Part 2 of Info:
CAT65K-PODX# sh ver
Cisco Internetwork Operating System Software
IOS (tm) s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(18)S
XF4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by cisco Systems, Inc.
Compiled Thu 23-Mar-06 19:38 by tinhuang
Image text-base: 0x40101040, data-base: 0x42DA8000
ROM: System Bootstrap, Version 12.2(17r)S2, RELEASE SOFTWARE (fc1)
BOOTLDR: s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(18)S
XF4, RELEASE SOFTWARE (fc1)
CAT65K-PODX uptime is 7 weeks, 7 hours, 55 minutes
Time since CAT65K-PODX switched to active is 7 weeks, 7 hours, 54 minutes
System returned to ROM by power cycle (SP by power on)
System image file is "disk0:s72033-adventerprisek9_wan-mz.122-18.SXF4.bin"
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
CAT65K-PODX#
CAT65K-PODX# sh mod
Mod Ports Card Type Model Serial No.
--- ----- -------------------------------------- ------------------ -----------
3 48 CEF720 48 port 10/100/1000mb Ethernet WS-X6748-GE-TX SAL084359BZ
4 8 Network Analysis Module WS-SVC-NAM-2 SAD095005X4
5 2 Supervisor Engine 720 (Active) WS-SUP720-3BXL SAL09412WB4
6 8 Intrusion Detection System WS-SVC-IDSM-2 SAD101601NR
Mod MAC addresses Hw Fw Sw Status
--- ---------------------------------- ------ ------------ ------------ -------
3 0012.435d.8b68 to 0012.435d.8b97 2.1 12.2(14r)S5 12.2(18)SXF4 Ok
4 0012.80f1.d8c0 to 0012.80f1.d8c7 4.0 7.2(1) 3.4(1a) Ok
5 0013.7f0a.ff48 to 0013.7f0a.ff4b 4.3 8.1(3) 12.2(18)SXF4 Ok
6 0016.9dab.3340 to 0016.9dab.3347 6.1 7.2(1) 5.1(1) Ok
Mod Sub-Module Model Serial Hw Status
---- --------------------------- ------------------ ----------- ------- -------
3 Centralized Forwarding Card WS-F6700-CFC SAD084205DY 2.0 Ok
5 Policy Feature Card 3 WS-F6K-PFC3BXL SAL09412SXU 1.6 Ok
5 MSFC3 Daughterboard WS-SUP720 SAL09412HDB 2.3 Ok
6 IDS 2 accelerator board WS-SVC-IDSUPG ADEI6120088 2.4 Ok
Mod Online Diag Status
---- -------------------
3 Pass
4 Pass
5 Pass
6 Pass
CAT65K-PODX#
I have attached the current Cat6K/Sup720 full configuration and the IDSM-2 configuration.
The million dollar question:
Why can?t I enforce blocking on SVI80? I have defined everything according to the docs and both options [blocking and rate limiting] are grayed out in my blocking device definition. I understand from the docs that rate limiting is not supported on VACLS, but if I am reading it correctly, ACLs should be.
So I have determined that I needed an ACL applied to the SVI as opposed to the VACL used for capture. I added:
ip access-list 2020
permit ip any any
Interface Vlan 80
ip address 10.1.80.1 255.255.255.0
ip access-group 2020 in
I still do not get the option to block in IDM. Does this need to be added as a Cisco router (doesnt seem to want to take Vlan80 as an interface) or a Cat6k blocking device?
All help appreciated. Thanks in advance.
