cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
354
Views
5
Helpful
5
Replies

IDS module fabric compatibility

kentnoyes
Level 1
Level 1

The following statement is in the documentation for the 6500 IDS module (WS-X6381-IDS):

"Not compatible with the crossbar switch fabric"

Does this mean the IDS won't be able to take advantage of a fabric module itself or is there actually an affect on its ability to monitr traffic? Can someone clarify this incompatibility?

Thanks.

5 Replies 5

8rpalmer
Level 1
Level 1

The IDSM Blade is only a 100M compatible. By installing the cross-bar fabric in the switch, you are effectively increasing the backplane speed to over 32G. The sensor would not be able to keep up with this data flow and as a result would constantly produce "Missed Packet Count" Alerts.

I've spoken with Cisco several times on this issue. I have two blades in a Cat 6509 switch without the cross-bar fabric but I do have 8 GBICs pumping data into the switch and I'm experiencing the "Missed Packet Count" phenomena on both blades.

Hope this answered your question...I'm sure someone from Cisco will respond and probably clarify my input as well.

The IDSM blade can be overwhelmed with both the original backplane and the new cross-bar fabric.

The original backplane has speeds of 32Gbps. This is way more than the IDS Module can monitor. This is why either SPAN or VACL Capture have to be used to limit the amount of data being sent to the IDS Module.

The IDS Module has an effective performance level somewhere between 100Mbps and 150Mbps. It is very hard to designate a specific number because the performance is very dependant on the type of traffic being monitored. A general rule of thumb would be performance of 100 Mbps.

So if the switch configuration is sending more than 100 Mbps to the IDS Module then it is likely that the IDS Module will drop packets and report "Missed Packet Count" alarms. You will need to limit the amount of traffic by limiting your span or switch to VACL Capture and being specific about the traffic types to monitor.

-----------------

As for the newer cross-bar fabric, the switch can upgraded to handle 256 Gbps. It can do this because a new backplane was added.

Cat 6000 modules that work only with the original back plane have only a single connector to the original backplane (The IDS Module fits into this catgeory). These cards are often referred to as Classic cards.

Cat 6500 modules that work with both the original backplane as well as the new cross-bar fabric backplane have connectors to both the original backplane as well as the new cross-bar fabric. These cards are often referred to as Cross-bar Compatible.

There is even a 3rd type of card called Cross-bar Only that will only connect to the new cross-bar fabric. These are you 10GE cards and high end WAN cards.

The switch, however, will not utilize this new cross-bar fabric unless a Switch Fabric Module (SFM) or SFM2 is also in the switch, and the sup card is a Supervisor 2. The cross-bar fabric is also only available in the 65xx switches and 76xx OSRs and not the original 600x switches.

To get the optimal 256 Gbps performance the user has to have a 6500 switch (or 7600 OSR), a Sup2, an SFM (or SFM2), and ALL of the other modules have to be either cros-bar compatible or cross-bar only cards.

Inserting a Classic card (like the IDSM) into the switch above will cause the switch to change the way it uses the backplane. What happens is that Supevisor 2 now has to be able to transmit packets over the orignal packplane as well as the new cross-bar backplane. This is referred to as "truncated" mode. The end result is that the effective performance of the switch drops from 256 Gpbs to somewhere between 128 Gbps and 32 Gbps (original backplane speed). The real speed is very dependant on the exact types of cards and the flow of traffic, but is somewhere between 128 and 32 Gbps.

It is because of this performance drop from 256Gbps that some users do not want to put the IDSM into a switch optimized for cross-bar fabric.

What users do need to know though, is that the IDSM is not the only card that does this. All cards that are not cross-bar compatible will do this.

That is why Cisco makes even the 48 port 10/100 line card in multiple varieties. Some are cross-bar compatible, and some are not (classic cards).

We only have the classic card variety for the IDSM at this time, and do not currently sell the cross-bar compatible variety of the IDSM.

Understand that the IDSM will work in this scenario and is fully supported. You still need to use Span and VACL Capture to limit the montored traffic to 100Mbps or you recieve the "Missed Packet Count" alarm just like with the original backplane.

So when we say that the IDSM is not cross-bar compatible we mean that it is a Classic card. It will work in a switch that is utilizing the cross-bar it is just that the switch goes into "truncated" mode and the performance of the switch drops.

Also realize that if you remove the SFM, or use a Sup1 instead of a Sup2, or use a 6000 instead of a 6500 switch, then the entire switch reverts to using the orignal backplane with performance of 32Gbps.

OK so when is a fabric enabled IDS blade going to arrive?

I'm guessing one is imminent as I noticed options for the IDS blade 2 with and without accelerator card are now on the Smartnet price list, yet the cards themselves aren't on the price list yet.

I'm surprised it's not on the list of Comdex announcements...?

Somebody jumped the gun on putting it in the price list for Smartnet.

Please contact your Cisco Sales Rep about future products and their release schedules.

We try not to talk about future products on this Forum until after they have been officially announced.

Fair enough, I only noticied it because I was about to buy one of the one modules, my sales rep, account manager, and SE are all trying to come up with a date for me !