topic Re: IDSM failover in Network Security

IDSM failover

Antonsibir — Sun, 10 Mar 2019 12:06:00 GMT

Hello,

Is there any failover mechanism for two IDSM installed in different 6500 chassis(chassis are configured as VSS)?

Re: IDSM failover

avanzaadmin — Fri, 20 Aug 2010 12:07:39 GMT

Hi Anton

Depending on how you use the IDSM, inline or promiscuous, I would suggest looking into the Multi Chassi Ethernet option available with VSS. If both IDSM join the port channel and share the traffic that would in effect make then a failover pair.

Regards

Fredrik

Re: IDSM failover

Antonsibir — Fri, 20 Aug 2010 12:21:20 GMT

Hi Fredrik,

Thank you for reply! It's necessarily to configure inline mode. Could you please explain more exact or give me a link?

Re: IDSM failover

avanzaadmin — Fri, 20 Aug 2010 12:51:33 GMT

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_idsm2.html#wp1044800

Here's the link to the IPS 7.x CLI mnaual regarding setting up and sharing an etherchannel across two IPSmodules. Just top of my head I would use inlineVLAN pair, that way I would save one interface for the future. I would then have my incoming data ports connect to one VLAN (Side A) and the outgoing data on the other VLAN (Side B).

/Fredrik

Re: IDSM failover

Antonsibir — Fri, 20 Aug 2010 13:02:13 GMT

Thank you for link. But AFAIK there is no ESLB support for IDSM in different chassis. Link that you sent me is for load balancing in the same chassis. Do you mean that I need similar EtherChannel and inline VLAN pair mode configurations on both IDSM and then I need to connect both IDSM by multichassis ethernet?

Re: IDSM failover

avanzaadmin — Fri, 20 Aug 2010 14:52:47 GMT

That was my general idea, since VSS operationally is the same chassi it might work depending on which data flow you need to monitor.

/Fredrik