Zillah,
The first thing you need to do is upgrade your sensor to version 5.1 or 6.0.
You have 4.1 software, which is no longer supported. If you have
maintenance on your sensor, the upgrade is no charge. If you do not have
maintenance (called Services for IPS), then you'll need to take care of that
first.
The 4215 sensor has only two interfaces, and you need one for command and
control. This is the interface that you'll assign an IP address to and use
for management purposes.
The other interface is Fast Ethernet (10/100), even though it doesn't look
like it to you from the show version results.
You can use this in inline mode (IPS mode) by enabling multiple VLAN
interfaces on the sniffing interface. With IPS 5.1 or higher, you can
create VLAN groups, where traffic that arrives on one VLAN is automatically
mapped to a different VLAN.
More information is available at:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration
_guide_chapter09186a008055df7d.html#wp1047718
Gary
On 11/28/06 8:20 AM, "zillah" <saadelias@hotmail.com> wrote:
I have got at work this sensor with two interfaces only, I have been asked to
check that
IDSWORK# show version
Application Partition:
Cisco Systems Intrusion Detection Sensor, Version 4.1(1)S47
OS Version 2.4.18-5smpbigphys-4215
Platform: IDS-4215
one interface which is Ethernet 0 (not FastEthernet) connected to switch in
DMZ , and Ethernet 1 connected to switch 4005,,,,logically I have to monitor
DMZ zone not switch 4005 (since I have got only two interfaces, my
case),,,Am I right ?
That means Ethernet 0 should be for sniffing (monitoring)since it is
connected to DMZ,and interface 1 for command and control since it is
connected to 4005 switch, but according to cisco specification
http://cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide
_chapter09186a008055df7d.html#wp1051279
Table 5-2
FastEthernet0/0: Interfaces Supporting Inline VLAN Pairs (Sensing Ports)
FastEthernet0/1: Interfaces Not Supporting Inline (Command and Control Port)
Note: Cisco has mentioned FastEthernet, the one that I have got Ethernet
,,,,does make any difference ?
Since I have not done that configuration , it has been done by some one
else, do I need to change that ?
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
