Solved: Re: IDSM-2 Inline mode

isgphyd12 · ‎05-01-2008

Hi,

I am working with the IDSM-2, We have Cisco 6509 with CSM & FWSM, We are planning IDSM-2 in Inline mode and now i want to monitor the traffic which is coming through Outside Interface of the FW context ( Which is nothing but a VLAN A, VLAN B, Vlan C. on MSFC )

Data flow :-- ISP RTR---INternal RTR---FWSM---IDSM---MSFC---CSM---

IDSM version is 5.1(4)S257.0,

This will support only Two VLAN (IN and OUT) on access mode.

My problem is I don't know how to scan the traffic of 3 numbers of VLAN (A,B,C).

Cisco 6509 --- Version 12.2(18)SXF7,

vinod.rathi · ‎05-02-2008

You can use inline VLAN pair mode to monitor traffic coming on specific VLANS. For eg

You have VLAN 100,200 and 300 on MSFC that you intend to monitor inline.

You need to configure VLAN 101,201 and 301 (L2 only) and send VLAN 100-101,200-201,300-301 to IDSM-2.

You then need to create VLAN pairs on IDSM-2 module as below

1 - VLAN 100-101 - pair 1

2 - VLAN 200-201 - pair 2

3 - VLAN 300-301 - pair 3

Then assign above three pairs to Virtual sensor and it will monitor this traffic for inline operation.

Inline VLAN pair mode is based on VLANs, so it doesnt really matter whether VLANS are behind or front of FWSM.

Cheers,

Vinod

View solution in original post

uchimaku · ‎05-03-2008

You need to configure 3 inline vlan pairs . Suppose you are interested in monitoring vlan A, B , C and your MSFC is in vlan D. You need to configure 3 vlan pair such as

vlan A ,D

Vlan B, D

vlan C, D

You can refer the below link for coniguring inline vlan pair

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliIDSM2.html#wp1067639

Hope it helps

View solution in original post

vinod.rathi · ‎05-02-2008

You can use inline VLAN pair mode to monitor traffic coming on specific VLANS. For eg

You have VLAN 100,200 and 300 on MSFC that you intend to monitor inline.

You need to configure VLAN 101,201 and 301 (L2 only) and send VLAN 100-101,200-201,300-301 to IDSM-2.

You then need to create VLAN pairs on IDSM-2 module as below

1 - VLAN 100-101 - pair 1

2 - VLAN 200-201 - pair 2

3 - VLAN 300-301 - pair 3

Then assign above three pairs to Virtual sensor and it will monitor this traffic for inline operation.

Inline VLAN pair mode is based on VLANs, so it doesnt really matter whether VLANS are behind or front of FWSM.

Cheers,

Vinod

uchimaku · ‎05-03-2008

You need to configure 3 inline vlan pairs . Suppose you are interested in monitoring vlan A, B , C and your MSFC is in vlan D. You need to configure 3 vlan pair such as

vlan A ,D

Vlan B, D

vlan C, D

You can refer the below link for coniguring inline vlan pair

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliIDSM2.html#wp1067639

Hope it helps

zujalal · ‎05-05-2008

Hi.

I dont think you can use the same VLAN ID in multiple pairs. You cannot use VLAN D as per the above example in all the pairs.

You might need to create dummy L2 vlans for everyvlan that you want to monitor. Move the IP address from the actual VLAN interface to the newly created vlan interface.

e.g. If you have

interface vlan A

ip address A.A.A.A .......

You will have to create a VLAN X.

vlan x

interface vlan x

ip address A.A.A.A ......

Now use the IDSM to configure pairing between A and X

IDSM will simply bridge the two vlans together.

HTH.

isgphyd12 · ‎05-06-2008

Hi,

As mentioned my front end is FWSM--MSFC--, so i don't have any ip address assigned on that vlan it is just a L2 vlan, so now what ?

One more thing, which I want to clarify, is that VLAN Pair configuration provides the Hardware bypass.

vinod.rathi · ‎05-06-2008

your dummy vlan (for every fwsm vlan) will be the actual end user vlan. (switchport access vlan command).

IDSM-2 will just bridge the dummy vlan with the actual vlan in pair.

Vinod

isgphyd12 · ‎05-06-2008

Vinod,

My actual VLAN 10 and i created one more dummy VALN 101, so do I need to change the FWSM configuration also like

From

firewall module 1 vlan-group 1,2,3

firewall vlan-group 2 10 100

To

firewall module 1 vlan-group 1,2,3

firewall vlan-group 2 101 100

so the data flow is just like VLAN10--IDSM2---VLAN 101--FWSM--MSFC

and

correct me if i am wrong, VLAN pair configuration is not available with IDSM-5, i think we need to upgrade the IDSM 5 to 6 and what about Hardware bypass? is hardware bypass is available with VLAN pair?

Please provide me the link for any configuration document of VLAN pair with IDSM-5

Dinesh

uchimaku · ‎05-06-2008

The link for IDSM running 5.1 which has provision for inline vlan pair http://www.cisco.com/en/US/docs/security/ips/5.1/configuration/guide/cli/cliguide.html

Thanks

Udaya

isgphyd12 · ‎05-07-2008

Hi Udaya,

I am not able to find out any subinterface.

I think it is available from IPS 5.1 and this one is IPS5.0(2)

IDSM2CORE2(config-int)# show settin

physical-interfaces (min: 0, max: 999999999, current: 3)

-----------------------------------------------

-----------------------------------------------

media-type: backplane

description:

admin-state: enabled

duplex: auto

speed: auto

alt-tcp-reset-interface

-----------------------------------------------

none

-----------------------------------------------

-----------------------------------------------

media-type: backplane

description:

admin-state: enabled

duplex: auto

speed: auto

alt-tcp-reset-interface

-----------------------------------------------

interface-name: System0/1

-----------------------------------------------

-----------------------------------------------

media-type: backplane

description:

admin-state: enabled

duplex: auto

speed: auto

alt-tcp-reset-interface

-----------------------------------------------

interface-name: System0/1

-----------------------------------------------

command-control: GigabitEthernet0/2

inline-interfaces (min: 0, max: 999999999, current: 0)

-----------------------------------------------

bypass-mode: auto

interface-notifications

-----------------------------------------------

missed-percentage-threshold: 0 percent

notification-interval: 30 seconds

idle-interface-delay: 30 seconds

-----------------------------------------------

vinod.rathi · ‎05-07-2008

Your FWSM configuration will not change and will remain as it is.

FWSM configuration

firewall module 1 vlan-group 1,2,3

firewall vlan-group 2 10 100

MSFC Configuration

Vlan 101

intrusion-detection module "slot-number" data-port "1/2" trunk allowed-vlan 10,101.

IDSM-2 configuration

Login to GUI and go to interface configuration --> VLAN pairs

Click Add.

Interface name - gigabitethernet0/7 or 0/8 (this corresponds to data port 1 or 2)

Subinterface number - 1

VLAN A - 101

VLAN B - 10

Give a description and click Apply

Next go to analysis engine - virtual sensors

select the pair you created above and click on apply. (This creates the inline vlan pair and bridges the 2 vlans).

Try generating some attacks from end user vlan (101) and see idsm-2 blocking attacks.

goodwills

Vinod

sureshkum · ‎05-08-2008

Hi Vinoth,

Ur posts are helpful for me to understand the Inline VLAN pair deployment.So then how to send log to the destination, where my IEV is installed in one of the Vlan in FWSM. Kindly provide me the config steps also..

vinod.rathi · ‎05-08-2008

IDSM-2 logs are sent using the management interface gig0/2. Depending on your management VLAN (either on FWSM or MSFC) where your IDSM-2 is placed, you might need to do the configuration accordingly.

Vinod

sureshkum · ‎05-09-2008

Hi Vino,

Thanks.Let say my Managent Vlan is in FWSM(VLAN 120). I need to monitor Vlan's 100, 160, 130, 140. So if that is the case..Kindly provide me configuration steps for sending logs to Mgmt Vlan 120.

isgphyd12 · ‎07-24-2008

Hi,

I am done with the config (Inline VLAN PAIR), but i am not able to see any logs at event viewver.

I enabled all FTP & MSN signatur but there is not logs for the same and able to access the internet services.

any one can help me out to trouble shoot the problem ?

Regards.

isgphyd12 · ‎05-04-2008

Thanks Vinod and Uchimaku, i am planning for the installation at production environment, hope you guys will be available in case of any problem.

Thank you,