Changing from Promiscuous mode to In-Line mode

Question

I want to put the ISDM "in-line" between my internet edge router and my firewall (FWSM which is in the same chassis as the IDSM). In order to have traffic flow from the internet edge router into the IDSM, then out of the IDSM to the FWSM, I will need to set the IDSM interfaces in the appropriate VLANs. I cannot find the procedure for doing this in the documentation.

Answer 1

There is very little real documentation (that I have found) that covers this real well.
What I have found to work, think of it this way. Use two separate VLANs, VLAN 10 and VLAN 11 for example. Use the same IP address range over these two VLANs. Put the router in VLAN 10 and the firewall interface in VLAN 11 (or vice versa).
Then configure the IDSM two utilize the two VLANs as a VLAN pair. The only way those two interfaces can communicate (as they are on separate VLANs) is through the IPS module. The IPS module will bridge the two speparate VLANs with the Virtual Sensor Interface.
If there are hosts in the same VLAN, that will not traverse the IPS, but if the interfaces are in separate VLANS 10 and 11 in this example, they will traverse the IPS or any traffic that traverses this connection.
I hope this helps,
Mike