Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Question on opportunities of a sensor control

Whether the sensor control 4230 is capable to listen the trank channel on which the packages from 9 VLAN are transferred?

3 REPLIES
New Member

Re: Question on opportunities of a sensor control

I don't think so, please let me know if you find anything otherwise on this

Bronze

Re: Question on opportunities of a sensor control

I don't believe an IDS-4230 can do this per se either...

However, there is a solution for this situation - use an IDS-4235 instead! Now, before you flame me for telling you to spend money, read this link:

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_field_notice09186a00801850de.shtml

In a nutshell, IDS-4230 appliances are subject to a recall due to a failure in a mainboard component. This means you'll get a free IDS-4235 to replace the IDS-4230!

Hope this helps,

Alex

Cisco Employee

Re: Question on opportunities of a sensor control

First let me clear up some confusion on terminology.

The sensor appliances have 2 or more interfaces.

One interface is the command and control interface. This interface is assigned an ip address (by the setup command in version 4.x) and is used for communicating with the IDS management stations (and your desktop machine if using the CLI and/or IDM).

The command and control interfaces do NOT support connecting to a Trunk port of a switch.

The sensor (in version 4.x) can not be configured to monitor the command and control port.

The other interfaces of the sensor are known as the sensing interfaces.

These other interfaces are used for receiving traffic for monitoring.

The sensing interfaces are capable of being connected to a 802.1q trunk port, and the software is capable of analyzing the 802.1q trunk traffic.

(NOTE: This is true of all sensor appliances running version 4.x including the 4230).

When monitoring a switch, and you want traffic from multiple vlans to be monitored by the sensor, then the following steps are usually followed:

On the switch itself configure the port connected to the sensor to be a 802.1q trunk port.

NOTE: The sensor does not participate in auto negotiation of the trunk so you will need to force the trunking "on" in the switch configuration.

Setup the trunk port to trunk those vlans you want monitored. In your case the 9 vlans of interest.

NOW you must still use Span or VACL Capture (VACL Capture is only on the Cat 6500 switches) to forward the traffic from those vlans to the sensor port.

Some users have incorrectly assumed that making the sensor's port a trunk port was enough to get the packets to be sent to the sensor for monitoring. This is incorrect. You still need to use SPAN or VACL Capture to tell the switch to send a copy of the packets to the sensor. The trunking just allows the packets to be copied with 802.1q trunk headers and allows the monitoring of multiple vlans through SPAN or VACL Capture.

74
Views
0
Helpful
3
Replies