We currently have Cisco/SourceFire 8250 IPS appliances in line on our inside and DMZ firewall interfaces. Some of the firewalls are being periodically overwhelmed by bursty traffic, so ethernet flow control has been enabled, which seems to address the issue.
However, for the firewall interfaces which have connections to the switch which pass through an inline IPS, the pause frames sent by the firewall are not being received by the switch, thus the switch port never pauses sending frames.
I looked through the 8250 documentation but could find nothing that explicitly addressed whether it passes ethernet pause frames or not. I know that the inline IPS connection actually presents itself like a pair of back-to-back NICs, so each IPS connection establishes link to the directly connected device. So, the only options that I was thinking that may address this are enabling 'Propagate Link State' and/or 'Transparent Inline Mode'.
http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/IPS-Devices.html#52730
Any ideas or pointers would be appreciated.
Thank you,
-rb
