How many IPS?

[gnaveen]

We have been using SNORT and now evaluating Cisco IPS sensors. The first question is:

- We have 2 ASA 5510 configured as Active/Active failover and have 2 different data centers. How many IPS do we esentially need?

My guess is 2 - one for each data center. But, then how it will connect to both the firewalls?

Or, we just have it its interface go into a switchport and monitor all the traffic from various vlans into the destination port to which IPS is connected to?

-NG

[Eduardo Aliaga]

Actually, it depends very much on your traffic flows.

Anyway, assuming all your traffic flows go through ASA,  a simple solution would be to install AIM-SSM module, which is the IPS module for your ASA 5510. That way you don-t have to worry to redirect traffic to your IPS, because ASA can do it for you.