Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

IDS Monitoring Design Problem

I have a customer that I am implementing IDS's to monitor several parts of their network and I am running into a small design problem.

The customer has a network that is highly redundant. Example of this is causing a problem of how to or where to place the IDS's. They have two seperate connections to the Internet on two seperate routers. These routers are connected to two seperate cat2950 switches that are connected via FastEthernetChannel. These two switches each has a connection into a PIX (one Primary and one Failover).

Now the problem. I can connect the IDS to the switch that has the connection to the primary PIX and monitor that port, but the customer wants to be able to monitor the other PIX without having to move the patch cable for the IDS from the first switch to the second. I did try to have a monitor port in the second switch connect back to the primary switch and monitor that port as well, but there was a sudden blasting of traffic on the primary switch when I made the connection.

Any thoughts on how to configure the switches? Or other thoughts to add a switch for the monitoring?

3 REPLIES
Community Member

Re: IDS Monitoring Design Problem

I'm sure there are more than a couple of solutions here. One such is to use two sniffing interfaces on a Cisco IDS sensor. You can run two instances of a sensor on the same piece of hardware. You can have one sniffing interface monitor traffic on the 1st 2950 and have the second sniffing interface monitor traffic on the 2nd 2950.

Cisco Employee

Re: IDS Monitoring Design Problem

Current IDS software (4.1) does support multiple sensing interfaces that would let you monitor both pix's. This would be done with 1 instance of the sensor doing the monitoring. Mutliple instances of the sensor are not supported at this time.

Cisco Employee

Re: IDS Monitoring Design Problem

IDS hardware options:

IDS-4215 with the IDS-4FE-INT=

- this sensor will have 5 interfaces that could be used for monitoring (the standard 10/100 monitoring interface + 4 additional 10/100 interfaces on the 4FE card)

- Aggregate performance with traffic from all 5 ports is 80 MBPS

IDS-4235 with the IDS-4FE-INT=

- this sensor will have 5 interfaces that could be used for monitoring (the standard 10/100/1000 monitoring interface + 4 additional 10/100 interfaces on the 4FE card)

- Aggregate performance with traffic from all 5 ports is 250 MBPS

IDS-4250 with the IDS-4FE-INT=

- this sensor will have 5 interfaces that could be used for monitoring (the standard 10/100/1000 monitoring interface + 4 additional 10/100 interfaces on the 4FE card)

- Aggregate performance with traffic from all 5 ports is 500 MBPS

IDS-4250-XL (IDS-4250 with the IDS-XL-INT=)

- this sensor will have 2 interfaces that could be used for monitoring (2 1000 fiber connection on the XL card)

- Aggregate performance with traffic from both ports is 1 GBPS

So if you are connecting to the sensor with 10/100 ports from the switches then the 4FE card can be added to the IDS-4215, 4235, or 4250 to give you the additional monitoring interface.

BUT if you are connecting from the 2950 with a Gig interface then the only option is the IDS-4250-XL which has 3 Gig Fiber interfaces.

243
Views
0
Helpful
3
Replies
CreatePlease to create content