IDSM2 and FWSM

[binelipetrov]

Hi

I have question regarding IDSM2 implementation in FWSM environment.

VLAN 60 is outside interface on FWSM

interface Vlan60

nameif outside

security-level 0

ip address 10.10.60.2 255.255.255.0

Also, on Cisco 6500, I have VLAN 60

interface Vlan60

ip address 10.10.60.1 255.255.255.0

Everything is OK, inside interface on FWSM is SVI 66, everything is UP and FWSM is wporking correctly.

Now, I want to put IDSM2 to monitor ALL traffic between FWSM outside interface and MSFC(6500).

Is it possible? And how?

I know that I need to put some additional VLAN to bridge through IDMS2, creating interface vlan pair (subinterface on data ports of IDSM2), but in thaht case, I am losing connection between FWSM and MSFC

Please help. Thank You

[amritpatek]

You will need to create a new vlan and then put all traffic between FWSM and MSFC in this vlan. You can also create multiple vlans if required. Then put the vlan for monitoring in the IDSM2. Following link may help you

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliIdsm2.html

[hoffa2000]

One solution might also be to SPAN monitor the port channel serving the FWSM. In my case it's po 271. If you filter the SPAN session on only vlan 60 you should get the traffic flowing in and out of the FWSM outside interface towards the MSFC.

I've tried this a few times with a sniffer and it seems to work. Haven't tried it with the IDSM though

/Fredrik

[jonix.niebla]

Hi,

Hope you have already solved your problem. have you tried changing the inline TCP tracking mode?