IDS Placement

[mark.o.hall]

I am trying to determine how to configure the 4215 IDS to work in sandwich mode. 1 port connected up outside the firewall and 1 port connected up inside the firewall, and is this the best method to use and is it secure?

[mark.o.hall]

2950-XL, where can I find info on spanning for this switch?

[marcabal]

Could not find any documentation for a 2950-XL.

Here is documentation I could find for a 2900-XL:

http://www.cisco.com/univercd/cc/td/doc/product/lan/c2900xl/29_35wc6/scg/swports.htm#xtocid26

Does not look like you can enable incoming packets.

And here is documentation I could find for a 2950:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12122ea7/scg/swspan.htm#wp1218090

Looks like it can allow incoming packets.

I haven't worked with any of these switches so I don't know any details beyond what is in the documentation. You could try the TAC if you need more information.

[marcabal]

It completely depends on the switch.

Some switches allow multiple destinations for the same span session. While other switches do not.