topic Re: Redundancy for single IDSM on two separate chassis in Network Security

Redundancy for single IDSM on two separate chassis

new_networker — Sun, 10 Mar 2019 11:16:48 GMT

Can EtherChannel protocol be used to provide active/standby redundancy for single IDSM on two different chassis.

Rgds.

Re: Redundancy for single IDSM on two separate chassis

Farrukh Haroon — Mon, 01 Sep 2008 02:05:08 GMT

Please see the following PDF for more design details:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&topicID=.ee6e1fc&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cc106a7/4#selected_message

Regular ECLB assumes that all links (or IDSM interfaces) are on the same box.

Regards

Farrukh

Re: Redundancy for single IDSM on two separate chassis

new_networker — Mon, 01 Sep 2008 09:15:25 GMT

From the given link, I understand that active/standby redundancy configuration is not possible for IDSM's on two different chassis. Only active/active is possible.

Secondly, please let me know whether the below configuration is for two IDSM's within same chassis or across two separate chassis.

intrusion-detection module 4 management-port access-vlan 100

intrusion-detection module 5 management-port access-vlan 100

intrusion-detection module 4 data-port 1 channel-group 5

intrusion-detection module 4 data-port 2 channel-group 6

intrusion-detection module 5 data-port 1 channel-group 5

intrusion-detection module 5 data-port 2 channel-group 6

intrusion-detection port-channel 5 trunk allowed-vlan 200-204,208

intrusion-detection port-channel 5 trunk allowed-vlan 708

intrusion-detection port-channel 5 autostate include

intrusion-detection port-channel 5 portfast enable

intrusion-detection port-channel 6 trunk allowed-vlan 260,280,400,401

intrusion-detection port-channel 6 trunk allowed-vlan 111-114

intrusion-detection port-channel 6 autostate include

intrusion-detection port-channel 6 portfast enable

Rgds.

Re: Redundancy for single IDSM on two separate chassis

Farrukh Haroon — Mon, 01 Sep 2008 13:17:25 GMT

You can achieve active/standby with spanning tree. You need to tell more detail about your topology to comment further.

This is for two IDSMs installed in the same chassis.

Regards

Farrukh

Re: Redundancy for single IDSM on two separate chassis

new_networker — Mon, 01 Sep 2008 13:25:58 GMT

My scenario is two Cat 6500 Chassis with similar FWSM, ACE, IDSM modules in each.

Now I need to configure redundancy for the IDSM module only in each 6500 chassis.

Thanks.

Re: Redundancy for single IDSM on two separate chassis

Farrukh Haroon — Mon, 01 Sep 2008 15:03:12 GMT

How is your FWSM setup? MSFC Outside or MSFC inside?

Regards

Farrukh

Re: Redundancy for single IDSM on two separate chassis

new_networker — Mon, 01 Sep 2008 18:29:08 GMT

MSFC is outside to the FWSM.

Thanks.

Re: Redundancy for single IDSM on two separate chassis

Farrukh Haroon — Tue, 02 Sep 2008 02:06:49 GMT

The failover will be based on HOW your FWSM mac-address is learnt by the 'inside' devices. Under normal operation The PRIMARY FWSM will be active so all traffic will pass through the IDSM present on that Core Sw. When FWSM failovers all traffic will pass through the SECONDARY FWSM and the IDSM module in the second chassis.

Regards

Farrukh

Re: Redundancy for single IDSM on two separate chassis

new_networker — Tue, 02 Sep 2008 02:58:54 GMT

In short, there is no provision for independnent IDSM failover across two chassis.

Thanks.

Re: Redundancy for single IDSM on two separate chassis

Farrukh Haroon — Tue, 02 Sep 2008 14:51:38 GMT

To my knowledge, NO 🙂

Regards

Farrukh