IPS 4260 sensor - NIC ports

[networker99]

The IPS 4260 only comes with 1 NIC port, does this mean it can only operate in promisicious mode, and will have to buy additional NIC interfaces to run inline?

[marcabal · Accepted solution]

It comes with one command and control NIC, and one monitoring NIC.

The monitoring NIC can be used for Promiscuous monitoring, or InLine Vlan Pair monitoring.

With InLine Vlan Pair Monitoring you plug it into a switch, and make the switch port a trunk port of 2 vlans.

Inside the sensor configuation you pair the 2 vlans.

Packets coming in Vlan A will be analyzed and transmitted back on Vlan B.

Packets coming in Vlan B will be analyzed and transmitted back on Vlan A.

So InLine Vlan Pairs acts as if one interface of an InLine sensor is connected to Vlan A, and the other interface connected to Vlan B; but is able to do it using a single interface.

For traditional InLine Interface Pair monitoring, yes you will need to purchase an additional NIC.

The 4260 supports 3 types of additional NICs: 10/100/1000 TX, 1000 SX, and 10 Gbps SX.

[rhermes]

If you're going to shell out the money for a 4260, but\y the 4 port interface bundle (the bundle price saves you some money). Cisco claims that the sensor can run between 1 and 2 Gb/s of traffic, so why would you want to liimit the amount of traffic you can get into the box to 1 Gb/s?