topic Re: Using IDSM with FWSM in multiple context in Network Security

Using IDSM with FWSM in multiple context

cisco_lite — Sun, 10 Mar 2019 11:28:40 GMT

Hi,

I would like to know whether it is possible to use IDSM across two distinct contexts in FWSM.

Re: Using IDSM with FWSM in multiple context

Syed Iftekhar Ahmed — Mon, 26 Jan 2009 20:27:53 GMT

Yes you can.

In promiscous mode you tap the required traffic (All fwsm context Vlans) at Switch and copy that traffic to IDSM.

Syed

Re: Using IDSM with FWSM in multiple context

cisco_lite — Mon, 26 Jan 2009 20:40:36 GMT

Thanks Syed.

If I were to use inline mode, when there are distinct active contexts across two FWSMs; will it be possible.

Re: Using IDSM with FWSM in multiple context

Syed Iftekhar Ahmed — Mon, 26 Jan 2009 22:35:54 GMT

Yes you can.

You can configure IDSM-2 in inline VLAN pair mode. IDSM-2 performs VLAN bridging between pairs of VLANs within the same data port operating as an 802.1q trunk.

IDSM-2 has two data ports (sensing ports).

You can configure IDSM-2 to simultaneously bridge up to 255 VLAN pairs on each data port.

So with two sensing ports you can have 2 x 255

inline vlan pairs.

(Obviously its not recommended to have so many vlan pairs. Remember that IDSM throughput is hardly 500Mbps and it can easily become a bottleneck in front of FWSM which has much higher throughput)

HTH

Syed

Re: Using IDSM with FWSM in multiple context

cisco_lite — Mon, 26 Jan 2009 23:26:31 GMT

Thanks.

Once more for clarity.

Lets say contextA is active on FWSM1 placed in Cat6500(1) and contextB is active on FWSM2 placed in Cat6500(2). IDSM(1) is installed on Cat6500(1) and IDSM(2) is installed on Cat6500(2).

Can both the active contexts on different FWSM be inspected by the IDSM simultaneously. Which IDSM shall inspect which FWSM. Is it 1 to 1 and 2 to 2.

Re: Using IDSM with FWSM in multiple context

Syed Iftekhar Ahmed — Tue, 27 Jan 2009 01:04:51 GMT

Unlike FWSM/ACE where you could have one FWSM active & other standby, In IDSM there are no such states.

You will have to extend all FWSM & IDSM vlans over trunk between two switches and then configure STP (Spanning tree protocol)such taht it will make one path in forwarding mode and other in Blocking mode.

For example if context1 is active in SW1 & standby in SW2. Then STP will ensure that link b/w Active context1 (of SW1) & IDSM(of SW1) is in forwarding state & link between b/w stdby context1 (of SW2) & IDSM(of SW2) is in blocking state.

Syed

Re: Using IDSM with FWSM in multiple context

cisco_lite — Tue, 27 Jan 2009 16:03:57 GMT

Would you be able to provide a short example of extending FWSM/IDSM vlans over the trunk and configuring STP where different active contexts reside on both the FWSMs.