topic Re: IPS monitoring in Network Security https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783551#M86325 <HTML><HEAD></HEAD><BODY><P>Oh -- and you can't really feed the internals from an external feed from the other switch, so you'd need to get 2 IDSM2s, I think (You might be able to use either RSPAN or something like that, but I'm not sure you'd really want to do that, just from a 'keeping everything straight' perspective). </P><P>..N</P></BODY></HTML> Tue, 26 Jun 2007 13:46:45 GMT Nick Egloff 2007-06-26T13:46:45Z IPS monitoring https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783549#M86323 <P>Can an IPS module monitor traffic for (2) 6500s working in load balancing mode?</P> Sun, 10 Mar 2019 10:40:30 GMT https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783549#M86323 jmutuski 2019-03-10T10:40:30Z Re: IPS monitoring https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783550#M86324 <HTML><HEAD></HEAD><BODY><P>When you say IPS module, do you mean an in-chassis one like an IDSM2, or an external one? </P><P></P><P>An external one can use a SPAN from each core to take 'copies' of the traffic you want, but you have to watch for oversubscription and overall IDS throughput. </P><P></P><P>Even the internal IDSM2 can only technically handle 600mbps throughput, so can be oversubscribed. </P><P></P><P>The one thing "funny" I've seen in my 4 years with the SPAN/6500/external IDS (4250XL I think) is that I get a lot of spoofing messages; my guess is that it's related to the duplication of messages in the 2 SPAN ports (which span specific VLANs) feeding the single IDS. </P><P></P><P>If this helps, please drop it a quick rating.. </P><P>Thanks!</P><P>...Nick</P></BODY></HTML> Tue, 26 Jun 2007 13:45:25 GMT https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783550#M86324 Nick Egloff 2007-06-26T13:45:25Z Re: IPS monitoring https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783551#M86325 <HTML><HEAD></HEAD><BODY><P>Oh -- and you can't really feed the internals from an external feed from the other switch, so you'd need to get 2 IDSM2s, I think (You might be able to use either RSPAN or something like that, but I'm not sure you'd really want to do that, just from a 'keeping everything straight' perspective). </P><P>..N</P></BODY></HTML> Tue, 26 Jun 2007 13:46:45 GMT https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783551#M86325 Nick Egloff 2007-06-26T13:46:45Z Re: IPS monitoring https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783552#M86326 <HTML><HEAD></HEAD><BODY><P>definitely helps.</P><P></P><P>Thanks,</P></BODY></HTML> Tue, 26 Jun 2007 13:47:29 GMT https://community.cisco.com/t5/network-security/ips-monitoring/m-p/783552#M86326 jmutuski 2007-06-26T13:47:29Z