IDS Query

[tyagivijay]

Hello,

We are having IDS 4215 with 4 Sniffing interface.

Now we want to place the sniffing interface at the different segment in our Network.

So do we need to place the entire sensing interfaces in a single logical group, or configure them as individual Interface???

Thanks in advance.

Vijay

[a.arndt · Accepted solution]

If I understand your question correctly, your interfaces will stay in a single group, whether you like it or not. They will remain under a single monitoring policy despite being physically connected to different monitoring domains.

This is a result of the current versions of Cisco software (IDS 4.1 and IPS 5.0). The ability to configure a set of "Virtual Sensor" settings for each interface is not yet available. Cisco has said, both in various posts to this forum and in press releases and white papers on the Cisco site, that this feature will be added to a "future release".

Basically, you're stuck using a generic monitoring policy for all monitored segments. Any event filters or other changes you make to the policy (disabling/enabling signatures, for example) will apply to all the interfaces.

I hope this helps,

Alex Arndt