i can use VACLS or ACLs to only capture specified traffic, is that correct?

Any assistance would be great,

many thanks,

rays

Estela,

I am not sure if I understood your questions correctly.

This is difficult to explain by email.

Please go through the link below to understand difference between 'inline interface pair mode ' and inline vlan pair mode'

http://tools.cisco.com/squish/6F956

Question 1:The above RED HIGLIGHTED line is confusing me ,We can assign vlan's in inline Interface pair mode as u have suggested me to use in ur above mail???  If so, then can we  use as much real vlan on port gig0/7 and as much virtual vlan on  gig0/8,so that IDSM-2 will bridge between them.Uptill now what i m  thinking is in inline interface pair mode supports only 1 set of vlan  and that to they are access ports.

Answer:

Inline interface pair is used when IPS ports are connected to access ports , correct.

IDSM will bridge only 2 vlans in inline interface pair mode.

Remember, IDSM in inline interface pair mode has no notions of vlans as such.

The vlan assignment is done on the 6500 on ports connecting to the IDSM.

For IDSM,  inline interface pair is like a wire connecting two ports.

Whatever comes in on one interface, send it out of the other.

The 6500 ports connecting to the ports on IDSM are access ports belonging in different vlans of the pair.

Hence IDSM in theory bridges 2 vlans together.

Question 2:ON what scenarios we need INLINE VLAN PAIR MODE THEN??

Inline vlan pair is roughly analogous to 'Router on a stick '

In inline vlan pair mode we have: One physical interface, and a pair of vlans per subinterface.

Packets received on one of the paired VLANs are analyzed and then forwarded to the other VLAN in the pair.

You can have multiple sub-interface pairs on a single physical interface.

For a inline vlan pair mode, the IDSM port needs to be connected to a trunk port on the switch side.

The following example might make it easier to understand

E.g

Gig 0/7 - Physical interface

Inline vlan pair #1

sub interface 1

vlan 10

vlan 20

Inline vlan pair #2

sub interface 2

Vlan 30

Vlan 40

On 6500 switch, data-port 1 connects to gig0/7 over backplane.

data-port 1 needs to be a trunk port.

When traffic in vlan 10 is recieved on gig0/7 its forwarded out of same interface gig0/7 out of vlan 20

When traffic in vlan 20 is recieved on gig0/7 its forwarded out of same interface gig0/7 out of vlan 10

Sub interface 1 is used to associate the pair of vlans 10 and 20 to physical interface gig0/7

When traffic in vlan 30 is recieved on gig0/7 its forwarded out of same interface gig0/7 out of vlan 40

When traffic in vlan 40 is recieved on gig0/7 its forwarded out of same interface gig0/7 out of vlan 30

Sub interface 2 is used to associate the pair of vlans 130 and 40 to physical interface gig0/7

Question 3: In 1 virtual sensor  traffic is passed how many times to IDSM-2.for  Example in  inline vlan pair mode.if i want to allow inter-vlan routing  from vlan 100 to vlan 200.

I did not understand the question. For inline interface pair, traffic flows through virtual sensor once for each direction.

From x > y  one.

From y back to > x two.

Go through the design document I wrote and take a look at the packet walk for arp.

https://supportforums.cisco.com/docs/DOC-12206

INLINE VLAN PAIR: vlan 1 and vlan2 are real SVI interface  and vlan 100 and vlan 200 are virtual just for pairing.

vlan 1 to  100

vlan 2 to 200

USER-PC                      SWITCH SVI           SWITCH SVI                       USER-PC

vlan  100----IDSM--------int vlan1 SVI --- ----int vlan2  SVI-------IDSM----vlan 200

Please correct the above steps for traffic flow.from 1 vlan to another.I hope the traffic is passing 2 times to IDSM-2

Switch cannot have SVI for 2 vlans. It will do intervlan routing directly without the packet ever going through the IDSM.

We need  one ip subnet, 2 vlans, and SVI only on one of them.

Check " Normal intervlan routing " on the design doc: https://supportforums.cisco.com/docs/DOC-12206

ALSO

Question 4:I  m also going to place IDSM-2 with FWSM,any different configuration or  traffic flow will be the same, as it was hitting the switch SVI now it  will hit to FWSM SVI

E.g scenario:

Well say, inside vlan is 100 and outside vlan is 200.

All hosts reside in inside vlan 100.

Outside artificial vlan 200 is created to force traffic to go through IDSM.

Then vlan 100 and vlan 200 share same common ip subnet.

SVI only exists on vlan 200.

6500 data port 1  is access port in vlan 100

6500 data port 2 is access port in vlan 200

IDSM gig0/7-gig0/8 are a inline interface pair.

IDSM bridges vlan 100 & 200 together.

Default gateway for all hosts in vlan 100 and 200 is SVI for 200.

This SVI can be placed on FWSM, and FWSM can be put it routing mode.

That way traffic is forced to go through to the FWSM after it passes through the IDSM and back to the switch.

Sid Chandrachud

TAC Security Solutions

Hi Rays,

To answer your question:

1.  To view events one can use IPS devuce manager or IDM which is the web gui for IDSM.

To access IDSM

https://

Click monitoring > events

2. You can also install IPS manager express (free software) from cisco.com

This can be used to configure IDSM and view the events.

IME can be downloaded here:

http://tools.cisco.com/squish/0dbB3

3. To send traffic to IDSM two methods can be used

SPAN

or

Vacl Capture

Both configurations are listed here:

http://tools.cisco.com/squish/4DDA3

Sid Chandrachud

TAC Security Solutions

Thanks for the information Sid.

WIth the options you have mentioned, do you know how long the event logs are kept for? The customer has to meet PCI DSS

compliance and one of requirements is that logged information is kept for a period of time..

thanks

rays

a. IDM is not meant for event storage.

IDM is displaying events from IPS's own event store which is limited and gets overwritten.

b. IME is a software installed on a p.c which can configure IPS and also store events from it.

It installs a version of MYSQL

c. IME stores events in a event file.

Each event file has a max event capacity of 1 million events.

IME can archive max 400 such events files.

So 400 archive files each having 1 million events each is the number of events that can be stored on IME.

To view the files:

\Program Files\Cisco Systems\Cisco IPS Manager Express\MYSQL\data\alarmDB

d. For a comprehensive event storage solution you can look to something like Mars which can store all events on a NFS share.

Or IPS is also a SDEE client. So an external SDEE server can log into IPS and grab events from it. Event storage then depends on the capacity of the SDEE server. Check out my document about SDEE and IPS:

https://supportforums.cisco.com/docs/DOC-12515

Sid Chandrachud

TAC Security Solutions