IDSM-2(5.0)inline mode- Pair Status=down??

I have trouble with configuring idsm-2 inline mode(5.0).
it seems that traffic doesn't go through idsm.
I chechked it on command: sh interfac gi0/7(idsm mode)
the 'pair Status=down'(below) shows that, i think.
moreover, total packet received doesn't increase.
how do i solve it?
Please help!
xxsystems# sh int gigabitEthernet0/7
MAC statistics from interface GigabitEthernet0/7
Media Type = backplane
Missed Packet Percentage = 0
Inline Mode = Paired with interface GigabitEthernet0/8
Pair Status = Down
Link Status = Up
Link Speed = Auto_1000
Link Duplex = Auto_Full
Total Packets Received = 38
Total Bytes Received = 2584
Total Multicast Packets Received = 38
Total Broadcast Packets Received = 0
Total Jumbo Packets Received = 0
Total Undersize Packets Received = 0
Total Receive Errors = 0
Total Receive FIFO Overruns = 0
Total Packets Transmitted = 12
Total Bytes Transmitted = 1152
Total Multicast Packets Transmitted = 0
Total Broadcast Packets Transmitted = 12
Total Jumbo Packets Transmitted = 0
Total Undersize Packets Transmitted = 0
Total Transmit Errors = 0
Total Transmit FIFO Overruns = 0

You can only pair interfaces on your sensor if your sensor is capable of inline monitoring.
http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a00803eb069.html

Similar Messages

  • IDSM-2 load balancing on inline mode is it possible ..?

    Hi there .. I am currenty working on a project and need to find out as to whether etherchanelling load balancing can be configured between several IDSM-2 running on inline mode. The IPS 5.1 admin guide states that it is possible for IOS based switches having the IDSM-2 configured on promiscuous mode, however I have heard that it might also be possible to configure etherchannelling load balance when the IDSM-2 are on inline mode. Any help .. commments will be appreciated .. any links to refer to will be even better
    Thanks !!!

    To configure EtherChannel load balancing on IDSM-2, you must install Cisco IOS 12.2(18)SXE and have Supervisor Engine 720. Cisco IOS only supports promiscuous IDSM-2 EtherChanneling using VACL capture (not SPAN or monitor). Refer the URL
    http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html#wp1044800

  • IDSM-2 inline VLAN pair mode

    My customer has voice, video and data VLAN's. Customer wants to inspect only inter VLAN traffic ONLY for data to be inspected by IDSM-2 inline while bypassing other VLAN traffic to FWSM and then to WAN.
    Is that possible with Inline VLAN pair mode?
    I read the cisco document which states as below
    "You can configure IDSM-2 to simultaneously bridge up to 255 VLAN pairs on each data port. IDSM-2 replaces the VLAN ID field in the 802.1q header of each packet with the ID of the VLAN on which the packet is forwarded. It drops any packets received on VLANs that are not assigned to an inline VLAN pair."
    The last statement says it will drop all other vlan traffic which are not assigned to any inline vlan pair?
    Regards
    Vinod

    You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

  • IDSM-2 inline vlan pair mode configs

    Dear all,
    1. Is it possible to associate 2 vlans( to be paired) on 2 different data ports on IDSM instead of pairing it on single data port on IDSM ?? & configuring these 2 ports on CAT6509 as access ports instead of trunk... Will this thing work ?
    2. Since bypass mode is ON by default(AUTO) in IDSM-2 in-line vlan pair mode but when I am testing the bypass its not happening..can any pls. guide what could be the reason for this ?
    Regards,
    Akhtar

    You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

  • 6509 - IDSM-2 inline vlan pair mode at layer 3

    I am a little green, so be nice.
    wondering how to get an IDSM-2 module inline on a 6509. my issue is that the traffic comes into the 6509 at layer3 (routed) so I'm not sure how the config works. (e.g. do I use a trunk, or do I have to add a in a hop somehow)
    6509 conf snippet:
    intrusion-detection module 7 data-port 1 trunk allowed-vlan 3127,3128
    vlan 3127
    name FIREWALL-IPS
    vlan 3128
    name FIREWALL
    interface Port-channel2
    description CAB2
    ip address 10.30.2.2 255.255.255.0
    ip helper-address 10.10.20.11
    ip helper-address 10.10.20.13
    ip helper-address 10.30.123.11
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    glbp 2 ip 10.30.2.1
    glbp 2 timers msec 250 msec 750
    glbp 2 priority 120
    glbp 2 preempt delay minimum 60
    glbp 2 load-balancing weighted
    glbp 2 weighting track 89 decrement 50
    glbp 2 weighting track 99 decrement 50
    glbp 2 forwarder preempt delay minimum 60
    interface GigabitEthernet1/9
    description FIREWALL
    switchport
    switchport access vlan 3128
    switchport mode access
    no ip address
    interface GigabitEthernet8/9
    description CAB2SW1-Gi1/0/49
    no ip address
    channel-group 2 mode on
    interface GigabitEthernet9/9
    description CAB2SW1-Gi1/0/50
    no ip address
    channel-group 2 mode on
    interface Vlan3128
    description FIREWALL
    ip address 10.30.128.2 255.255.255.0
    no ip redirects
    no ip unreachables
    ip flow ingress
    no ip igmp snooping
    glbp 128 ip 10.30.128.1
    glbp 128 timers msec 250 msec 750
    glbp 128 priority 120
    glbp 128 preempt delay minimum 60
    glbp 128 load-balancing weighted
    glbp 128 forwarder preempt delay minimum 60
    IDSM-2 conf snippet:
    service interface
    physical-interfaces GigabitEthernet0/7
    description data-port 1
    subinterface-type inline-vlan-pair
    subinterface 1
    description FIREWALL VLAN3127<->VLAN3128
    vlan1 3127
    vlan2 3128

    A colleague of mine explained how to do this and it mostly makes sense. My only confusion is that once you remove the access vlan (3128) from the interface that gets monitored and replace it with 3127, how does traffic still traverse the 3128 vlan? What is the mechanism that controls this, is it the command "intrusion-detection module 7 data-port 1 trunk allowed-vlan 3127,3128" ??

  • Can I use IDSM-2 to monitor in inline-mode multiple pair of vlans?

    my customer wants to have IDSM-2 in inline mode for monitoring VLANs that are routed through the PIX firewalls.
    These VLANs are defined on the Cat 6500 switch where the IDSM-2 resides.
    They want to have one external vlan to be paired with 4 internal vlans.
    As far as I know the inline VLAN pairs configuration only support one to one vlan pairing.
    What's the best of doing this?

    Yes, you can very well use the IDSM for monitoring multiple VLANs.
    Refer to the configuration guide of the IDSM for more information
    http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html

  • How can i use IDSM-2 in inline mode for more than two VLANs?

    can i use the IDSM-2 in inline mode to be ips to more than two VLANS
    like this or it isn't
    intrusion-detection module 5 data port 1 access-vlan 10,20,30,40,50
    intrusion-detection module 5 data port 1 access-vlan 100,200
    thank u all for your help

    The IDSM-2 ports need to be configured as trunk ports with multiple vlans rather than as access ports.
    http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00807517eb.html#wp1068377
    And instead of creating an inline interface pair by pairing Gig0/7 with Gig0/8 within the IDSM-2 configuration, you would create inline vlan pairs.
    With an inline vlan pair you pair 2 vlans on the same interface.
    You can have up to 255 inline vlan pairs on each interface (assumining you keep the total traffic from all of the pairs within the IDSM-2s performance limit of around 500Mbps)
    How to create inline vlan pairs:
    http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00807517bb.html#wp1047852
    The other aspect you need to be aware of is that not all IOS versions will support configuring the IDSM-2 data ports as trunk ports for inline vlan pairs.
    Your best bet is to use 12.2(18)SXF4 or a later version on the 12.2(18)SXF train.
    The 12.2(33)SR train does not currently support the trunk feature for the IDSM-2.

  • IDSM-2 and inline mode

    Hello
    I have a question about IDSM-2 (in catalyst 6500) and ips 6.0.3 and inline mode. I wanted to create vlan groups, so i could have inline ips with many virtual sensors for subinterfaces (vlans range).
    I tied to:
    set trunk 5/7 1-4095 (on swith)
    set trunk 5/8 1-4095 (on swith)
    and in IDSM-2 in CLI:
    i created inline interface (using 5/7 and 5/8 ports), but after that i could not create in physical interface vlan groups. Why ?
    How can i make my IDSM-2 card working inline with many virtual sensors (policies) per different vlans ?

    i found my answer in idsm-2 document "You can mix sensing modes on IDSM-2. For example, you can configure one data port for promiscuous mode and the other data port for inline VLAN pair mode. But because IDSM-2 only has two data ports and inline mode requires the use of both data ports as a pair, you cannot mix inline mode with either of the other two modes." but something else,for doing such thing suppos that i have sig 2004 configured for inline traffic to deny attacker inline then this action doesnt make any sense for some data in passive mode and suppos that for that kind of traffic which idsm-2 is operating in passive mode i want to just send an alert. so can i use deferent VS for doing this? thanks.

  • Idsm 2- Inline Mode Deployment

    I would like to configure an IDSM-2 in inline mode, I am having trouble about the deployment, I have a couple of questions;
    1. If you configure 2 VLANs (existing) as VLAN pairs does this mean the exist connection between the 2 VLANs is broken?
    ie they can only communicate to each other via IPS.
    2. Where is the best place to deploy this type of IPS?

    In an inline VLAN-pair scenario, the IDSM2 will bridge the VLANs together using VLAN tag swapping.  Below is a quick topo sketch of an inline design where this might be used.
    6500 MSFC--VL10--(inside) FWSM (outside)--VLAN 11--IDSM--VLAN 111--RTR--INTERNET
    In the example above, the FWSM outside and RTR inside interfaces sit on the same Layer 3 subnet but different Layer 2 VLANs.  The IDSM is positioned inline using an inline VLAN-pair.  Traffic leaving the FWSM towards the Internet will go into the trunk to the IDSM on VLAN 11.  The IDSM will then swap the VLAN tag to 111 before fowarding the packet down the trunk.  This process allows the traffic to be influenced into the IDSM for inspection.
    http://www.cisco.com/en/US/customer/docs/security/ips/7.0/configuration/guide/cli/cli_interfaces.html#wp1047718

  • IDSM on catalyst 6500 to provide IOS Inline mode support

    I am currently evaluating what kind of method to apply in my 6500. I would like to ask if IOS Version 12.2(33)SXI2a  support inline mode and inline vlan pair mode with IDSM-2???what configuration should be done with the switch in order for the multiple vlan traffic to flow with an inline interface of the IDSM2??? In my case I have 16 user vlans and 1 server vlan on catalyst 6500...The task is to protect the servers from users....The requirement is to configure inline mode to monitor the traffic from these 16 vlans when they access the servers...But as we know the IDSM-2 has only two logical sensing ports...So my question is how will you configure the switch to forward the traffic from these 16 vlans to the IDSM-2 module via only ONE sensing port, since the other sensing port will be configured in the server vlan???  Because as far as i know, when you configure inline mode on IOS,you will have to configure the sensing ports in access mode( While in CatOS, you configure these as TRUNK ports)...But this will work when you have only two vlans...But in my case, I have 16 vlans to monitor in inline mode..Please suggest any solution.
    Any urgent reply will be much grateful...
    Many Thanks in advance

    Hi Mubin,
       If you're looking to monitor all the traffic from the user VLANs to the server VLANs then the simplest way to configure the IDSM-2 would be inline on the server VLAN segment.  All traffic destined to the servers (from the users or anywhere else) has to traverse that VLAN.  Assuming you have something like this to start:
    VLAN 100-120 (users) ====== Switch ------ VLAN 200 (servers)
    you'd drop the IDSM-2 inline on VLAN 200 by using a helper VLAN:
    VLAN 100-120 (users) ====== Switch ----- VLAN 201 (server gateway) ----- IDSM-2 (bridging 201 to 200) ----- VLAN 200 (servers)
    To do this you'll need to perform the following steps:
    1.  Designate a new VLAN to use as a helper VLAN for your current server VLAN.  I'll use 201 for this example and assume your current server VLAN is 200.
    Create the helper VLAN on the switch:
    switch# conf t
    switch(config)# vlan 201
    2.  Configure the IDSM-2 to bridge the helper VLAN and the server VLAN (200-201)
    sensor# conf t
    sensor(config)# service interface
    sensor(config-int)# phsyical-interface GigabitEthernet0/7
    sensor(config-int-phy)# admin-state enabled
    sensor(config-int-phy)# subinterface-type inline-vlan-pair
    sensor(config-int-phy-inl)# subinterface 1
    sensor(config-int-phy-inl-sub)# vlan1 200
    sensor(config-int-phy-inl-sub)# vlan2 201
    sensor(config-int-phy-inl-sub)# description Server-Helper pair
    sensor(config-int-phy-inl-sub)# exit
    sensor(config-int-phy-inl)# exit
    sensor(config-int-phy)# exit
    sensor(config-int)# exit
    Apply Changes:?[yes]:
    3.  Configure the switch to trunk the helper and server VLANs to the IDSM-2 module.  I assume the module is in slot 5 in the example.  Replace the 5 with the correct slot for your deployment:
    switch# conf t
    switch(config)# intrusion-detection module 5 data-port 1 trunk allowed-vlan 200,201
    switch(config)# intrusion-detection module 5 data-port 1 autostate include
    *Warning! This next step may cause an outage if everything is configured correctly.  You'll probably want to schedule a window to do this.*
    4.  Finally, force the traffic from the server VLAN through the IDSM-2 by moving the server VLAN gateway from VLAN 200 (where it is currently) to the helper VLAN you created.  To do this, remove the SVI from VLAN 200 and apply the same IP address to VLAN 201.  I assume the current server gateway is 192.168.1.1/24
    switch# conf t
    switch(config)#int vlan 200
    switch(config-int)#no ip addr
    switch(config-int)#int vlan 201
    switch(config-int)#ip addr 192.168.1.1 255.255.255.0
    switch(config-int)#exit
    switch(config)#exit
    switch# wr mem
    Now, when the servers try to contact 192.168.1.1 (their gateway) they'll have to be bridged through the IDSM-2 to reach VLAN 201 and in the process all traffic destined to them or sourced from them will be inspected.  Do not put any hosts or servers in the helper VLAN (201) or they will not be inspected.
    Best Regards,
    Justin

  • IDSM-2 Inline Vlan Pair - Duplicate Packets

    Dear All
    We have a setup where two IDSM-2 modules are ether-channeled together in a single 6513 Chassis.
    There is an FWSM module also, which acts as the default gateway for all internal VLANs.
    Problem: IDSM show stat virtual-sensor command is showing tons of 'Duplicate Packets'
    show statistics virtual-sensor | inc Duplic
    Duplicate Packets = 2950967
    Inline TCP Tracking Mode: Interface and VLAN
    Topology:
    Assume Client VLAN = 10 and Server VLAN = 60
    IPS Inline VLAN Pairs:
    10 >> 110 (Client VLAN)
    60 >> 160 (Server VLAN)
    Client >> Server Flow: (Layer 2):
    [ClientPC] >>>> Access Switch (VLAN 10) >>>> Core SW >>>> IDSM-2 (VLAN 10--110 Pair) >>>> Core Sw >>>> FWSM VLAN 110 >>>>
    FWSM VLAN 160 >>>> Core Sw >>>> IDSM-2 (VLAN 160--60 Pair) >>>> Server Switch (VLAN 60) >>>> [Server]
    Core Switch IPS Etherchannel Setup:
    Group 5: IDSM(A) and IDSM(B) Port x/7
    Group 6: IDSM(A) and IDSM(B) Port x/8
    Some VLAN Pair(s) are on interface x/7 and others are on x/8
    Because of the above issue, we see a lot of TCP normalization signatures being fired (as the IPS gets confused with duplicate packets seen for the same flow). Specially signatures 1330:12 :17 and :18.
    It is also causing some applications to break (e.g. Veritas Netbackup 6.5). When I removed the DENY action from these signatures, our IPS started having stability issues (This could also be due to E3 upgrade)
    Should we change the Tracking mode to 'VLAN' only, OR any other possible solution?. Should not the 'interface and vlan' setting be sufficient?.
    Regards
    Farrukh

    This will take some traffic analysis to determine what is going wrong.
    You might need to place a sniffer to watch the traffic on the client where the backup software is running at the same time that you capture the traffic on the sensor.
    Look to see if there are any differences in the traffic.
    Look for any anomalies in the traffic.
    Look to see if maybe the backup software is not using a standard TCP connection (is it jumping the tcp sequence numbers in any abnormal way?)
    You might also try some things on the sensor to determine if the sensor itself might have an issue.
    Determine if the connction passes through 2 connections (inline vlan pairs) monitored by the sensor.
    If you can, you might try removing both of the pairs from the virtual sensor. (don't delete the pairs, just remove them from the virtual sensor so they won't be analyzed)
    And see if the backup works.
    If it does then just add in one pair, and see if it keeps working.
    If it has errors with just the one pair, then the problem is likely not because of the connection being monitored twice.
    Something else must be weird about the connection.
    If the problems are only seen when having both pairs in the same virtual sensor, then try placing the pairs in different virtual sensors and see if the problem goes away.
    If the problem goes away when in different virtual sensors, then there may be an error in the inline tcp session tracking code that should track connections separately for each interface/vlan.

  • IDSM inline VLAN pairing

    We have cat 6509 switch with FWSM, IDSM-2, NAM modules. Customer wants all the internal VLAN's to be monitored by IDSM in inline mode. Customer has around 400 VLANS in datacenter and wants to monitor all communications between VLAN's. How do I monitor all VLAN's when IDSM has 2 data ports and can only span 255 vlan groups per port?
    Please suggest!
    Vinod

    I don't know if anyone is still watching this or not but that's a lot of VLANs to go through a (single?) IDSM. Technically you should be able to do it by splitting the VLAN pairs across the two data ports (i.e. vlan 2-200,1002-1200 on DP 1 and vlan 300-500,1300-1500 on DP 2). Considering each IDSM only has a throuput of 500MBps when deep scanning, you're going to potentially be limiting your throughput considerably if you do this.

  • IDSM-2 Inline mode

    Hi,
    I am working with the IDSM-2, We have Cisco 6509 with CSM & FWSM, We are planning IDSM-2 in Inline mode and now i want to monitor the traffic which is coming through Outside Interface of the FW context ( Which is nothing but a VLAN A, VLAN B, Vlan C. on MSFC )
    Data flow :-- ISP RTR---INternal RTR---FWSM---IDSM---MSFC---CSM---
    IDSM version is 5.1(4)S257.0,
    This will support only Two VLAN (IN and OUT) on access mode.
    My problem is I don't know how to scan the traffic of 3 numbers of VLAN (A,B,C).
    Cisco 6509 --- Version 12.2(18)SXF7,

    Hi Udaya,
    I am not able to find out any subinterface.
    I think it is available from IPS 5.1 and this one is IPS5.0(2)
    IDSM2CORE2(config-int)# show settin
    physical-interfaces (min: 0, max: 999999999, current: 3)
    name: GigabitEthernet0/2
    media-type: backplane
    description:
    admin-state: enabled
    duplex: auto
    speed: auto
    alt-tcp-reset-interface
    none
    name: GigabitEthernet0/7
    media-type: backplane
    description:
    admin-state: enabled
    duplex: auto
    speed: auto
    alt-tcp-reset-interface
    interface-name: System0/1
    name: GigabitEthernet0/8
    media-type: backplane
    description:
    admin-state: enabled
    duplex: auto
    speed: auto
    alt-tcp-reset-interface
    interface-name: System0/1
    command-control: GigabitEthernet0/2
    inline-interfaces (min: 0, max: 999999999, current: 0)
    bypass-mode: auto
    interface-notifications
    missed-percentage-threshold: 0 percent
    notification-interval: 30 seconds
    idle-interface-delay: 30 seconds

  • IDSM-2 Inline mode operation - cat6000 Hybrid

    Hello, is the inline mode operation on the IDSM-2 IPS 5.1 only supported with catos 8.4(1)?
    Thanks!

    I agree, the IPS 5.1 release notes http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/prod_release_note09186a0080574954.html#wp1068104 says it requires 8.5(1) go figure.

  • Compatible 6500 IOS version to support IDSM-2 Inline mode

    The 6500 model WS-SUP720-3BXL with IOS version 12.2(18)SXD4,
    and IDS card WS-SVC-IDSM-2 with sw 5.0(2)is compatible to run on inline mode.
    Regards,
    Viraj

    Good day,
    Hi, You need minimum sup-bootdisk:s3223-advipservicesk9_wan-mz.122-18.SXF7.bin IOS to enable INLINE mode on 6500 series.
    as per my knowledge,
    the latest IOS is
    sup-bootdisk:s3223-adventerprisek9_wan-mz.122-18.SXF13.bin.
    for IDSM-2, if u upgrade to Engine 2 IOS, U can get update with E2 signatures and also U can manage from New Management Console like Cisco IPS manager Express 6.1.
    I hope this will satisfy.

Maybe you are looking for