My general recommendation is to use VACL Capture instead of Span in the majority of promiscuous deployments.
VACL Capture gives you a little better control of what packets you want monitored. You can permit and capture traffic that regularly goes to the internet (like web, and mail), while being able permit but not capture traffic that stays in the network and is rarely used in attacks (like network backups).
The IDSM-2 has an uppper performance of about 600Mbps. So being able to permit but not analyze some of the internal traffic will allow you to analyze more of the traffic of interest (traffic on ports known to be used in attacks across the internet).
There are, however, a few scenarios where Span does work better than VACL Capture. Like when you only plan on monitoring the traffic going through the firewall. In this situations it is easier to just span the port connected to the firewall, then to try and set up a complex VACL to only capture between the internal network and internet without capturing traffic staying on the internal network.
As for "inline pairs". When operating in "inline" mode, the IDSM-2 passes traffic back and forth between 2 vlans. It is kind of like bridging the 2 vlans. So with an "inline pair" it can only monitor the traffic passing back and forth between these 2 vlans.
Most people associate a IP subnet with a vlan, and the only way a machine on vlan can talk to another is through a router (generally the MSFC of the switch, or routing by the switch itself in the case of Native IOS),
But this is not the case with "inline" IDSM-2. Instead it is a Single IP Subnet spread across 2 vlans. The IDSM-2 does not do IP Routing between the vlans, instead it passes packets more like a layer 2 bridge.
If you want to do "inline" monitoring on an existing vlan, the easiest thing to do is to create a brand new vlan to pair with the existing vlan. Part of the machines in the existing vlan are then moved to the new vlan, and the IDSM-2 is used to "pair" the 2 vlans.
One example would be vlan 100 with 1 port connected to the firewall, and multiple ports connected to internal personal machines and even internal routers.
The firewall and all the internal machines are all on the same IP Subnet.
An easy thing to do is to create a new vlan 101.
Move the firewall port to vlan 101.
Then use the IDSM-2 to pair vlan 100 and vlan 101.
Traffic going to the internet would come in one of the internal ports on vlan 100. Then get bridged (and analyzed) by the IDSM-2 to vlan 101. The packet then goes to the firewall and out to the Internet. The opposite happens for packets coming in from the Internet.
So you can see that all packets going to/coming from the internet have to pass through the IDSM-2 for analysis.
The big advantage of an "inline" deployment is that if the IDSM-2 detects an attack it can drop the packet and prevent it from ever reaching the destination.
A promiscuous deployment can not do this because the IDSM-2 is only seeing a copy of the packet (from Span or VACL Capture).
The disadvantage as you've seen is that you can only monitor a single "pair" of vlans in "inline" mode. But because you have to create the pair by creating a new vlan; it really equates to only being able to monitor on One existing vlan.
NOTE: This is subject to change in future versions of the IDSM-2 as users are requesting the ability to create multiple "inline vlan pairs".
