Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

IPS Deployment in a Dual Core Environment

Can any one share ideas/recommendations about deploying a Cisco 4215 IPS in an environment that has dual core switchs?


Re: IPS Deployment in a Dual Core Environment

look into vacl's and aggregators.

Community Member

Re: IPS Deployment in a Dual Core Environment

Right.... I guess I should back up and provide more information about what I am trying to do. So, I have a 4215 without the 4FE optional 4 port NIC that I want to monitor off of two 3750 routing switches. Would you recommend purchasing the card or spanning all Vlans?


Re: IPS Deployment in a Dual Core Environment

In 4215 you would have two interfaces, so that would mean you could have one inline pair. I am sure your two core switch traffic has to route through a fw before reaching the internet.

Need not do a promiscous monitoring, create a pair and place the IPS in between the active PIX and switch. This way whenever we have a active PIX, IPS inspects the traffic flows through it. Now in case of either device failing the secondary path can be used for the traffic to still continue passing. This way the traffic is not inspected but its going to be a rare occurence that your PIX would fail that easily or IPS has a hardware failure.

I am not sure if you can order the 4FE ports seperately contact your partner or Cisco for this information



Do rate if this post helps :)


Re: IPS Deployment in a Dual Core Environment

I assume your goal is to monitor all traffic on both switches? If you're not going to purchase the card, you're going to have to get all the traffic down into a single port (the 4215 only has one monitoring port). You might be able to do that without additional equipment using RSPAN. There are numerous other ways to get the 2 feeds down to "one" (hub, additional switch with SPAN, port aggregator).

If you get the card, you should be able to use a normal SPAN or VACL on each switch and use a separate physical interface on the sensor.

CreatePlease to create content