WAAS WAE Inline Vlans

Switch with trunk to router, whith the wae inline between them I cannot get between vlans, from the wan side I can get to all resource, Any ideas what to configure or look at

Are you trying to only intercept one VLAN or all the VLANs? You can configure this on the inline card's interface or in the CM GUI under the Interception section for that device.
Dan

Similar Messages

WAAS 7574 Inline

Hi,
We are testing a Cisco WAVE 7574 with the WAVE-INLN-GE-4SX inline card.
Setup is as follows:
SWITCH LAYER2 ------>WAVE 7574 ----> LAYER2 WAN -----> WAVE 7574 --->SWITCH LAYER 2
The switch connections are trunk connections with vlan tagged on it and the layer 2 WAN supports VLANs.
Without WAAS ok.
I have added one vlan to test with the WAAS setup, ping goes through, ok , so WAN link is up.
Now, when I add another vlan (2 vlans )and pass production traffic on the other vlan, nothing goes through, not even bypass. My MAC address at all on the switch port connected to the WAAS, no arp replies, just blanking.
WAAS config is all vlans interception with vlan id checking.
My question
1. The WAVE-INLN-GE-4SX does not have indication which sx port is LAN and WAN. Is there a specific way to connect? and is this causing the problem. but ping is going through.
2. What's the purpose of the vlan id checking? I am ot sure to understand what it does and could this cause the problem
The documentation are pretty vague and I thought that inline is straight forward.
WAAS config:
interface InlineGroup 1/0
inline vlan all
exit
interface InlineGroup 1/1
inline vlan all
exit
Switch
description **** TEMP CONNECTION TO WAAS ON MW ****
switchport trunk allowed vlan 3,9
switchport mode trunk
load-interval 30
media-type sfp
no cdp enable
spanning-tree portfast trunk
end
I would be gratful f you could help.

Hello Ashley,
I'll need to do a little more research on your first question before I can provide you with a solid answer; however, in reference to your second question vlan id checking is very important for ensuring that your layer 2 traffic reaches the correct destination. In VTP (vlan trunking protocol) 802.1q vlan ids are added to the frames when sent through trunking ports so that the receiving switch knows what vlan to send the traffic to. (Also keep in mind that if you are trying to talk between different vlans layer 3 connectivity must be enabled. A trunk is solely used to talk to the same vlan on different switches. To go between vlans the traffic will now need to be routed.) Once it makes it to the right vlan it can then be forwarded to the right port. There is a special scenario in 802.1q when the frame does not have a vlan id and that is when the frame is sent from the native vlan.
By default vlan 1 is the native vlan, but this can be changed in configurations. The native vlan does not attach a vlan id to the frames sent from it. The native vlan must be the same on both the sending and receiving switch ports. If it is not your switch will drop the frames as it will not know how to forward the traffic.
Also in your posted verification I saw the command spanning-tree portfast trunk. Portfast is usually a command saved for access ports and not trunks. Special servers with multiple NICs will support that feature however. Do you know if your Wave 7574 supports a portfast trunk connection?
Finally can you provide me some verification outputs for both the vlans and the ports that the traffic is moving across?

IDSM-2 inline VLAN pair mode

My customer has voice, video and data VLAN's. Customer wants to inspect only inter VLAN traffic ONLY for data to be inspected by IDSM-2 inline while bypassing other VLAN traffic to FWSM and then to WAN.
Is that possible with Inline VLAN pair mode?
I read the cisco document which states as below
"You can configure IDSM-2 to simultaneously bridge up to 255 VLAN pairs on each data port. IDSM-2 replaces the VLAN ID field in the 802.1q header of each packet with the ID of the VLAN on which the packet is forwarded. It drops any packets received on VLANs that are not assigned to an inline VLAN pair."
The last statement says it will drop all other vlan traffic which are not assigned to any inline vlan pair?
Regards
Vinod

You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

IDSM-2 inline vlan pair mode configs

Dear all,
1. Is it possible to associate 2 vlans( to be paired) on 2 different data ports on IDSM instead of pairing it on single data port on IDSM ?? & configuring these 2 ports on CAT6509 as access ports instead of trunk... Will this thing work ?
2. Since bypass mode is ON by default(AUTO) in IDSM-2 in-line vlan pair mode but when I am testing the bypass its not happening..can any pls. guide what could be the reason for this ?
Regards,
Akhtar

You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

Filter Traffic using ISDM-2 Inline Mode and Inline VLAN Pairs

Hi Everyone,
I have a new ISDM-2 Module (Version 6.0(1)E1) and I?m thinking use Inline VLAN Pairs to bridge two vlans, in my case vlan 100 and vlan 101. Vlan 100 is the vlan used by MSFC and Vlan 101 is the vlan used by the outside of my FWSM . In this way, I think I can monitor all the traffic into and from Internet. My question is: can I choose what traffic I will analyze using this configuration ? Maybye with VACL or another way.
Thanks in Advanced
Andre Lomonaco

If I understand your question correctly, I do not think you have the ability to selectively inspect the traffic with only a single pair of vlans. The IPS module is going to bridge your vlans together and you would want all traffic to go through that bridge...I don't know what mechanism you'd use to selectively direct traffic through some other bridge/route function.
Within the IPS software you can turn off (disable AND retire) signatures that inspect traffic that you wish to ignore, the IPS will just forward the traffic through, but you don't have a fine level of granularity there.
Scott

Only some of the traffic passing through inline vlan pair

Here is my network setup
   firewall<---- >(g1/2)Coreswitch 6500 with IDSM(TG9/1)<-----> (TG9/1) Distrib switch with FWSM---------Accessswitch
configuration in core switch
interface GigabitEthernet1/2.11
description **** ****
encapsulation dot1Q 211
ip vrf forwarding VRF11
ip address 10.2.11.73 255.255.255.248
ip ospf network point-to-point
standby 1 ip 10.2.11.75
standby 1 priority 110
standby 1 preempt
interface GigabitEthernet1/2.37
description **** ****
encapsulation dot1Q 237
ip vrf forwarding VRF37
ip address 10.2.37.73 255.255.255.248
ip ospf network point-to-point
standby 1 ip 10.2.37.75
standby 1 priority 110
standby 1 preempt
interface TenGigabitEthernet9/1.11
description ****   ****
encapsulation dot1Q 311
ip vrf forwarding VRF11
ip address 10.2.11.2 255.255.255.252
ip ospf network point-to-point
interface TenGigabitEthernet9/1.12
description ****   ****
encapsulation dot1Q 312
ip vrf forwarding VRF12
ip address 10.2.12.2 255.255.255.252
ip ospf network point-to-point
configuration in Distribution switch:
interface TenGigabitEthernet9/1.11
description **** ****
encapsulation dot1Q 311
ip vrf forwarding VRF11
ip address 10.2.11.1 255.255.255.252
no ip route-cache
ip ospf network point-to-point
interface TenGigabitEthernet9/1.37
description ********
encapsulation dot1Q 337
ip vrf forwarding VRF37
ip address 10.2.37.1 255.255.255.252
no ip route-cache
ip ospf network point-to-point
i have seggregated n/w like this. i am using inline vlan pair , to pass all the traffic through the IDSM module ,
i am using the monitoring port gi0/8
config in core switch
intrusion-detection module 8 data-port 2 trunk allowed-vlan 211-260,311-360
IDSM
physical-interfaces GigabitEthernet0/8
subinterface-type inline-vlan-pair
subinterface 11
description
vlan1 211
vlan2 311
exit
subinterface 37
description
vlan1 237
vlan2 337
exit
Problem i am facing is , some of the vlan-pair traffic passing through the IDSM some of the traffic are not passing , here i have given the statistics
MAC statistics from interface GigabitEthernet0/8
   Statistics From Subinterface 11
      Statistics From Vlan 211
         Total Packets Received On This Vlan = 0
         Total Bytes Received On This Vlan = 0
         Total Packets Transmitted On This Vlan = 0
         Total Bytes Transmitted On This Vlan = 0
      Statistics From Vlan 311
         Total Packets Received On This Vlan = 0
         Total Bytes Received On This Vlan = 0
         Total Packets Transmitted On This Vlan = 0
         Total Bytes Transmitted On This Vlan = 0
Statistics From Subinterface 37
      Statistics From Vlan 237
         Total Packets Received On This Vlan = 3189658726
         Total Bytes Received On This Vlan = 64165872092928
         Total Packets Transmitted On This Vlan = 3549575166
         Total Bytes Transmitted On This Vlan = 64165872092928
      Statistics From Vlan 337
         Total Packets Received On This Vlan = 3549575166
         Total Bytes Received On This Vlan = 64165872092928
         Total Packets Transmitted On This Vlan = 3189658726
         Total Bytes Transmitted On This Vlan = 64165872092928
   Statistics From Subinterface 38
      Statistics From Vlan 238
         Total Packets Received On This Vlan = 2215151150
         Total Bytes Received On This Vlan = 64165872092928
         Total Packets Transmitted On This Vlan = 126546964
         Total Bytes Transmitted On This Vlan = 64165866995200
      Statistics From Vlan 338
         Total Packets Received On This Vlan = 126546964
         Total Bytes Received On This Vlan = 64165866995200
         Total Packets Transmitted On This Vlan = 2215151150
         Total Bytes Transmitted On This Vlan = 64165872092928
Give me idea experts , so that i can resolve this issue.
Help me thanks in advance

I believe the issue is because of the config below:
interface GigabitEthernet1/2.11
description **** ****
encapsulation dot1Q 211
ip vrf forwarding VRF11
ip address 10.2.11.73 255.255.255.248
ip ospf network point-to-point
standby 1 ip 10.2.11.75
standby 1 priority 110
standby 1 preempt
encapsulation dot1Q 311
ip vrf forwarding VRF11
ip address 10.2.11.2 255.255.255.252
ip ospf network point-to-point
interface TenGigabitEthernet9/1.12
description ****   ****
encapsulation dot1Q 312
ip vrf forwarding VRF12
ip address 10.2.12.2 255.255.255.252
ip ospf network point-to-point
As you can see we have 2 ip subnets in the VRF 11 .73 & .2 in vlan 211 & 311 respectively.
The switch is doing intervlan routing directly without having to go through the IDSM for VRF 11.
What we need to remember is IDSM does not do routing, and it can only bridge vlans.
Hence we have to force to packet to go through the IDSM.
Here is what we do when we use IDSM to see traffic going between vlans.:
Normally, with vlans, and IDSM inline mode, we have one IP subnet and 2 Vlans.
IDSM2 in inline mode necessitates an additional artificial Vlan on the SAME subnet as the Vlan you wish to sense.
A layer 3 switch interface needs to be configured within this additional artificial Vlan.
In a nutshell, we need to create 2 Vlans that share one same ip subnet and put SVI on only one of the Vlans.
In your case you will need one ip between vlans 211 & 311 in VRF 11 to force the data to go through the IDSM.
I can understand if this is a bit tricky to understand.
Please go through my design document for IDSM inline mode, which explains the basic concepts and packet walk in detail.
It will explain why we need the above and how arp makes the mac-address table populate correct entries, (with one ip subnet for 2 vlans) so that traffic goes through the IDSM.
https://supportforums.cisco.com/docs/DOC-12206
- Sid

IDSM-2 Inline Vlan Pair - Duplicate Packets

Dear All
We have a setup where two IDSM-2 modules are ether-channeled together in a single 6513 Chassis.
There is an FWSM module also, which acts as the default gateway for all internal VLANs.
Problem: IDSM show stat virtual-sensor command is showing tons of 'Duplicate Packets'
show statistics virtual-sensor | inc Duplic
Duplicate Packets = 2950967
Inline TCP Tracking Mode: Interface and VLAN
Topology:
Assume Client VLAN = 10 and Server VLAN = 60
IPS Inline VLAN Pairs:
10 >> 110 (Client VLAN)
60 >> 160 (Server VLAN)
Client >> Server Flow: (Layer 2):
[ClientPC] >>>> Access Switch (VLAN 10) >>>> Core SW >>>> IDSM-2 (VLAN 10--110 Pair) >>>> Core Sw >>>> FWSM VLAN 110 >>>>
FWSM VLAN 160 >>>> Core Sw >>>> IDSM-2 (VLAN 160--60 Pair) >>>> Server Switch (VLAN 60) >>>> [Server]
Core Switch IPS Etherchannel Setup:
Group 5: IDSM(A) and IDSM(B) Port x/7
Group 6: IDSM(A) and IDSM(B) Port x/8
Some VLAN Pair(s) are on interface x/7 and others are on x/8
Because of the above issue, we see a lot of TCP normalization signatures being fired (as the IPS gets confused with duplicate packets seen for the same flow). Specially signatures 1330:12 :17 and :18.
It is also causing some applications to break (e.g. Veritas Netbackup 6.5). When I removed the DENY action from these signatures, our IPS started having stability issues (This could also be due to E3 upgrade)
Should we change the Tracking mode to 'VLAN' only, OR any other possible solution?. Should not the 'interface and vlan' setting be sufficient?.
Regards
Farrukh

This will take some traffic analysis to determine what is going wrong.
You might need to place a sniffer to watch the traffic on the client where the backup software is running at the same time that you capture the traffic on the sensor.
Look to see if there are any differences in the traffic.
Look for any anomalies in the traffic.
Look to see if maybe the backup software is not using a standard TCP connection (is it jumping the tcp sequence numbers in any abnormal way?)
You might also try some things on the sensor to determine if the sensor itself might have an issue.
Determine if the connction passes through 2 connections (inline vlan pairs) monitored by the sensor.
If you can, you might try removing both of the pairs from the virtual sensor. (don't delete the pairs, just remove them from the virtual sensor so they won't be analyzed)
And see if the backup works.
If it does then just add in one pair, and see if it keeps working.
If it has errors with just the one pair, then the problem is likely not because of the connection being monitored twice.
Something else must be weird about the connection.
If the problems are only seen when having both pairs in the same virtual sensor, then try placing the pairs in different virtual sensors and see if the problem goes away.
If the problem goes away when in different virtual sensors, then there may be an error in the inline tcp session tracking code that should track connections separately for each interface/vlan.

IDS 4215 Inline VLAN Pair

I am trying to configure IDS 4215 to do inline vlan pair with a Cisco 3750 Layer 3 switch.
We have 4 vlans in the 3750, vlan 100 for workstations,vlan 200 for servers, vlan 250 for ip phones and vlan 150 for firewalls.
All vlans have corresponding SVI with that ip been the default gateway for each vlan.
interface Vlan1
no ip address
interface Vlan100
description Workstation VLAN
ip address 192.0.0.5 255.255.255.0 secondary
ip address 192.0.0.254 255.255.255.0
interface Vlan150
description WatchGuard FW VLAN
ip address 192.168.150.254 255.255.255.0
interface Vlan200
description Servers
ip address 192.168.200.254 255.255.255.0
interface Vlan250
description VOICE
ip address 192.168.250.254 255.255.255.0
ip helper-address 192.168.200.30
interface Vlan254
description Management VLAN
ip address 192.168.254.254 255.255.255.0
My question is how do i monitor the traffic going to firewall vlan from server/workstation vlans ?
I read a quite a bit of old topics here in this forum but could not find anything matching though there were few coming close.
So my idea is to configure new vlan say 151 and move the firewalls to the new vlan.Then do inline vlan pair on old firewall vlan 150 and new fw vlan 151.
Any idea its going to work ? or can i simply do 2 vlan inline pairs for fw-server and fw-workstation vlans ? Also i understand that i have to configure trunking on switch ports ?
would appriciate any comments.

I would recommend you proceed with your first suggestion of creating vlan 151, moving the firewall ports to vlan 151, and then placing the sensor inline between vlans 150 and 151.
There are 2 options for placing the sensor between vlans 150 and 151: inline interface pairing, or inline vlan pairing.
With inline interface pairing you would need the 4FE card in the IDS-4215. Create an inline interface pair using Fe2/0 and Fe2/1.
Create an access port on vlan 150 of your switch and connect Fe2/0.
Create an access port on vlan 151 of your switch and connect Fa2/1.
Allow spanning-tree to run (generally between 30 and 40 seconds).
With InLine Vlan Pairing you can do this with an IDS-4215 without needing the 4FE card.
Create an inline vlan pair subinterface on Fe0/1 that will pair vlans 150 and 151.
Creat an 802.1q trunk port on your switch that will trunk just vlans 150 and 151 (leave the native vlan of the trunk as vlan 1, but do not place vlan 1 in the list of allowed vlans on the trunk)
Connect Fe0/1 to your trunk port.
Now this will cause All traffic between your internal networks and the firewall to have to pass through the sensor. This includes your voice traffic that goes through the internet.
The other option you mentioned of creating inline vlan pairs on your workstation vlan and your server vlans, I would not recommend with IPS 5.1.
The inline vlan pairs would have to be created similar to the inline vlan pair I described above using vlans 150 and 151.
You would have to create vlan 101 and pair 100 and 101.
As well as create 201 and pair 200 and 201.
If the workstations ONLY have connections out through the Firewall and NOT to the servers then it would be OK.
BUT if the workstations also have connections to the servers then it will cause problems. The packets will have to pass through both the vlan 100 and 101 pair as well as the vlan 200 and 201 pair.
When the sensor sees the same packet again after having been routed (by the switch in this case) it causes issues. The sensor sees that the packet has changed and believes that a hacker is modifying packets on the network.
This is being addressed in IPS version 6.0 (still under development) so that vlan pair 100 and 101 can be monitored independant of vlan pair 200 and 201.
So until IPS 6.0 is released I would suggest staying with the single vlan pair approach using vlan pair 150 and 151.

6509 - IDSM-2 inline vlan pair mode at layer 3

I am a little green, so be nice.
wondering how to get an IDSM-2 module inline on a 6509. my issue is that the traffic comes into the 6509 at layer3 (routed) so I'm not sure how the config works. (e.g. do I use a trunk, or do I have to add a in a hop somehow)
6509 conf snippet:
intrusion-detection module 7 data-port 1 trunk allowed-vlan 3127,3128
vlan 3127
name FIREWALL-IPS
vlan 3128
name FIREWALL
interface Port-channel2
description CAB2
ip address 10.30.2.2 255.255.255.0
ip helper-address 10.10.20.11
ip helper-address 10.10.20.13
ip helper-address 10.30.123.11
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
glbp 2 ip 10.30.2.1
glbp 2 timers msec 250 msec 750
glbp 2 priority 120
glbp 2 preempt delay minimum 60
glbp 2 load-balancing weighted
glbp 2 weighting track 89 decrement 50
glbp 2 weighting track 99 decrement 50
glbp 2 forwarder preempt delay minimum 60
interface GigabitEthernet1/9
description FIREWALL
switchport
switchport access vlan 3128
switchport mode access
no ip address
interface GigabitEthernet8/9
description CAB2SW1-Gi1/0/49
no ip address
channel-group 2 mode on
interface GigabitEthernet9/9
description CAB2SW1-Gi1/0/50
no ip address
channel-group 2 mode on
interface Vlan3128
description FIREWALL
ip address 10.30.128.2 255.255.255.0
no ip redirects
no ip unreachables
ip flow ingress
no ip igmp snooping
glbp 128 ip 10.30.128.1
glbp 128 timers msec 250 msec 750
glbp 128 priority 120
glbp 128 preempt delay minimum 60
glbp 128 load-balancing weighted
glbp 128 forwarder preempt delay minimum 60
IDSM-2 conf snippet:
service interface
physical-interfaces GigabitEthernet0/7
description data-port 1
subinterface-type inline-vlan-pair
subinterface 1
description FIREWALL VLAN3127<->VLAN3128
vlan1 3127
vlan2 3128

A colleague of mine explained how to do this and it mostly makes sense. My only confusion is that once you remove the access vlan (3128) from the interface that gets monitored and replace it with 3127, how does traffic still traverse the 3128 vlan? What is the mechanism that controls this, is it the command "intrusion-detection module 7 data-port 1 trunk allowed-vlan 3127,3128" ??

Issue - Inline VLAN pair IPS

Hello everyone,
I have an issue with an 4255 IPS using an inline VLAN pair. Here's the rough sketch of the topology:
SW1
port 1 access vlan 10 - PC (10.20.30.2/24)
port 48 trunk to SW2 - all vlans allowed and forwarding
SW2
port 48 trunk to SW1 - all vlans allowed and forwarding
port 1 trunk allowed vlan 10,20 to IPS g0/1 configured in inline VLAN pair; assigned to sensor etc.
SVI vlan 20 for network 10.20.30.1/24 (up/up)
I'm unable to ping SVI from PC. Anyone have any suggestions? Running packet display on IPS interface I only see BPDUs hitting the interface. VTP is enabled but pruning is disabled. Both vlans exist on both switches.
I'm only seeing ARP requests from SVI on the IPS, but no replies coming from the remote switch.
Alternatively the PC is sending ARP requests to the SVI IP, but those aren't getting resolved, nor are they getting to the IPS interface.

Hello Yuriy
So Topology is something like
PC-----ACCESSPORT----SW1----TRUNK----SWITCH2
                                                                 |
                                                                 |
                                                               IPS Inile vlan pair
The thing is that if you already allow the vlans on the trunk link then traffic will not get inspect by the IPS,
Do you see what I mean, you must force it to go to the IPS.
Let me know if I was clear enough

IPS Interface Pairs vs. Inline VLAN Pairs

       I've got a Cisco IPS 4240 that needs to be configured inline. Right now I've got an ASA 5525-X with two interfaces (inside and DMZ) plugged into our Catalyst 6500 Switch that need to be monitored by the IPS. I also plugged two interfaces from the IPS into the same Catalyst switch hoping that I could use the inline VLAN pairs to monitor that traffic. I've got several VLANs in our DMZ and LAN that need to be monitored. The problem is that I don't understand how the inline VLAN pairs are supposed to work (Cisco's IPS documentation is almost useless), I've been fighting with it for some time with no success.
     I'm now thinking that it might be a better idea to plug the two interfaces from the ASA directly into the IPS and then create Interface Pairs from the IPS to the switch. My concern with doing this is that I am turning the IPS into a single point of failure, if it goes down everything goes down with it.   Also, will the Interface Pairs work with a 802.1q trunk? Would I then need to create VLAN groups for the trunk? Would using inline VLAN pairs also create a single point of failure?
     Basically, I'd like to know the pros and cons to the Interface Pairs vs. the Inline VLAN pairs. Interface Pairs seems like the easiest and most comprehensive way to go, but if I can avoid the single point of failure with the inline VLAN paris I would like to go that route.

Hello Paul,
I want to go with Inline vlan pair,i don't want to go with interface pairing,as this is request by customer,how i can do it,as i m having a IPS-4240 with 4 gig ports,
I have a doubt that if we create a vlan pair then in each pair 1 be a real vlan and the other should be dummy vlan ???? ( for example vlan 2 and vlan 3 in which vlan 3 is the dummy vlan). Please suggest
If i have a 10 vlan than i will configure the 10 pair of vlan on gig0/0 with real and dummy vlan, but what vlan pair i shld configure on gig0/1 i.e (exit interface to ASA DMZ interface.)
Thanks
Message was edited by: adamgibs7

Help with inline VLAN Pair and switch configuration

Hello,
I'm new to IPS and IDS in general, but I have an IPS-4255 and a couple of Catalyst 2900 switches to experiment with. I'm currently trying to enable an Inline VLAN Pair configuration on the IPS and have a simple setup.
SW1 and SW2 have vlans 100 and 200 configured. PC1 and PC2 are on the same IP range (no routing). PC1 on vlan 100 connects to Sw1. PC2 on vlan 200 connects to SW2. The IPS connects to a SW2 trunking port, and SW1 and SW2 are connected together on another trunking port.
I know that my trunking is working because PC1 and PC2 can ping each other whenever they are on the same vlan of either switch. But, they can't ping when on the separate vlans.
From what I've read, the IPS with an Inline VLAN Pair acts as a bridge between the two vlans and should forward the traffic if it passes inspection. However, the IPS does not appear to see any traffic at all.
My IPS is configured with inline VLAN pair 100->200 and associated to vs0.
Have I missed something in my config somewhere? Or am I misunderstanding how inline VLAN Pairs are supposed to work?
Below are my configs for the switches and the IPS.
Any help would be appreciated. Thank you!
IPS Config
service interface
physical-interfaces GigabitEthernet0/0
no description
admin-state enabled
duplex auto
speed auto
alt-tcp-reset-interface interface-name GigabitEthernet0/3
subinterface-type inline-vlan-pair
subinterface 1
description test
vlan1 100
vlan2 200
exit
exit
service analysis-engine
virtual-sensor vs0
physical-interface GigabitEthernet0/0 subinterface-number 1
inline-TCP-session-tracking-mode vlan-only
exit
exit
SW1 and SW2 config
interface FastEthernet0/1
switchport access vlan 100
interface FastEthernet0/9
switchport access vlan 200
interface FastEthernet0/18
switchport trunk encapsulation dot1q
switchport mode trunk
interface FastEthernet0/24 (Sw 2 only)
description IPS port
switchport trunk encapsulation dot1q
switchport mode trunk

It has been awhile since I've dealt with a 2900 switch to I am just trying to guess at what may be wrong with your setup.
I noticed that neither of your trunk port configuration are specifically stating which vlans are allowed on the trunks.
It is possible that for the trunk between the 2 switches there may be some protocol negotiation so the switches can determine which vlans to trunk, BUT no such negotiation will happen with the sensor. If I remember right you will need to specifically state which vlans the trunk to the sensor should carry. If I remember right the commmand would be something like:
switchport trunk allowed-vlan 100,200
You will want to find the show command on your switch that will show you which vlans are actually being trunked by the port. It might be something like "show switchport trunk"
And you will want to verify that the switch is actually trunking vlans 100 and 200 to your sensor.
On your sensor you will want to execute "show interfaces" and look at the statistics for Gig0/0 to see if it is receiving packets on vlan 100 and 200.
You can also run "packet display GigabitEthernet0/0" to see if any packets are making it to your sensor.
You will also want to check Link status and make sure your sensor is linking up properly with your switch. A common mistake is to connect the wrong ports, as some sensors do not have the port numbers clearly marked.
NOTE: If the above doesn't help, then take the additional step of eliminating the second switch. Attach both pcs to the same SW2 switch (1 in each vlan). The second switch isn't necessary to test the inline vlan pair functionality. Connecting both PCs to the same switch will help eliminate any possibility of misconfiguration between the 2 switches.

WAE Inline Adapter and High Availability

What is the recommendation to achieve high availability (and load sharing?) using two WAE's in a DC with inline adapters being used for interception rather than WCCPv2? Any ideas greatly appreciated.

Ken,
Generally I would recommend interception with either WCCP or a L4-7 load balancer like ACE/ACE Appliance/CSM. Both of these are considered best practice for DC deployments as they both can handle high amounts of traffic, can handle WAEs going offline and can load balance many WAEs in a cluster. WCCP might be slightly more flexible where and how you can deploy it.
Both of the following interception techniques are not recommended for data centers, but I list just as FYI:
- Inline cards in appliances can be configured in serial to give you high availability, but you don't get load balancing. The second appliance only starts optimizing traffic once the first WAE starts passing traffic through on overload. Inline interception is usually used for remote offices, however it has been deployed in DCs.
- PBR can be configured for high availability with next-hop features, however there is no available load balancing. The first WAE has to fail completely and then a second WAE can come into play. Overloaded traffic is not optimized at all.
Hope that helps,
Dan

WAAS Deployement : Inline Vs Off-path

Hi All,
I would like to get your expertise on deciding suitable deployement method.
We have to deploy the WAAS solution between a DC and 70+ branch locations ( expected TCP connections in each <= 200) which are connected through provider managed MPLS cloud . Decided to use WAE 7341 (with WCCP redirection method)as the WAE in DC side but when it comes to branch side still thinking between INLINE ( WAVE 274) vs WCCP (ISR router with NME) . Basically , would like to understand more about ..
a) Difference between Inline and Off-path deployement in all aspects.
b) Does inline deployement with WAVE 274 ( has 2 NIC ) passes through the traffic in case of Power / device failure
We have been did PoC with WCCP method , it was very stable and got good respone. We would like to use inline method as it is the low cost solution, if it can provide same level STABLITIY + RESPONSE.
Regards,
Maria

Hi Maria,
I don't know exactly which aspects you are interested in but usually, WCCP is used when we want to spread the load over multiple WAE as it is easier to achieve then with Inline interfaces.
Now, as in your case, you'll be only using one NME, so it doesn't apply.
Another difference is that the module is integrated inside your router while the WAVE obviously isn't so it will require additional cabling in your network.
Inline acceleration will not add any processing load to your router while WCCP will. Even if this load increase might not be that high, you might want to think about it if your routers are already heavily used.
If you have any other aread you would like to get more info on, let me know and I'll see what I can do for you.
Regarding your question on what would happen if the WAVE gets powered off or fails completely, the inline interface has an hardware bypass mechanism that will kick off if this occurs and the device will simply start bridging the traffic between the two sides of the interface, preventing a network outage.
Regards,
Nicolas

Waas without subinterfaces vlans on router

Hi my name is Ivan:
I have a wave 274, wae 674 and wave 574, and i would like to deploy the WAAS in this way:
Cisco wae central manager and wae core attached in the switch core 3750 in stack ( WS-C3750G-24TS-S1U and WS-C3750G-12S-S) with IOS
c3750-ipbase-mz.122-35.SE5.bin. But i want to configuring like it:
Switch Core Stack
int gig 0/x
description Link SwitchCore>>WAECentralManager
switchport mode access
switchport access vlan 100
int gig 0/y
description Link SwitchCore>>WAECore
switchport mode access
switchport access vlan 200
int gig 0/z
description Link SwitchCore>>RouterWAN
switchport mode access
switchport access vlan 300
int vlan 100
description VlanWAECentralManager
ip wccp 61 redirect in
ip add 10.0.41.1 255.255.255.0
int vlan 200
description VlanWAECore
ip wccp redirect excluded inn
ip add 10.0.42.1 255.255.255.0
int vlan 300
descripton VlanRouterWAN
ip add 10.0.43.1 255.255.255.0
int vlan 400
description VLan ServerFarm
ip wccp 61 redirect in
ip add 10.0.44.1 255.255.255.0
Config Router WAN
Int gig 0/a
description Link WAN
ip add 190.41.227.26 255.255.255.248.0
ip wccp 62 redirect out
int gig 0/b
description Link LAN
ip add 10.0.44.2 255.255.255.0
My question is: Is OK this configuration or there is something wrong?
Please could you help me
Regards
Ivan

hi,
as i wrote in my previous post, i'm using pfsense as software appliance on an intel-based server with one internal nic and extended by a 4-port nic. internal nic is WAN, 2 ports of the extended nic are LAN and DMZ.
in my opinion my problem has nothing to do with inter-vlan connectivity. i've forgotten to say, that servers have 2 nics inside, one belonging to DMZ, the other to LAN. but if a request from WAN belongs to a public ip (DMZ), the router forwards to DMZ vlan on the switch, and the switch to the DMZ nic of the server. in my opinion the response should go the other way round, but obviously it's not.
if i do a traceroute from an internal server's public ip nic to an other's LAN nic, it goes over the router. so vlan's are seeming to be ok. so what way a request to a public ip can be responded over the LAN uplink of the switch?!

WAAS WAE Inline Vlans

Similar Messages

Maybe you are looking for