IPS Deployment in a Dual Core Environment

[cschweigert]

Can any one share ideas/recommendations about deploying a Cisco 4215 IPS in an environment that has dual core switchs?

[mhellman]

look into vacl's and aggregators.

[cschweigert]

Right.... I guess I should back up and provide more information about what I am trying to do. So, I have a 4215 without the 4FE optional 4 port NIC that I want to monitor off of two 3750 routing switches. Would you recommend purchasing the card or spanning all Vlans?

[hoogen_82]

In 4215 you would have two interfaces, so that would mean you could have one inline pair. I am sure your two core switch traffic has to route through a fw before reaching the internet.

Need not do a promiscous monitoring, create a pair and place the IPS in between the active PIX and switch. This way whenever we have a active PIX, IPS inspects the traffic flows through it. Now in case of either device failing the secondary path can be used for the traffic to still continue passing. This way the traffic is not inspected but its going to be a rare occurence that your PIX would fail that easily or IPS has a hardware failure.

I am not sure if you can order the 4FE ports seperately contact your partner or Cisco for this information

HTH

Hoogen

Do rate if this post helps :)

[mhellman]

I assume your goal is to monitor all traffic on both switches? If you're not going to purchase the card, you're going to have to get all the traffic down into a single port (the 4215 only has one monitoring port). You might be able to do that without additional equipment using RSPAN. There are numerous other ways to get the 2 feeds down to "one" (hub, additional switch with SPAN, port aggregator).

If you get the card, you should be able to use a normal SPAN or VACL on each switch and use a separate physical interface on the sensor.