IDSM-2 Throughput in Bypass Mode?

HI,i cisco documentation idsm-2 has 500Mbps throughput in inline mode and 600Mbps throughput in passive.so suppose that our idam-2 is in inline mode,then if we put our idsm-2 in Bypass mode,how much traffic idsm-2 can handle without any inspection?(throughput?)
thanks.

The IDSM-2 would only be supported at the same 500Mbps for both inspection and ByPass mode.
There is not a separate rating for ByPass mode.
With that said, the IDSM-2 will do much higher than 500Mbps while in ByPass mode (assuming nothing else happening on the sensor).
But I am not sure how much more since we don't generally test performance while in ByPass mode.
You would not want to plan your network on the ByPass performance capability.
The other reason is that when the sensor goes into ByPass there be something else going on in the sensor.
In the case of a Signature Update there will be signature processing consuming much of the CPU and memory so ByPass will not perform at its top performance.

Similar Messages

  • IDSM-2 inline VLAN pair mode

    My customer has voice, video and data VLAN's. Customer wants to inspect only inter VLAN traffic ONLY for data to be inspected by IDSM-2 inline while bypassing other VLAN traffic to FWSM and then to WAN.
    Is that possible with Inline VLAN pair mode?
    I read the cisco document which states as below
    "You can configure IDSM-2 to simultaneously bridge up to 255 VLAN pairs on each data port. IDSM-2 replaces the VLAN ID field in the 802.1q header of each packet with the ID of the VLAN on which the packet is forwarded. It drops any packets received on VLANs that are not assigned to an inline VLAN pair."
    The last statement says it will drop all other vlan traffic which are not assigned to any inline vlan pair?
    Regards
    Vinod

    You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

  • IDSM-2 inline vlan pair mode configs

    Dear all,
    1. Is it possible to associate 2 vlans( to be paired) on 2 different data ports on IDSM instead of pairing it on single data port on IDSM ?? & configuring these 2 ports on CAT6509 as access ports instead of trunk... Will this thing work ?
    2. Since bypass mode is ON by default(AUTO) in IDSM-2 in-line vlan pair mode but when I am testing the bypass its not happening..can any pls. guide what could be the reason for this ?
    Regards,
    Akhtar

    You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

  • IDSM-2, inline and Passive mode in same Module?

    Hi,i have a question that it can be strange.in our network we have implemented idsm-2 module in our 6513 Switch in inline mode.without any discution about network design suppose that our network is going beyond IDSM-2 Throughput and then we want to use IDSM-2 for some traffic in Passive mode insted of inline to reduce drop probability in inline mode.i mean before this state we were using idsm-2 data port 1(in vlan pair mode),now can we use data port 2 for this purpus(capturing some traffic on data port 2 for passive operation)? in other word idsm-2 can operate in this way?

    i found my answer in idsm-2 document "You can mix sensing modes on IDSM-2. For example, you can configure one data port for promiscuous mode and the other data port for inline VLAN pair mode. But because IDSM-2 only has two data ports and inline mode requires the use of both data ports as a pair, you cannot mix inline mode with either of the other two modes." but something else,for doing such thing suppos that i have sig 2004 configured for inline traffic to deny attacker inline then this action doesnt make any sense for some data in passive mode and suppos that for that kind of traffic which idsm-2 is operating in passive mode i want to just send an alert. so can i use deferent VS for doing this? thanks.

  • IDSM-2 Throughput

    Hi,
    Do you know what is the througput on an IDSM-2 when in "promiscuous mode"?
    thank you.
    regards,
    jonix

    As per the data sheet it is 600 mbps.
    http://www.cisco.com/en/US/products/hw/modules/ps2706/products_data_sheet09186a00801e55dd.html
    Please rate helpful posts.
    Regards
    Farrukh

  • IPS 4240 & Interface Up\Down In Bypass-Mode Auto

    Hi. this is a strange one. We have a C7200R (FastEthernet) on one side and a C3500 (FastEthernet) on the other with an IPS4240 in the middle. When changing the IPS unit from "bypass-mode on" to auto the interface on the C7200 router goes down, ie no link activity. We have tried several combinations of interface speeds\duplex. The systems would normally be in speed auto\duplex auto but we have tried 100\full forced as well. When in "bypass-mode on" the all systems work fine in auto\auto negotiating 100\full. Any ideas. Thanks Alex

    I have a similar problem:
    ASA 5510 - E0/0 - Connects to E0/1 on C2800 - when we set it to FULL/100 the connection fails - when the interfaces are set to AUTO everything is fine. Any suggestions? Thanks

  • SNMP monitoring of Bypass mode on a 4255

    Hi,
    I am trying to monitor if the IPS is in bypass mode or not through SNMP.
    Does anyone know which OID I should be looking at?
    Thanks

    .1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.0 = STRING: "Indicates that the specified network interface has lost link."
    .1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.1 = STRING: "Indicates that the specified network interface has established link."
    .1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.2 = STRING: "Indicates that packet traffic has started on the specified network interface."
    .1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.3 = STRING: "Indicates that packet traffic has stopped on the specified network interface."
    .1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.4 = STRING: "Indicates that the percentage of missed packets on the specified interface has exceeded the configured threshold."
    .1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.5 = STRING: "Indicates that the inline data bypass has started."
    .1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.6 = STRING: "Indicates that the inline data bypass has stopped."
    There seems to be some mibs releated to this, but i'm guessing these are SNMP traps that can be sent.  I haven't tested this, but might be worth a shot to setup SNMP traps and manually start bypass to see if you get them.

  • IDSM-2(5.0)inline mode- Pair Status=down??

    I have trouble with configuring idsm-2 inline mode(5.0).
    it seems that traffic doesn't go through idsm.
    I chechked it on command: sh interfac gi0/7(idsm mode)
    the 'pair Status=down'(below) shows that, i think.
    moreover, total packet received doesn't increase.
    how do i solve it?
    Please help!
    xxsystems# sh int gigabitEthernet0/7
    MAC statistics from interface GigabitEthernet0/7
    Media Type = backplane
    Missed Packet Percentage = 0
    Inline Mode = Paired with interface GigabitEthernet0/8
    Pair Status = Down
    Link Status = Up
    Link Speed = Auto_1000
    Link Duplex = Auto_Full
    Total Packets Received = 38
    Total Bytes Received = 2584
    Total Multicast Packets Received = 38
    Total Broadcast Packets Received = 0
    Total Jumbo Packets Received = 0
    Total Undersize Packets Received = 0
    Total Receive Errors = 0
    Total Receive FIFO Overruns = 0
    Total Packets Transmitted = 12
    Total Bytes Transmitted = 1152
    Total Multicast Packets Transmitted = 0
    Total Broadcast Packets Transmitted = 12
    Total Jumbo Packets Transmitted = 0
    Total Undersize Packets Transmitted = 0
    Total Transmit Errors = 0
    Total Transmit FIFO Overruns = 0

    You can only pair interfaces on your sensor if your sensor is capable of inline monitoring.
    http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a00803eb069.html

  • 6509 - IDSM-2 inline vlan pair mode at layer 3

    I am a little green, so be nice.
    wondering how to get an IDSM-2 module inline on a 6509. my issue is that the traffic comes into the 6509 at layer3 (routed) so I'm not sure how the config works. (e.g. do I use a trunk, or do I have to add a in a hop somehow)
    6509 conf snippet:
    intrusion-detection module 7 data-port 1 trunk allowed-vlan 3127,3128
    vlan 3127
    name FIREWALL-IPS
    vlan 3128
    name FIREWALL
    interface Port-channel2
    description CAB2
    ip address 10.30.2.2 255.255.255.0
    ip helper-address 10.10.20.11
    ip helper-address 10.10.20.13
    ip helper-address 10.30.123.11
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    glbp 2 ip 10.30.2.1
    glbp 2 timers msec 250 msec 750
    glbp 2 priority 120
    glbp 2 preempt delay minimum 60
    glbp 2 load-balancing weighted
    glbp 2 weighting track 89 decrement 50
    glbp 2 weighting track 99 decrement 50
    glbp 2 forwarder preempt delay minimum 60
    interface GigabitEthernet1/9
    description FIREWALL
    switchport
    switchport access vlan 3128
    switchport mode access
    no ip address
    interface GigabitEthernet8/9
    description CAB2SW1-Gi1/0/49
    no ip address
    channel-group 2 mode on
    interface GigabitEthernet9/9
    description CAB2SW1-Gi1/0/50
    no ip address
    channel-group 2 mode on
    interface Vlan3128
    description FIREWALL
    ip address 10.30.128.2 255.255.255.0
    no ip redirects
    no ip unreachables
    ip flow ingress
    no ip igmp snooping
    glbp 128 ip 10.30.128.1
    glbp 128 timers msec 250 msec 750
    glbp 128 priority 120
    glbp 128 preempt delay minimum 60
    glbp 128 load-balancing weighted
    glbp 128 forwarder preempt delay minimum 60
    IDSM-2 conf snippet:
    service interface
    physical-interfaces GigabitEthernet0/7
    description data-port 1
    subinterface-type inline-vlan-pair
    subinterface 1
    description FIREWALL VLAN3127<->VLAN3128
    vlan1 3127
    vlan2 3128

    A colleague of mine explained how to do this and it mostly makes sense. My only confusion is that once you remove the access vlan (3128) from the interface that gets monitored and replace it with 3127, how does traffic still traverse the 3128 vlan? What is the mechanism that controls this, is it the command "intrusion-detection module 7 data-port 1 trunk allowed-vlan 3127,3128" ??

  • VMotion in VM-FEX Hypervisor Bypass Mode

    Hello,
    I know that when vMotion a virtual machine in a VM-FEX with Hyperv Bypass, the environment gets temporarily switched to Emulated Mode...
    Question is: ¿is this switch to Emulated Mode and switch back to Hyperv Bypass automatically done? Or rather it needs human intervention?
    Thanks,

    No, VM-FEX is managed by the fabric Interconnect cluster.  For this reason you can't use VM-FEX to migrate between separate UCS clusters.
    Regards,
    Robert

  • My iphone 3gs is in ios5 bypass mode and my power button dont work

    my power button dont work how can i fix this the bypass problem ?

    You have a hardware problem. Make an appointment at the genius bar. You can get an out of warranty replacement for $149.

  • Hybrid 6500 IDSM-2 inline vlan pair mode

    I am having a problem understanding how a packet is going to know that it needs to get evaluated by the IDSM if it is being sent to a host on a different vlan. First lets say that the server is on a vlan that is being pair and the server host is configured with the GW address of the paired vlan. So if a different host on a different vlan sent a packet to that server how does the MSFC know to sent the packet to the paried vlan to get routed to the servers vlan instead of routing it directly to the servers vlan that is attached to it(msfc). FYI. I followed the admin guides to set this up and it does not cover design or operation packet flows.

    Cisco CatOS on the Cisco Catalyst 6500 Series with optional Cisco IOS Software on the Multilayer Switching Feature Card (MSFC) provides Layer 2/3/4 functionality for the Cisco Catalyst 6500 by integrating two operating systems. A switch running CatOS only on the Supervisor Engine is a Layer 2 forwarding device with Layer 2/3/4 functionality for QoS, security, multicast, and network management of the Policy Feature Card (PFC), but does not have any routing capabilities. Layer 3 routing functionality is provided via a Cisco IOS Software image on the MSFC routing engine (optional in Supervisor 1A and 2, and integrated within Supervisor 32 and 720.) In this paper, the combination of CatOS on the Supervisor Engine and Cisco IOS Software on the MSFC is referred to as the "hybrid" OS; two operating systems work together to provide complete Layer 2/3/4 system functionality.

  • IPS mode with IDSM-2 module on Cat6K

    Hi,
    I have installed the IDSM-2 module on the Catalyst 6509 switch, now I was refering to the configuration guide for IPS 6.0 there are multiple modes I can configure like inline, inline vlan pair, Promiscuous & vlan group mode.. so I'm thinking which one would be the best solution...
    The catalyst 6509 is acting as the CORE/Distribution with multiple Vlan's (around 20 vlans) configured, and customer wants the IPS to be deployed in such a way that it covers the traffic from all the vlans..
    Also note that there is a redundant Cat6509 switch which also has got the IDSM-2 module installed, so can these both IDSM-2 modules be installed in active/standby or active/active combination...
    can someone through some lights on the same please...
    Regards
    Vijay.

    A sensor can enter bypass mode for several reasons, including, but not limited to:
    1) Analysis Engine reconfiguration
    2) Global  Correlation updates
    3) Daily Signature DB self purg
    4) sensorApp failure
    Most of these reasons are benign. I have written Supportability Enhancement CSCtg69012 so that each bypass log will show the reason for entering bypass mode.
    The bug is available via the CCO Bug Toolkit: http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs.
    You may review the bug and click on the "Save Bug" button at the bottom of the page to receive email updates as changes are made to the bug's state.
    To fully diagnose your issue, I suggest opening a TAC case where we will request a "show tech," including debug level logs. This will allow us to see what is triggering the sensor to enter bypass mode.
    Thank you,
    Blayne Dreier
    Cisco TAC IDS Team
    **Please check out our Podcast**
    TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

  • IDSM-2 Inline mode

    Hi,
    I am working with the IDSM-2, We have Cisco 6509 with CSM & FWSM, We are planning IDSM-2 in Inline mode and now i want to monitor the traffic which is coming through Outside Interface of the FW context ( Which is nothing but a VLAN A, VLAN B, Vlan C. on MSFC )
    Data flow :-- ISP RTR---INternal RTR---FWSM---IDSM---MSFC---CSM---
    IDSM version is 5.1(4)S257.0,
    This will support only Two VLAN (IN and OUT) on access mode.
    My problem is I don't know how to scan the traffic of 3 numbers of VLAN (A,B,C).
    Cisco 6509 --- Version 12.2(18)SXF7,

    Hi Udaya,
    I am not able to find out any subinterface.
    I think it is available from IPS 5.1 and this one is IPS5.0(2)
    IDSM2CORE2(config-int)# show settin
    physical-interfaces (min: 0, max: 999999999, current: 3)
    name: GigabitEthernet0/2
    media-type: backplane
    description:
    admin-state: enabled
    duplex: auto
    speed: auto
    alt-tcp-reset-interface
    none
    name: GigabitEthernet0/7
    media-type: backplane
    description:
    admin-state: enabled
    duplex: auto
    speed: auto
    alt-tcp-reset-interface
    interface-name: System0/1
    name: GigabitEthernet0/8
    media-type: backplane
    description:
    admin-state: enabled
    duplex: auto
    speed: auto
    alt-tcp-reset-interface
    interface-name: System0/1
    command-control: GigabitEthernet0/2
    inline-interfaces (min: 0, max: 999999999, current: 0)
    bypass-mode: auto
    interface-notifications
    missed-percentage-threshold: 0 percent
    notification-interval: 30 seconds
    idle-interface-delay: 30 seconds

  • IDSM-2 load balancing on inline mode is it possible ..?

    Hi there .. I am currenty working on a project and need to find out as to whether etherchanelling load balancing can be configured between several IDSM-2 running on inline mode. The IPS 5.1 admin guide states that it is possible for IOS based switches having the IDSM-2 configured on promiscuous mode, however I have heard that it might also be possible to configure etherchannelling load balance when the IDSM-2 are on inline mode. Any help .. commments will be appreciated .. any links to refer to will be even better
    Thanks !!!

    To configure EtherChannel load balancing on IDSM-2, you must install Cisco IOS 12.2(18)SXE and have Supervisor Engine 720. Cisco IOS only supports promiscuous IDSM-2 EtherChanneling using VACL capture (not SPAN or monitor). Refer the URL
    http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html#wp1044800

Maybe you are looking for