This is a general question as to whether anyone is running the 4235 sensor on 4.0 code with multiple monitoring interfaces?
Basically I am wondering if you have any comments on performance or if you have run into any issues with the configuration. I have not seen too much documentation for actually configuring this, so I'm wondering if there are any additional requirements or considerations.
We are currently testing 4.1, which has support for multiple interfaces on the 4235. I have a configuration running in the lab with a 4235 that has a quad nic card installed. Performance is very good. I think we rate the 4235 about 300 mbit or so with 4.1, so you should have a aggregate bandwidth support for the 300 Mbit divided among your monitoring interfaces.
You are correct , no docs out yet, because 4.1 is not yet shipping. Expected very soon.
With IDS 4.0 you can only montior using one sniffing interface. With 4.1 you will have support for multiple monitoring interfaces.
As far as performance goes, I don't see any issues besides to make sure the management station is able to handle the amount of alarms coming in when using multiple interfaces.