topic Re: IDSM in Network Security

IDSM

aksher — Sun, 10 Mar 2019 11:15:24 GMT

Which command on IDSM is used to check if the device is running on inline or promiscous mode?

Re: IDSM

Farrukh Haroon — Wed, 20 Aug 2008 06:38:40 GMT

You can see this both from the Cataylyst Switch configuration and the IDS itself.

In the 6500 switch if its inline VLAN pair you will form a trunk to the IDSM like this:

intrusion-detection port-channel 5 trunk allowed-vlan 130,140

If it is Inline Phyiscal interfae you will see something like:

intrusion-detection module 4 data-port 1 access-vlan

In case of promiscious you will have SPAN/capture configuration.

On the IDS cli you can see it via CLI:

physical-interfaces GigabitEthernet0/8

subinterface-type inline-vlan-pair

subinterface 7

vlan1 160

vlan2 760

This is an example of Inline VLAN Pair.

Regards

Farrukh

Re: IDSM

aksher — Wed, 20 Aug 2008 20:10:11 GMT

I can see

inline-interfaces test

no description

interface1 GigabitEthernet0/7

interface2 GigabitEthernet0/8

on CLI of IDSM which means it's in inline VLAN pair but however i can also see SPAN through monitor commands which means it's in promiscous mode. Which is correct?

Re: IDSM

Farrukh Haroon — Thu, 21 Aug 2008 01:36:24 GMT

No you IDS seems to be in 'Inline Interface Pair' mode and not Inline VLAN pair mode and definitely not in promiscuous mode. Those span settings must be for something else on the switch.

In IDM >> Virtual Sensor Configurationyou sill see it spelled out pretty clearly.

If possible post 'show run | inc intrusion' from your core switch.

Regards

Farrukh

Re: IDSM

aksher — Thu, 21 Aug 2008 22:23:31 GMT

Thanks Farrukh! I am sending the output here,

sh run | i intrusion

intrusion-detection module 2 management-port access-vlan 333

intrusion-detection module 2 data-port 1 autostate include

intrusion-detection module 2 data-port 1 portfast enable

monitor session 2 destination intrusion-detection-module 2 data-port 1

Also it would be great if you explain the over all stuff in quick reference style:)

Re: IDSM

Farrukh Haroon — Fri, 22 Aug 2008 02:14:19 GMT

The intrusion detection module is connected to the switch back plane via a 'hidden' link. Which can be seen by show ether channel tough. The IDSM in total has 8 ports. In your configuration the management/command&control port belongs to VLAN 333 (this is port gig 0/1 on the IDSM I think). This port is represented by 'management-port' in the IDSM config.

Ports gig x/7 and gig x/8 are the two 'sensing' ports. These are represented by 'data-port' 1 and 2 in the IDSM config. In you case all data from some interface(s)/vlan(s) is being sent to the 'first' sensing port of the IDSM. So in short you are using promiscuous mode. For more details on what traffic is being sent, have a look at the 'show monitor session' command.

Please rate if helpful.

Regards

Farrukh