IDSM-2 Inline mode operation - cat6000 Hybrid

Hello, is the inline mode operation on the IDSM-2 IPS 5.1 only supported with catos 8.4(1)?
Thanks!

I agree, the IPS 5.1 release notes http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/prod_release_note09186a0080574954.html#wp1068104 says it requires 8.5(1) go figure.

Similar Messages

IDSM-2 Inline mode

Hi,
I am working with the IDSM-2, We have Cisco 6509 with CSM & FWSM, We are planning IDSM-2 in Inline mode and now i want to monitor the traffic which is coming through Outside Interface of the FW context ( Which is nothing but a VLAN A, VLAN B, Vlan C. on MSFC )
Data flow :-- ISP RTR---INternal RTR---FWSM---IDSM---MSFC---CSM---
IDSM version is 5.1(4)S257.0,
This will support only Two VLAN (IN and OUT) on access mode.
My problem is I don't know how to scan the traffic of 3 numbers of VLAN (A,B,C).
Cisco 6509 --- Version 12.2(18)SXF7,

Hi Udaya,
I am not able to find out any subinterface.
I think it is available from IPS 5.1 and this one is IPS5.0(2)
IDSM2CORE2(config-int)# show settin
physical-interfaces (min: 0, max: 999999999, current: 3)
name: GigabitEthernet0/2
media-type: backplane
description:
admin-state: enabled
duplex: auto
speed: auto
alt-tcp-reset-interface
none
name: GigabitEthernet0/7
media-type: backplane
description:
admin-state: enabled
duplex: auto
speed: auto
alt-tcp-reset-interface
interface-name: System0/1
name: GigabitEthernet0/8
media-type: backplane
description:
admin-state: enabled
duplex: auto
speed: auto
alt-tcp-reset-interface
interface-name: System0/1
command-control: GigabitEthernet0/2
inline-interfaces (min: 0, max: 999999999, current: 0)
bypass-mode: auto
interface-notifications
missed-percentage-threshold: 0 percent
notification-interval: 30 seconds
idle-interface-delay: 30 seconds

Idsm 2- Inline Mode Deployment

I would like to configure an IDSM-2 in inline mode, I am having trouble about the deployment, I have a couple of questions;
1. If you configure 2 VLANs (existing) as VLAN pairs does this mean the exist connection between the 2 VLANs is broken?
ie they can only communicate to each other via IPS.
2. Where is the best place to deploy this type of IPS?

In an inline VLAN-pair scenario, the IDSM2 will bridge the VLANs together using VLAN tag swapping. Below is a quick topo sketch of an inline design where this might be used.
6500 MSFC--VL10--(inside) FWSM (outside)--VLAN 11--IDSM--VLAN 111--RTR--INTERNET
In the example above, the FWSM outside and RTR inside interfaces sit on the same Layer 3 subnet but different Layer 2 VLANs. The IDSM is positioned inline using an inline VLAN-pair. Traffic leaving the FWSM towards the Internet will go into the trunk to the IDSM on VLAN 11. The IDSM will then swap the VLAN tag to 111 before fowarding the packet down the trunk. This process allows the traffic to be influenced into the IDSM for inspection.
http://www.cisco.com/en/US/customer/docs/security/ips/7.0/configuration/guide/cli/cli_interfaces.html#wp1047718

Compatible 6500 IOS version to support IDSM-2 Inline mode

The 6500 model WS-SUP720-3BXL with IOS version 12.2(18)SXD4,
and IDS card WS-SVC-IDSM-2 with sw 5.0(2)is compatible to run on inline mode.
Regards,
Viraj

Good day,
Hi, You need minimum sup-bootdisk:s3223-advipservicesk9_wan-mz.122-18.SXF7.bin IOS to enable INLINE mode on 6500 series.
as per my knowledge,
the latest IOS is
sup-bootdisk:s3223-adventerprisek9_wan-mz.122-18.SXF13.bin.
for IDSM-2, if u upgrade to Engine 2 IOS, U can get update with E2 signatures and also U can manage from New Management Console like Cisco IPS manager Express 6.1.
I hope this will satisfy.

IDSM-2(5.0)inline mode- Pair Status=down??

I have trouble with configuring idsm-2 inline mode(5.0).
it seems that traffic doesn't go through idsm.
I chechked it on command: sh interfac gi0/7(idsm mode)
the 'pair Status=down'(below) shows that, i think.
moreover, total packet received doesn't increase.
how do i solve it?
Please help!
xxsystems# sh int gigabitEthernet0/7
MAC statistics from interface GigabitEthernet0/7
Media Type = backplane
Missed Packet Percentage = 0
Inline Mode = Paired with interface GigabitEthernet0/8
Pair Status = Down
Link Status = Up
Link Speed = Auto_1000
Link Duplex = Auto_Full
Total Packets Received = 38
Total Bytes Received = 2584
Total Multicast Packets Received = 38
Total Broadcast Packets Received = 0
Total Jumbo Packets Received = 0
Total Undersize Packets Received = 0
Total Receive Errors = 0
Total Receive FIFO Overruns = 0
Total Packets Transmitted = 12
Total Bytes Transmitted = 1152
Total Multicast Packets Transmitted = 0
Total Broadcast Packets Transmitted = 12
Total Jumbo Packets Transmitted = 0
Total Undersize Packets Transmitted = 0
Total Transmit Errors = 0
Total Transmit FIFO Overruns = 0

You can only pair interfaces on your sensor if your sensor is capable of inline monitoring.
http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a00803eb069.html

IDSM-2 and inline mode

Hello
I have a question about IDSM-2 (in catalyst 6500) and ips 6.0.3 and inline mode. I wanted to create vlan groups, so i could have inline ips with many virtual sensors for subinterfaces (vlans range).
I tied to:
set trunk 5/7 1-4095 (on swith)
set trunk 5/8 1-4095 (on swith)
and in IDSM-2 in CLI:
i created inline interface (using 5/7 and 5/8 ports), but after that i could not create in physical interface vlan groups. Why ?
How can i make my IDSM-2 card working inline with many virtual sensors (policies) per different vlans ?

i found my answer in idsm-2 document "You can mix sensing modes on IDSM-2. For example, you can configure one data port for promiscuous mode and the other data port for inline VLAN pair mode. But because IDSM-2 only has two data ports and inline mode requires the use of both data ports as a pair, you cannot mix inline mode with either of the other two modes." but something else,for doing such thing suppos that i have sig 2004 configured for inline traffic to deny attacker inline then this action doesnt make any sense for some data in passive mode and suppos that for that kind of traffic which idsm-2 is operating in passive mode i want to just send an alert. so can i use deferent VS for doing this? thanks.

IDSM-2, inline and Passive mode in same Module?

Hi,i have a question that it can be strange.in our network we have implemented idsm-2 module in our 6513 Switch in inline mode.without any discution about network design suppose that our network is going beyond IDSM-2 Throughput and then we want to use IDSM-2 for some traffic in Passive mode insted of inline to reduce drop probability in inline mode.i mean before this state we were using idsm-2 data port 1(in vlan pair mode),now can we use data port 2 for this purpus(capturing some traffic on data port 2 for passive operation)? in other word idsm-2 can operate in this way?

i found my answer in idsm-2 document "You can mix sensing modes on IDSM-2. For example, you can configure one data port for promiscuous mode and the other data port for inline VLAN pair mode. But because IDSM-2 only has two data ports and inline mode requires the use of both data ports as a pair, you cannot mix inline mode with either of the other two modes." but something else,for doing such thing suppos that i have sig 2004 configured for inline traffic to deny attacker inline then this action doesnt make any sense for some data in passive mode and suppos that for that kind of traffic which idsm-2 is operating in passive mode i want to just send an alert. so can i use deferent VS for doing this? thanks.

How can i use IDSM-2 in inline mode for more than two VLANs?

can i use the IDSM-2 in inline mode to be ips to more than two VLANS
like this or it isn't
intrusion-detection module 5 data port 1 access-vlan 10,20,30,40,50
intrusion-detection module 5 data port 1 access-vlan 100,200
thank u all for your help

The IDSM-2 ports need to be configured as trunk ports with multiple vlans rather than as access ports.
http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00807517eb.html#wp1068377
And instead of creating an inline interface pair by pairing Gig0/7 with Gig0/8 within the IDSM-2 configuration, you would create inline vlan pairs.
With an inline vlan pair you pair 2 vlans on the same interface.
You can have up to 255 inline vlan pairs on each interface (assumining you keep the total traffic from all of the pairs within the IDSM-2s performance limit of around 500Mbps)
How to create inline vlan pairs:
http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00807517bb.html#wp1047852
The other aspect you need to be aware of is that not all IOS versions will support configuring the IDSM-2 data ports as trunk ports for inline vlan pairs.
Your best bet is to use 12.2(18)SXF4 or a later version on the 12.2(18)SXF train.
The 12.2(33)SR train does not currently support the trunk feature for the IDSM-2.

IDSM-2 load balancing on inline mode is it possible ..?

Hi there .. I am currenty working on a project and need to find out as to whether etherchanelling load balancing can be configured between several IDSM-2 running on inline mode. The IPS 5.1 admin guide states that it is possible for IOS based switches having the IDSM-2 configured on promiscuous mode, however I have heard that it might also be possible to configure etherchannelling load balance when the IDSM-2 are on inline mode. Any help .. commments will be appreciated .. any links to refer to will be even better
Thanks !!!

To configure EtherChannel load balancing on IDSM-2, you must install Cisco IOS 12.2(18)SXE and have Supervisor Engine 720. Cisco IOS only supports promiscuous IDSM-2 EtherChanneling using VACL capture (not SPAN or monitor). Refer the URL
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html#wp1044800

IDSM-2 inline VLAN pair mode

My customer has voice, video and data VLAN's. Customer wants to inspect only inter VLAN traffic ONLY for data to be inspected by IDSM-2 inline while bypassing other VLAN traffic to FWSM and then to WAN.
Is that possible with Inline VLAN pair mode?
I read the cisco document which states as below
"You can configure IDSM-2 to simultaneously bridge up to 255 VLAN pairs on each data port. IDSM-2 replaces the VLAN ID field in the 802.1q header of each packet with the ID of the VLAN on which the packet is forwarded. It drops any packets received on VLANs that are not assigned to an inline VLAN pair."
The last statement says it will drop all other vlan traffic which are not assigned to any inline vlan pair?
Regards
Vinod

You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

IDSM on catalyst 6500 to provide IOS Inline mode support

I am currently evaluating what kind of method to apply in my 6500. I would like to ask if IOS Version 12.2(33)SXI2a support inline mode and inline vlan pair mode with IDSM-2???what configuration should be done with the switch in order for the multiple vlan traffic to flow with an inline interface of the IDSM2??? In my case I have 16 user vlans and 1 server vlan on catalyst 6500...The task is to protect the servers from users....The requirement is to configure inline mode to monitor the traffic from these 16 vlans when they access the servers...But as we know the IDSM-2 has only two logical sensing ports...So my question is how will you configure the switch to forward the traffic from these 16 vlans to the IDSM-2 module via only ONE sensing port, since the other sensing port will be configured in the server vlan??? Because as far as i know, when you configure inline mode on IOS,you will have to configure the sensing ports in access mode( While in CatOS, you configure these as TRUNK ports)...But this will work when you have only two vlans...But in my case, I have 16 vlans to monitor in inline mode..Please suggest any solution.
Any urgent reply will be much grateful...
Many Thanks in advance

Hi Mubin,
If you're looking to monitor all the traffic from the user VLANs to the server VLANs then the simplest way to configure the IDSM-2 would be inline on the server VLAN segment. All traffic destined to the servers (from the users or anywhere else) has to traverse that VLAN. Assuming you have something like this to start:
VLAN 100-120 (users) ====== Switch ------ VLAN 200 (servers)
you'd drop the IDSM-2 inline on VLAN 200 by using a helper VLAN:
VLAN 100-120 (users) ====== Switch ----- VLAN 201 (server gateway) ----- IDSM-2 (bridging 201 to 200) ----- VLAN 200 (servers)
To do this you'll need to perform the following steps:
1. Designate a new VLAN to use as a helper VLAN for your current server VLAN. I'll use 201 for this example and assume your current server VLAN is 200.
Create the helper VLAN on the switch:
switch# conf t
switch(config)# vlan 201
2. Configure the IDSM-2 to bridge the helper VLAN and the server VLAN (200-201)
sensor# conf t
sensor(config)# service interface
sensor(config-int)# phsyical-interface GigabitEthernet0/7
sensor(config-int-phy)# admin-state enabled
sensor(config-int-phy)# subinterface-type inline-vlan-pair
sensor(config-int-phy-inl)# subinterface 1
sensor(config-int-phy-inl-sub)# vlan1 200
sensor(config-int-phy-inl-sub)# vlan2 201
sensor(config-int-phy-inl-sub)# description Server-Helper pair
sensor(config-int-phy-inl-sub)# exit
sensor(config-int-phy-inl)# exit
sensor(config-int-phy)# exit
sensor(config-int)# exit
Apply Changes:?[yes]:
3. Configure the switch to trunk the helper and server VLANs to the IDSM-2 module. I assume the module is in slot 5 in the example. Replace the 5 with the correct slot for your deployment:
switch# conf t
switch(config)# intrusion-detection module 5 data-port 1 trunk allowed-vlan 200,201
switch(config)# intrusion-detection module 5 data-port 1 autostate include
*Warning! This next step may cause an outage if everything is configured correctly. You'll probably want to schedule a window to do this.*
4. Finally, force the traffic from the server VLAN through the IDSM-2 by moving the server VLAN gateway from VLAN 200 (where it is currently) to the helper VLAN you created. To do this, remove the SVI from VLAN 200 and apply the same IP address to VLAN 201. I assume the current server gateway is 192.168.1.1/24
switch# conf t
switch(config)#int vlan 200
switch(config-int)#no ip addr
switch(config-int)#int vlan 201
switch(config-int)#ip addr 192.168.1.1 255.255.255.0
switch(config-int)#exit
switch(config)#exit
switch# wr mem
Now, when the servers try to contact 192.168.1.1 (their gateway) they'll have to be bridged through the IDSM-2 to reach VLAN 201 and in the process all traffic destined to them or sourced from them will be inspected. Do not put any hosts or servers in the helper VLAN (201) or they will not be inspected.
Best Regards,
Justin

Can I use IDSM-2 to monitor in inline-mode multiple pair of vlans?

my customer wants to have IDSM-2 in inline mode for monitoring VLANs that are routed through the PIX firewalls.
These VLANs are defined on the Cat 6500 switch where the IDSM-2 resides.
They want to have one external vlan to be paired with 4 internal vlans.
As far as I know the inline VLAN pairs configuration only support one to one vlan pairing.
What's the best of doing this?

Yes, you can very well use the IDSM for monitoring multiple VLANs.
Refer to the configuration guide of the IDSM for more information
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html

IDSM2 on 6500-IOS inline mode support?

Hi,
I have an IDSM-2 running IPS5.1(1d) software (recently upgraded from 4.x) that is sitting on a 6500 IOS.
The IPS device manager shows gi0/7 and gi0/8 as both in Promiscuous mode. There is no option to change the mode to inline and pair them.
Is it so that IDSM-2 currently supports only Promiscuous mode?
If so, then this module is still acting as an IDS despite running IPS5.1. Isn't it? What is the advantage that I get after upgrading it from 4.x to 5.1?
-- Vasanth

There are 2 pieces to the puzzle.
There is the IDSM-2 version and what it supports, but also the Cat 6K Native IOS version and what it supports.
IDSM-2 v5.1(1d) supports
a) Promiscuous mode,
b) InLine Interface Pair mode (2 interfaces are paired for inline monitoring), and also
c) InLine Vlan Pair mode (2 vlans on a single interface are paired for inline monitoring, you will also see it called inline-on-a-stick)
But for these features to be used, the switch code must also support configuring the switch side of the IDSM-2 for each of these 3 features.
Native IOS Versions prior to 12.2(18)SXE will support only Promiscuous mode on the IDSM-2.
12.2(18)SXE and later versions will support InLine Interface Pair mode on the IDSM-2.
No Native IOS versions currently support InLine Vlan Pair mode on the IDSM-2 (a new Native IOS versions with this support is currently in development).
So to get Inline (IPS) functionality you need to be running a Native IOS version 12.2(18)SXE or later, and on the IDSM-2 run IPS versions 5.1 (or even the older 5.0).
(NOTE: Cat OS 8.5(1) does support all 3 modes of the IDSM-2. So if you are using Cat OS instead of Native IOS, then run version 8.5(1) to have access to all of the features of IPS 5.1(1) on the IDSM-2)
If you are running a Native IOS version prior to 12.2(18)SXE then the IDSM-2 can only be operated in Promiscuous mode even if 5.1(1) is loaded on the IDSM-2.
However, even in promiscuous mode the IPS 5.1(1) software does have a few advantages.
There are several engines, and engine parameters that are only supported in the 5.1 version and not the 4.0 version. So there are several signatures that are either a) not even created for 4.x sensors, or b) the 4.x signature is not as precise as the 5.x signature in the new engines.
(These new engines have proved invaluable in writing signatures to detect some of the new attacks that have come out over the past year.)
There are of course other advantages as well:
For example:
1) Risk Rating to better aid in prioritization of alerts.
2) More flexible fitlering mechanism for alerts that allows for fitlering individual actions
The 2 features above are just 2 of the new features that have been added in 5.0 and 5.1 that apply to both promiscuous and inline modes.

How to best use IDSM in promiscuous mode?

Hi folks
I need some input and ideas how to best set up my IDSM2 module.
Today I have the module set up to capture traffic from the 6513 using SPAN in both directions and two different firewalled VLANs as sources. The destination is data-port 1 on the IDSM. This setup is working fine but I'm curious as how to best use the second data-port. Our 6513 runs IOS 12.2(18)SXF3 and has a limit of only one SPAN session set up to capture an entire VLAN in both directions.
My idea was to use the second data-port as SPAN destination for our external/non-firewalled VLAN, but this isn't allowed.
Does anyone have or had a similar problem? Would using a VLAN access list with data-port 2 as destination be an option or are the dual IDSM interfaces mainly used for inline mode?
Regards
Fredrik Hofgren

Fredrik,
I am using VACLs in the switch that has the IDSM. This will preserve your SPAN sessions.
You can specify which vlans go to which port on the IDSM.
We actually have our external vlan set up as an inline vlan pair on data port 2.

IDSM-2 inline between multible VLAN

Hi,
I have a coreswitch 6509 which is include IDSM-2 actully the core switch handle the traffice between the usres VLANs and the server Vlan (vlan 11)
The users Vlan are (Vlan 2 , 3, 4, 5, 6 and 7). I need to configure the core switch and IDSM to be inline between the Users VLANs and the Server farm Vlan to inspect the traffic comming from the useres.
as my understanding I can use the ISDM inline mode between multible Vlan but unfortunattly my test to drop the ICMP request to server is faild.
Kindly advice if that available or it should be only in promisecouse mode.
also if there any sample of succesfully configuration.
my configuration is as below:
Core-SW-RYD#sh run | in intr
intrusion-detection module 9 data-port 1 trunk allowed-vlan 2-7,11
intrusion-detection module 9 data-port 2 trunk allowed-vlan 2-7,11
intrusion-detection module 9 data-port 1 autostate include
intrusion-detection module 9 data-port 2 autostate include
intrusion-detection module 9 data-port 1 portfast 1
intrusion-detection module 9 data-port 2 portfast 1
VLAN Name                             Status    Ports
1    default                          active    Gi9/2, Gi9/3, Gi9/4, Gi9/5, Gi9/6
2    Food-D-VLAN                      active
3    Comm-D-VLAN                      active
4    Emar-D-VLAN                      active
5    Finance-D-VLAN                   active
6    Glucose-D-VLAN                   active
7    IT-D-VLAN                        active    Gi1/3
11   servers-Vlan                     active    Gi1/2, Gi1/4, Gi1/5, Gi1/6, Gi1/7, Gi1/8, Gi1/9, Gi1/10, Gi1/12, Gi1/13
                                                Gi1/14, Gi1/15, Gi1/16, Gi1/17, Gi1/18, Gi1/19, Gi1/20, Gi1/21, Gi1/22
                                                Gi1/23, Gi1/24, Gi1/25, Gi1/26, Gi1/27, Gi1/28, Gi1/29, Gi1/31, Gi1/32
                                                Gi1/33, Gi1/34, Gi1/35, Gi1/36, Gi1/37, Gi1/38, Gi1/39, Gi1/41, Gi1/42
                                                Gi1/43, Gi1/44, Gi1/45, Gi1/46, Gi1/47, Gi1/48, Gi2/10, Gi2/11, Gi2/12
                                                Gi2/13, Gi2/15, Gi2/16, Gi2/18, Gi2/19, Gi2/20, Gi2/21, Gi2/22, Gi2/23
                                                Gi2/24, Gi3/1, Gi3/2, Gi3/3, Gi3/4, Gi3/5, Gi3/6, Gi3/7, Gi3/8, Gi3/9, Gi3/10
                                                Gi3/11, Gi3/12, Gi3/13, Gi3/14, Gi3/15, Gi3/16, Gi3/17, Gi3/18, Gi3/19
                                                Gi3/20, Gi3/21, Gi3/22, Gi3/23, Gi3/24
your support will be highly appreciated.
Best Regards,
Magdy

Hi Mohamed.
with inline mode, you can only bridge vlans in pairs uniquely!. so you can only bridge vlan 11 to another single vlan. and remember since they are bridged, that means the 2 vlans need to have the same ip subnet.
but looking at your requirements, i'm guess the different vlans are on different ip subnet ranges.
In that case, you'll need to do promiscuous mode.
However in promiscuous mode, you can only do acl blocking. and first packet will pass successfully but will trigger the sensor to configure the router to create an acl, and further packets will be dropped.
However if you redesign a bit you can use promiscuous mode. for example create a new layer 2 vlan (let's say 14), move the servers to this vlan.
You only need to trunk vlan11 and vlan14 to the idsm module, then create a single vlan-pair on the IPS which bridges vlan11 and vlan 14. then configure the signature to drop packets inline. SInce now for the clients who need to contact the servers need to pass traffic to vlan11, and the idsm is in the middle between vlan 11 and 14, then it should drop pings to the servers.
Regards,
Fadi.

IDSM-2 Inline mode operation - cat6000 Hybrid

Similar Messages

Maybe you are looking for