topic Virtual IPS/IDS design question. in Network Security

Virtual IPS/IDS design question.

David Kleberson — Sun, 10 Mar 2019 13:27:20 GMT

Hi! I'm having some problems with understanding the design of virtual IPS/IDS.
I know how to do it with hardware IPS/IDS, when you have one physical interfaces specified to handle traffic and another physical interface to to send inspected traffic back to Core.

My question is how do people do it with virtual firewall? I mean how it is possible to configure a server running on VMWare to receive SPAN session (in IDS case) or something like that.

I hope I can clarify my concern.

You can actually do both. If

nspasov — Wed, 16 Sep 2015 19:32:39 GMT

You can actually do both. If you just want to monitor (IDS) then you will have to dedicate a physical port on your VM server and span traffic to it. For more info on that check this link:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004099

If you want to place the virtual appliance inline, then you will have to dedicate two physical ports from your VM server. One of those ports will be used for the outside zone and the other for your inside zone.

I hope this helps!

Thank you for rating helpful posts!

Neno, thank you for your

David Kleberson — Mon, 21 Sep 2015 17:38:56 GMT

Neno, thank you for your reply. Does it mean that I have to sacrifice 1 or 2 physical ports of a host that is running VMware or HyperV?

Yes, otherwise you can't

nspasov — Tue, 22 Sep 2015 00:33:38 GMT

Yes, otherwise you can't really put it truly inline if other hosts/vlans are about to traverse around it 🙂