IPS reactions in passive mode

[dehghan]

Hi

we are planning to deploy cisco IPS 4200 series on our network. We have a redundant network so what I need is an a device that would react to threats(via acl, shun, resets) while in passive mode ( using span or taps). couple of questions

1- Is this device capable of preventing threats whilein passive mode.

2- What is the diffrence between cisco IDS and IPS series ?

Thanks

[msocarras]

Hi!

The Cisco 4200 IDS series work as IPS also when used with version 5.0. This means that you can use an IDS/IPS device as a tap in a line to "prevent" attacks by not passing attacking packets. Of course this is a mode of operation, and if you just want to use the device as IDS you can. As IDS you will "monitor" VLANs o ports usually, from a span port. The IDS will alarm and send resets (if configured for) to prevent attacks. You can also configure the IDS to put ACL on border routers or PIX to stop the offending traffic (this may require some tedious and carefull config).

Consider deploying Cisco ASA5500 appliances also. They are IDS/IPS, FW, VPN, and much more.

http://www.cisco.com/go/asa

Mario S.

CCIE #14047