two switch connect to IPS

[teymur azimov]

hi. I want to connect two switch to ips sensor. i configurate ips at interface inline pairs mode. swicthes interface ar configurated access or trunk mode.

my question is that: is the vlan which pass througth the ips must be same at both switch at this application??

yes or not?

[rhermes]

Teymur -

If you have configured your IPS sensor for in-line interface pairs, then the connections to your switches should be an access interface.

interface FastEthernet0/1

switchport access vlan 101

If you need to pass a trunk interface through your sensor, you have to change the sensor to in-line VLAN pairs. In this mode the sensor will not be fully transparent to traffic. It will translate incoming VLAN header tags to outgoing VLAN headers according to the VLAN pairs you create in the configuration.

- Bob

[teymur azimov]

ok. if the switches access mode, the subnet must be same both swithes???

[rhermes]

Yes, the subnet on both switches needs to be the same because the IPS sensors is transparent. It should act just like a patch cable between the switches.

- Bob

[denizkaya]

Actually you can connect IPS to Switch Trunk ports as well. You need to configure VLAN groups on IPS to be able to inspect traffic passing through.

[teymur azimov]

ok. i want to configurate vlan 10 20 30 40 at both switches and switces interface configurated as trunk.

ips sensor configurate at inline vlan group mode.

i configurate this config at ips like as:

for example 1 switch connect to ips ge0/0 interface.

i create two subinterface in ge0/0.

subinterface 1 vlan 10 and 20 and policy 1 or vs0.

subinterface 2 vlan 30 and 40 and policy 2 or vs1.

also do this configuration as the same in ge0/1 interface at ips.

am i di rigth configuration??

[rhermes]

Teymur

Please read this section on VLAN pairs to understand how they work:

http://www.cisco.com/en/US/partner/docs/security/ips/7.0/configuration/guide/cli/cli_interfaces.html#wp1047718

- Bob