topic Re: IDSM2 and FWSM in Network Security

IDSM2 and FWSM

binelipetrov — Sun, 10 Mar 2019 10:59:25 GMT

I have question regarding IDSM2 implementation in FWSM environment.

VLAN 60 is outside interface on FWSM

interface Vlan60

nameif outside

security-level 0

ip address 10.10.60.2 255.255.255.0

Also, on Cisco 6500, I have VLAN 60

interface Vlan60

ip address 10.10.60.1 255.255.255.0

Everything is OK, inside interface on FWSM is SVI 66, everything is UP and FWSM is wporking correctly.

Now, I want to put IDSM2 to monitor ALL traffic between FWSM outside interface and MSFC(6500).

Is it possible? And how?

I know that I need to put some additional VLAN to bridge through IDMS2, creating interface vlan pair (subinterface on data ports of IDSM2), but in thaht case, I am losing connection between FWSM and MSFC

Please help. Thank You

Re: IDSM2 and FWSM

amritpatek — Mon, 18 Feb 2008 15:42:10 GMT

You will need to create a new vlan and then put all traffic between FWSM and MSFC in this vlan. You can also create multiple vlans if required. Then put the vlan for monitoring in the IDSM2. Following link may help you

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliIdsm2.html

Re: IDSM2 and FWSM

hoffa2000 — Wed, 20 Feb 2008 09:54:09 GMT

One solution might also be to SPAN monitor the port channel serving the FWSM. In my case it's po 271. If you filter the SPAN session on only vlan 60 you should get the traffic flowing in and out of the FWSM outside interface towards the MSFC.

I've tried this a few times with a sniffer and it seems to work. Haven't tried it with the IDSM though

/Fredrik

Re: IDSM2 and FWSM

jonix.niebla — Mon, 02 Jun 2008 08:05:05 GMT

Hi,

Hope you have already solved your problem. have you tried changing the inline TCP tracking mode?