topic Re: IDSM-2 Inline mode in Network Security

IDSM-2 Inline mode

isgphyd12 — Sun, 10 Mar 2019 11:05:22 GMT

Hi,

I am working with the IDSM-2, We have Cisco 6509 with CSM & FWSM, We are planning IDSM-2 in Inline mode and now i want to monitor the traffic which is coming through Outside Interface of the FW context ( Which is nothing but a VLAN A, VLAN B, Vlan C. on MSFC )

Data flow :-- ISP RTR---INternal RTR---FWSM---IDSM---MSFC---CSM---

IDSM version is 5.1(4)S257.0,

This will support only Two VLAN (IN and OUT) on access mode.

My problem is I don't know how to scan the traffic of 3 numbers of VLAN (A,B,C).

Cisco 6509 --- Version 12.2(18)SXF7,

Re: IDSM-2 Inline mode

vinod.rathi — Fri, 02 May 2008 08:33:33 GMT

You can use inline VLAN pair mode to monitor traffic coming on specific VLANS. For eg

You have VLAN 100,200 and 300 on MSFC that you intend to monitor inline.

You need to configure VLAN 101,201 and 301 (L2 only) and send VLAN 100-101,200-201,300-301 to IDSM-2.

You then need to create VLAN pairs on IDSM-2 module as below

1 - VLAN 100-101 - pair 1

2 - VLAN 200-201 - pair 2

3 - VLAN 300-301 - pair 3

Then assign above three pairs to Virtual sensor and it will monitor this traffic for inline operation.

Inline VLAN pair mode is based on VLANs, so it doesnt really matter whether VLANS are behind or front of FWSM.

Cheers,

Vinod

Re: IDSM-2 Inline mode

uchimaku — Sun, 04 May 2008 06:15:00 GMT

You need to configure 3 inline vlan pairs . Suppose you are interested in monitoring vlan A, B , C and your MSFC is in vlan D. You need to configure 3 vlan pair such as

vlan A ,D

Vlan B, D

vlan C, D

You can refer the below link for coniguring inline vlan pair

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliIDSM2.html#wp1067639

Hope it helps

Re: IDSM-2 Inline mode

isgphyd12 — Mon, 05 May 2008 03:40:57 GMT

Thanks Vinod and Uchimaku, i am planning for the installation at production environment, hope you guys will be available in case of any problem.

Thank you,

Re: IDSM-2 Inline mode

zujalal — Mon, 05 May 2008 14:27:43 GMT

Hi.

I dont think you can use the same VLAN ID in multiple pairs. You cannot use VLAN D as per the above example in all the pairs.

You might need to create dummy L2 vlans for everyvlan that you want to monitor. Move the IP address from the actual VLAN interface to the newly created vlan interface.

e.g. If you have

interface vlan A

ip address A.A.A.A .......

You will have to create a VLAN X.

vlan x

interface vlan x

ip address A.A.A.A ......

Now use the IDSM to configure pairing between A and X

IDSM will simply bridge the two vlans together.

HTH.

Re: IDSM-2 Inline mode

isgphyd12 — Tue, 06 May 2008 11:22:04 GMT

Hi,

As mentioned my front end is FWSM--MSFC--, so i don't have any ip address assigned on that vlan it is just a L2 vlan, so now what ?

One more thing, which I want to clarify, is that VLAN Pair configuration provides the Hardware bypass.

Re: IDSM-2 Inline mode

vinod.rathi — Tue, 06 May 2008 12:05:10 GMT

your dummy vlan (for every fwsm vlan) will be the actual end user vlan. (switchport access vlan command).

IDSM-2 will just bridge the dummy vlan with the actual vlan in pair.

Vinod

Re: IDSM-2 Inline mode

isgphyd12 — Wed, 07 May 2008 03:17:31 GMT

Vinod,

My actual VLAN 10 and i created one more dummy VALN 101, so do I need to change the FWSM configuration also like

From

firewall module 1 vlan-group 1,2,3

firewall vlan-group 2 10 100

firewall module 1 vlan-group 1,2,3

firewall vlan-group 2 101 100

so the data flow is just like VLAN10--IDSM2---VLAN 101--FWSM--MSFC

and

correct me if i am wrong, VLAN pair configuration is not available with IDSM-5, i think we need to upgrade the IDSM 5 to 6 and what about Hardware bypass? is hardware bypass is available with VLAN pair?

Please provide me the link for any configuration document of VLAN pair with IDSM-5

Dinesh

Re: IDSM-2 Inline mode

uchimaku — Wed, 07 May 2008 06:12:52 GMT

The link for IDSM running 5.1 which has provision for inline vlan pair http://www.cisco.com/en/US/docs/security/ips/5.1/configuration/guide/cli/cliguide.html

Thanks

Udaya

Re: IDSM-2 Inline mode

isgphyd12 — Wed, 07 May 2008 07:43:19 GMT

Hi Udaya,

I am not able to find out any subinterface.

I think it is available from IPS 5.1 and this one is IPS5.0(2)

IDSM2CORE2(config-int)# show settin

physical-interfaces (min: 0, max: 999999999, current: 3)

-----------------------------------------------

-----------------------------------------------

media-type: backplane

description:

admin-state: enabled

duplex: auto

speed: auto

alt-tcp-reset-interface

-----------------------------------------------

none

-----------------------------------------------

-----------------------------------------------

media-type: backplane

description:

admin-state: enabled

duplex: auto

speed: auto

alt-tcp-reset-interface

-----------------------------------------------

interface-name: System0/1

-----------------------------------------------

-----------------------------------------------

media-type: backplane

description:

admin-state: enabled

duplex: auto

speed: auto

alt-tcp-reset-interface

-----------------------------------------------

interface-name: System0/1

-----------------------------------------------

command-control: GigabitEthernet0/2

inline-interfaces (min: 0, max: 999999999, current: 0)

-----------------------------------------------

bypass-mode: auto

interface-notifications

-----------------------------------------------

missed-percentage-threshold: 0 percent

notification-interval: 30 seconds

idle-interface-delay: 30 seconds

-----------------------------------------------

Re: IDSM-2 Inline mode

vinod.rathi — Wed, 07 May 2008 09:11:03 GMT

Your FWSM configuration will not change and will remain as it is.

FWSM configuration

firewall module 1 vlan-group 1,2,3

firewall vlan-group 2 10 100

MSFC Configuration

Vlan 101

intrusion-detection module "slot-number" data-port "1/2" trunk allowed-vlan 10,101.

IDSM-2 configuration

Click Add.

Interface name - gigabitethernet0/7 or 0/8 (this corresponds to data port 1 or 2)

Subinterface number - 1

VLAN A - 101

VLAN B - 10

Give a description and click Apply

Next go to analysis engine - virtual sensors

select the pair you created above and click on apply. (This creates the inline vlan pair and bridges the 2 vlans).

Try generating some attacks from end user vlan (101) and see idsm-2 blocking attacks.

goodwills

Vinod

Re: IDSM-2 Inline mode

sureshkum — Fri, 09 May 2008 03:23:11 GMT

Hi Vinoth,

Ur posts are helpful for me to understand the Inline VLAN pair deployment.So then how to send log to the destination, where my IEV is installed in one of the Vlan in FWSM. Kindly provide me the config steps also..

Re: IDSM-2 Inline mode

vinod.rathi — Fri, 09 May 2008 04:28:22 GMT

IDSM-2 logs are sent using the management interface gig0/2. Depending on your management VLAN (either on FWSM or MSFC) where your IDSM-2 is placed, you might need to do the configuration accordingly.

Vinod

Re: IDSM-2 Inline mode

sureshkum — Fri, 09 May 2008 07:14:34 GMT

Hi Vino,

Thanks.Let say my Managent Vlan is in FWSM(VLAN 120). I need to monitor Vlan's 100, 160, 130, 140. So if that is the case..Kindly provide me configuration steps for sending logs to Mgmt Vlan 120.

Re: IDSM-2 Inline mode

isgphyd12 — Fri, 25 Jul 2008 05:38:32 GMT

Hi,

I am done with the config (Inline VLAN PAIR), but i am not able to see any logs at event viewver.

I enabled all FTP & MSN signatur but there is not logs for the same and able to access the internet services.

any one can help me out to trouble shoot the problem ?

Regards.