Cisco IPS in HealthCare - PACS - DICOM traffic

[p-allen]

Has anybody know of someone who has implemented the Cisco IPS in a Healthcare network with PACS traffic. When we put the IPS unit inline with a WAN site that has PACS traffic we are seeing a significant slowdown of the transfer speeds from the remote site to the PACS server

[p-allen]

anyone???

[mhellman]

I'm not familiar with PACS, but have a look at this post by marcabal.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dde73c1/0#selected_message

Also, have you gotten a trace on both sides of the sensor? Do they look normal?

[p-allen]

How do I get a trace on both sides of the sensor ?

[mhellman]

You could do it right on the client and server. You can also do it on the sensor from the cli using the "packet capture" command. You'll be limited to so many MB though (15MB I think?).

[pdriscoll]

When you say you put an "IPS unit" in line, are you using an IPS 4200 appliance, an IPS module in an ASA (if so, what model?), or an IOS IPS implementation (if so, what IOS and router?)?

What are you seeing as far as CPU and memory utilization?

What ports are your modalities\PACS sending on? How large are your studies?

Is your slowdown during peak times of transmission, or with every transfer?