topic ips(asa) with ids in Network Security https://community.cisco.com/t5/network-security/ips-asa-with-ids/m-p/466356#M428161 <P>if i have an ASA with the SSM module and i have vlans configured on my LAN, how will i detect intrussion on the vlans? do i still need the ids?</P><P></P><P>thanks a lot</P> Fri, 21 Feb 2020 08:36:23 GMT cfajardo1_2 2020-02-21T08:36:23Z ips(asa) with ids https://community.cisco.com/t5/network-security/ips-asa-with-ids/m-p/466356#M428161 <P>if i have an ASA with the SSM module and i have vlans configured on my LAN, how will i detect intrussion on the vlans? do i still need the ids?</P><P></P><P>thanks a lot</P> Fri, 21 Feb 2020 08:36:23 GMT https://community.cisco.com/t5/network-security/ips-asa-with-ids/m-p/466356#M428161 cfajardo1_2 2020-02-21T08:36:23Z Re: ips(asa) with ids https://community.cisco.com/t5/network-security/ips-asa-with-ids/m-p/466357#M428162 <HTML><HEAD></HEAD><BODY><P>Hello</P><P></P><P>The IPS or IDS comes into picture when traffic hits the sensing interface and flows through the IPS... Now, you have VLANs on the local core switch , which is not in the IPS segment. Hence, the traffic between VLANs will not be seen or stopped by the IPS.</P><P></P><P>In case you have a 6500 chassis in your core, you can use a Network Analysis module and see the traffic flowing on all VLANs. Netflow can clearly give you data about the source/destination IP/port, through which you can detect attacks to a certain extent. </P><P></P><P>If you have servers, which has to be protected on the VLAN, i would advice you to have Cisco Security Agent on them, which will work as a Host ids... </P><P></P><P>Hope this helps.. let us know your views on this.</P><P></P><P>Raj</P></BODY></HTML> Thu, 22 Dec 2005 12:58:34 GMT https://community.cisco.com/t5/network-security/ips-asa-with-ids/m-p/466357#M428162 sachinraja 2005-12-22T12:58:34Z