Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

ips(asa) with ids

if i have an ASA with the SSM module and i have vlans configured on my LAN, how will i detect intrussion on the vlans? do i still need the ids?

thanks a lot

1 REPLY

Re: ips(asa) with ids

Hello

The IPS or IDS comes into picture when traffic hits the sensing interface and flows through the IPS... Now, you have VLANs on the local core switch , which is not in the IPS segment. Hence, the traffic between VLANs will not be seen or stopped by the IPS.

In case you have a 6500 chassis in your core, you can use a Network Analysis module and see the traffic flowing on all VLANs. Netflow can clearly give you data about the source/destination IP/port, through which you can detect attacks to a certain extent.

If you have servers, which has to be protected on the VLAN, i would advice you to have Cisco Security Agent on them, which will work as a Host ids...

Hope this helps.. let us know your views on this.

Raj

100
Views
5
Helpful
1
Replies
CreatePlease to create content