I have deployed Cisco blade-based IDS on a number of similar nets, each
blade could monitor all networks (VLANS) at a HO (assuming core switch) I
have also used Cisco MARS as a SIM, and am quite satisified with the
integration of both IDS monitoring and monitoring of Windows Servers.
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of star.gemini@gmail.com
Sent: Saturday, April 21, 2007 12:24 AM
To: focus-ids@securityfocus.com
Subject: Help for placing IDS sensors
Hi,
We are in the process of implementing a project involving a huge network
comprising of thousands computers and users (1 computer :1.5 users). The
network is spread across 600 locations. We wish to implement ADS on Win2003
servers.
In a switched environment, as we all know NIDSs have problems. There are
around 40 links directly to HO. Each location has its own LAN. Each location
has sublocations with LANs who authenticate to those higher in hierarchy.
How do we implement IDS sensors 20 (gigabit + 10/100) in count, so that we
can monitor all the traffic at lowest possible level of network, with
minimal number of sensors. How can we introduce sensors so that they
function as perfect as Inline
To give you and idea.
ISP1
ISP2
\ /
HO(Core
ROUTER) + DC
/ \
DC DC
/ \
Router + LAN(A). Router +LAN B----40
/ \
Router + LAN(A1) Router + LanB1
/ \
Router + LAN(AA1) Router
+ LAN
/ \
Subloc2 Subloc3 |
/ \
Users Users, computers............
Digvijay
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in
tro_sfw
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
