Installing and Using Cisco Intrusion Prevention System Device Manager 6.0 - Configuring Interfaces [Cisco IPS 4200 Series Sensors]

Table Of Contents

Configuring Interfaces

Understanding Interfaces

Command and Control Interface

Sensing Interfaces

Interface Support

TCP Reset Interfaces

Understanding Alternate TCP Reset Interfaces

Designating the Alternate TCP Reset Interface

Interface Configuration Sequence

Interface Configuration Restrictions

Hardware Bypass Mode

Hardware Bypass Card

Hardware Bypass Configuration Restrictions

Understanding Interface Modes

Promiscuous Mode

Inline Interface Mode

Inline VLAN Pair Mode

VLAN Group Mode

Interface Configuration Summary

Overview

Supported User Role

Field Definitions

Configuring Interfaces

Overview

Supported User Role

Field Definitions

Interfaces Pane

Edit Interface Dialog Box

Enabling and Disabling Interfaces

Editing Interfaces

Configuring Inline Interface Pairs

Overview

Supported User Role

Field Definitions

Interface Pairs Pane

Add and Edit Interface Pair Dialog Boxes

Configuring Inline Interface Pairs

Configuring Inline VLAN Pairs

Overview

Supported User Role

Field Definitions

VLAN Pairs Pane

Add and Edit VLAN Pair Dialog Boxes

Configuring Inline VLAN Pairs

Configuring VLAN Groups

Overview

Deploying VLAN Groups

Supported User Role

Field Definitions

VLAN Groups Pane

Add and Edit VLAN Group Dialog Boxes

Configuring VLAN Groups

Configuring Bypass Mode

Overview

Supported User Role

Field Definitions

Adaptive Security Appliance, AIP-SSM, and Bypass Mode

Configuring Traffic Flow Notifications

Overview

Supported User Role

Field Definitions

Configuring Traffic Flow Notifications

Configuring Interfaces

This chapter describes the various interface modes and how to configure interfaces on the sensor. It contains the following sections:

•Understanding Interfaces

•Understanding Interface Modes

•Interface Configuration Summary

•Configuring Interfaces

•Configuring Inline Interface Pairs

•Configuring Inline VLAN Pairs

•Configuring VLAN Groups

•Configuring Bypass Mode

•Configuring Traffic Flow Notifications

Understanding Interfaces

The sensor interfaces are named according to the maximum speed and physical location of the interface. The physical location consists of a port number and a slot number. All interfaces that are built-in on the sensor motherboard are in slot 0, and the PCI expansion slots are numbered beginning with slot 1 for the bottom slot with the slot numbers increasing from bottom to top (except for IPS 4270-20, where the ports are numbered from top to bottom). Interfaces with a given slot are numbered beginning with port 0 for the right port with the port numbers increasing from right to left. For example, GigabitEthernet2/1 supports a maximum speed of 1 Gigabit and is the second-from-the-right interface in the second-from-the bottom PCI expansion slot. IPS-4240, IPS-4255, IPS-4260, and IPS 4270-20 are exceptions to this rule. The command and control interface on these sensors is called Management0/0 rather than GigabitEthernet0/0. IPS 4270-20 has an additional interface called Management0/1, which is reserved for future use.

There are three interface roles:

•Command and control

•Sensing

•Alternate TCP reset

There are restrictions on which roles you can assign to specific interfaces and some interfaces have multiple roles. You can configure any sensing interface to any other sensing interface as its TCP reset interface. The TCP reset interface can also serve as an IDS (promiscuous) sensing interface at the same time. The following restrictions apply:

•Because AIM-IPS, AIP-SSM, and NM-CIDS only have one sensing interface, you cannot configure a TCP reset interface.

•Because of hardware limitations on the Catalyst switch, both of the IDSM-2 sensing interfaces are permanently configured to use System0/1 as the TCP reset interface.

•The TCP reset interface that is assigned to a sensing interface has no effect in inline interface or inline VLAN pair mode, because TCP resets are always sent on the sensing interfaces in those modes.

Note Each physical interface can be divided into VLAN group subinterfaces, each of which consists of a group of VLANs on that interface.

This section contains the following topics:

•Command and Control Interface

•Sensing Interfaces

•Interface Support

•TCP Reset Interfaces

•Interface Configuration Sequence

•Interface Configuration Restrictions

•Hardware Bypass Mode

Command and Control Interface

The command and control interface has an IP address and is used for configuring the sensor. It receives security and status events from the sensor and queries the sensor for statistics.

The command and control interface is permanently enabled. It is permanently mapped to a specific physical interface, which depends on the specific model of sensor. You cannot use the command and control interface as either a sensing or alternate TCP reset interface.

Table 3-1 lists the command and control interfaces for each sensor.

Table 3-1 Command and Control Interfaces

Sensor

Command and Control Interface

AIM-IPS

Management0/0

AIP-SSM-10

GigabitEthernet0/0

AIP-SSM-20

GigabitEthernet0/0

AIP-SSM-40

GigabitEthernet0/0

IDS-4215

FastEthernet0/0

IDS-4235

GigabitEthernet0/1

IDS-4250

GigabitEthernet0/1

IDSM-2

GigabitEthernet0/2

IPS-4240

Management0/0

IPS-4255

Management0/0

IPS-4260

Management0/0

IPS 4270-20

Management0/0

NM-CIDS

FastEthernet0/0

Sensing Interfaces

Sensing interfaces are used by the sensor to analyze traffic for security violations. A sensor has one or more sensing interfaces depending on the sensor. For the number and type of sensing interfaces available for each sensor, see Interface Support.

Sensing interfaces can operate individually in promiscuous mode or you can pair them to create inline interfaces for inline sensing mode. For more information, see Promiscuous Mode, Inline Interface Mode, Inline VLAN Pair Mode, and VLAN Group Mode.

Note On appliances, all sensing interfaces are disabled by default. You must enable them to use them. On modules, the sensing interfaces are permanently enabled.

Some appliances support optional PCI interface cards that add sensing interfaces to the sensor. You must insert or remove these optional cards while the sensor is powered off. The sensor detects the addition or removal of a supported interface card. If you remove an optional PCI card, some of the interface configuration is deleted, such as the speed, duplex, description string, enabled/disabled state of the interface, and any inline interface pairings. These settings are restored to their default settings when the card is reinstalled. However, the assignment of promiscuous and inline interfaces to the Analysis Engine is not deleted from the Analysis Engine configuration, but is ignored until those cards are reinserted and you create the inline interface pairs again. For more information, see Chapter 4, "Configuring Virtual Sensors."

Interface Support

Table 3-2 describes the interface support for appliances and modules running IPS 6.0.

Table 3-2 Interface Support

Base Chassis

Added PCI Cards

Interfaces Supporting
Inline VLAN Pairs (Sensing Ports)

Combinations Supporting Inline Interface Pairs

Interfaces Not Supporting Inline (Command and Control Port)

AIM-IPS

—

GigabitEthernet0/1 by ids-service-module command in the router configuration instead of VLAN pair or inline interface pair

GigabitEthernet0/1 by ids-service-module command in the router configuration instead of VLAN pair or inline interface pair

Management0/0

AIP-SSM-10

—

GigabitEthernet0/1 by security context instead of VLAN pair or inline interface pair

GigabitEthernet0/1 by security context instead of VLAN pair or inline interface pair

GigabitEthernet0/0

AIP-SSM-20

—

GigabitEthernet0/1 by security context instead of VLAN pair or inline interface pair

GigabitEthernet0/1 by security context instead of VLAN pair or inline interface pair

GigabitEthernet0/0

AIP-SSM-40

—

GigabitEthernet0/1 by security context instead of VLAN pair or inline interface pair

GigabitEthernet0/1 by security context instead of VLAN pair or inline interface pair

GigabitEthernet0/0

IDS-4215

—

FastEthernet0/1

N/A

FastEthernet0/0

IDS-4215

4FE

FastEthernet0/1
FastEthernetS/0¹
FastEthernetS/1
FastEthernetS/2
FastEthernetS/3

1/0<->1/1
1/0<->1/2
1/0<->1/3
1/1<->1/2
1/1<->1/3
1/2<->1/3
0/1<->1/0
0/1<->1/1
0/1<->1/2
0/1<->1/3

FastEthernet0/0

IDS-4235

—

GigabitEthernet0/0

N/A

GigabitEthernet0/1

IDS-4235

4FE

GigabitEthernet0/0
FastEthernetS/0
FastEthernetS/1
FastEthernetS/2
FastEthernetS/3

1/0<->1/1
1/0<->1/2
1/0<->1/3
1/1<->1/2
1/1<->1/3
1/2<->1/3

GigabitEthernet0/1

IDS-4235

TX (GE)

GigabitEthernet0/0 GigabitEthernet1/0 GigabitEthernet2/0

0/0<->1/0
0/0<->2/0

GigabitEthernet0/1

IDS-4250

—

GigabitEthernet0/0

N/A

GigabitEthernet0/1

IDS-4250

4FE

GigabitEthernet0/0
FastEthernetS/0
FastEthernetS/1
FastEthernetS/2
FastEthernetS/3

1/0<->1/1
1/0<->1/2
1/0<->1/3
1/1<->1/2
1/1<->1/3
1/2<->1/3

GigabitEthernet0/1

IDS-4250

TX (GE)

GigabitEthernet0/0 GigabitEthernet1/0 GigabitEthernet2/0

0/0<->1/0
0/0<->2/0

GigabitEthernet0/1

IDS-4250

SX

GigabitEthernet0/0
GigabitEthernet1/0

N/A

GigabitEthernet0/1

IDS-4250

SX + SX

GigabitEthernet0/0
GigabitEthernet1/0
GigabitEthernet2/0

1/0<->2/0

GigabitEthernet0/1

IDS-4250

XL

GigabitEthernet0/0
GigabitEthernet2/0
GigabitEthernet2/1

2/0<->2/1

GigabitEthernet0/1

IDSM-2

—

GigabitEthernet0/7
GigabitEthernet0/8

0/7<->0/8

GigabitEthernet0/2

IPS-4240

—

GigabitEthernet0/0
GigabitEthernet0/1
GigabitEthernet0/2
GigabitEthernet0/3

0/0<->0/1
0/0<->0/2
0/0<->0/3
0/1<->0/2
0/1<->0/3
0/2<->0/3

Management0/0

IPS-4255

—

GigabitEthernet0/0
GigabitEthernet0/1
GigabitEthernet0/2
GigabitEthernet0/3

0/0<->0/1
0/0<->0/2
0/0<->0/3
0/1<->0/2
0/1<->0/3
0/2<->0/3

Management0/0

IPS-4260

—

GigabitEthernet0/1

N/A

Management0/0

IPS-4260

4GE-BP

Slot 1

Slot 2

GigabitEthernet0/1

GigabitEthernet2/0
GigabitEthernet2/1
GigabitEthernet2/2
GigabitEthernet2/3

GigabitEthernet3/0
GigabitEthernet3/1
GigabitEthernet3/2
GigabitEthernet3/3

2/0<->2/1²
2/2<->2/3

3/0<->3/1
3/2<->3/3

Management0/0

IPS-4260

2SX

Slot 1

Slot 2

GigabitEthernet0/1

GigabitEthernet2/0
GigabitEthernet2/1

GigabitEthernet3/0
GigabitEthernet3/1

All sensing ports can be paired together

Management0/0

IPS 4270-20

—

GigabitEthernet0/1

N/A

Management0/0
Management0/1³

IPS 4270-20

4GE-BP

Slot 1

Slot 2

GigabitEthernet0/1

GigabitEthernet2/0
GigabitEthernet2/1
GigabitEthernet2/2
GigabitEthernet2/3

GigabitEthernet3/0
GigabitEthernet3/1
GigabitEthernet3/2
GigabitEthernet3/3

2/0<->2/1⁴
2/2<->2/3

3/0<->3/1
3/2<->3/3

Management0/0
Management0/1⁵

IPS 4270-20

2SX

Slot 1

Slot 2

GigabitEthernet0/1

GigabitEthernet2/0
GigabitEthernet2/1

GigabitEthernet3/0
GigabitEthernet3/1

All sensing ports can be paired together

Management0/0
Management0/1⁶

¹You can install the 4FE card in either slot 1 or 2. S indicates the slot number, which can be either 1 or 2.

²To disable hardware bypass, pair the interfaces in any other combination (2/0<->2/2 and 2/1<->2/3, for example).

³Reserved for future use.

⁴To disable hardware bypass, pair the interfaces in any other combination (2/0<->2/2 and 2/1<->2/3, for example).

⁵Reserved for future use.

⁶Reserved for future use.

TCP Reset Interfaces

This section explains the TCP reset interfaces and when to use them. It contains the following topics:

•Understanding Alternate TCP Reset Interfaces

•Designating the Alternate TCP Reset Interface

Understanding Alternate TCP Reset Interfaces

You can configure sensors to send TCP reset packets to try to reset a network connection between an attacker host and its intended target host. In some installations when the interface is operating in promiscuous mode, the sensor may not be able to send the TCP reset packets over the same sensing interface on which the attack was detected. In such cases, you can associate the sensing interface with an alternate TCP reset interface and any TCP resets that would otherwise be sent on the sensing interface when it is operating in promiscuous mode are instead sent out on the associated alternate TCP reset interface. For more information, see Designating the Alternate TCP Reset Interface.

If a sensing interface is associated with an alternate TCP reset interface, that association applies when the sensor is configured for promiscuous mode but is ignored when the sensing interface is configured for inline mode.

With the exception of IDSM-2, any sensing interface can serve as the alternate TCP reset interface for another sensing interface. The alternate TCP reset interface on IDSM-2 is fixed because of hardware limitation.

Table 3-3 lists the alternate TCP reset interfaces.

Table 3-3 Alternate TCP Reset Interfaces

Sensor

Alternate TCP Reset Interface

AIM-IPS

None¹

AIP-SSM-10

None²

AIP-SSM-20

None³

AIP-SSM-40

None⁴

IDS-4215

Any sensing interface

IDS-4235

Any sensing interface

IDS-4250

Any sensing interface

IDSM-2

System0/1⁵

IPS-4240

Any sensing interface

IPS-4255

Any sensing interface

IPS-4260

Any sensing interface

IPS 4270-20

Any sensing interface

NM-CIDS

None⁶

¹There is only one sensing interface on AIM-IPS.

²There is only one sensing interface on AIP-SSM-10.

³There is only one sensing interface on AIP-SSM-20.

⁴There is only one sensing interface on AIP-SSM-40.

⁵This is an internal interface on the Catalyst backplane.

⁶There is only one sensing interface on NM-CIDS.

Designating the Alternate TCP Reset Interface

You need to designate an alternate TCP reset interface in the following situations:

•When a switch is being monitored with either SPAN or VACL capture and the switch does not accept incoming packets on the SPAN or VACL capture port.

•When a switch is being monitored with either SPAN or VACL capture for multiple VLANs, and the switch does not accept incoming packets with 802.1q headers.

Note The TCP resets need 802.1q headers to tell which VLAN the resets should be sent on.

•When a network tap is used for monitoring a connection.

Note Taps do not permit incoming traffic from the sensor.

You can only assign a sensing interface as an alternate TCP reset interface. You cannot configure the management interface as an alternate TCP reset interface.

Interface Configuration Sequence

Follow these steps to configure interfaces on the sensor:

1. Configure the physical interface settings (speed, duplex, and so forth) and enable the interfaces.

For the procedure, see Configuring Interfaces.

2. Create or delete inline interfaces, inline VLAN subinterfaces, and VLAN groups, and set the inline bypass mode.

For the procedures, see Configuring Inline Interface Pairs, Configuring Inline VLAN Pairs, Configuring VLAN Groups, and Configuring Bypass Mode.

3. Assign the physical, subinterfaces, and inline interfaces to the virtual sensor.

For the procedure, see Adding, Editing, and Deleting Virtual Sensors, page 4-6.

Interface Configuration Restrictions

The following restrictions apply to configuring interfaces on the sensor:

•Physical Interfaces

–On modules (AIM-IPS, AIP-SSM, IDSM-2, and NM-CIDS) and IPS-4240, IPS-4255, IPS-4260, and IPS 4270-20, all backplane interfaces have fixed speed, duplex, and state settings. These settings are protected in the default configuration on all backplane interfaces.

–For nonbackplane FastEthernet interfaces the valid speed settings are 10 Mbps, 100 Mbps, and auto. Valid duplex settings are full, half, and auto.

–For Gigabit fiber interfaces (1000-SX and XL on IDS-4250), valid speed settings are 1000 Mbps and auto.

–For Gigabit copper interfaces (1000-TX on IDS-4235, IDS-4250, IPS-4240, IPS-4255, IPS-4260, and IPS 4270-20), valid speed settings are 10 Mbps, 100 Mbps, 1000 Mbps, and auto. Valid duplex settings are full, half, and auto.

–For Gigabit (copper or fiber) interfaces, if the speed is configured for 1000 Mbps, the only valid duplex setting is auto.

–The command and control interface cannot also serve as a sensing interface.

•Inline Interface Pairs

–Inline interface pairs can contain any combination of sensing interfaces regardless of the physical interface type (copper versus fiber), speed, or duplex settings of the interface. However, pairing interfaces of different media type, speeds, and duplex settings may not be fully tested or supported. For more information, see Interface Support.

–The command and control interface cannot be a member of an inline interface pair.

–You cannot pair a physical interface with itself in an inline interface pair.

–A physical interface can be a member of only one inline interface pair.

–You can only configure bypass mode and create inline interface pairs on sensor platforms that support inline mode.

–A physical interface cannot be a member of an inline interface pair unless the subinterface mode of the physical interface is none.

•Inline VLAN Pairs

–You cannot pair a VLAN with itself.

–For a given sensing interface, a VLAN can be a member of only one inline VLAN pair. However, a given VLAN can be a member of an inline VLAN pair on more than one sensing interface.

–The order in which you specify the VLANs in an inline VLAN pair is not significant.

–A sensing interface in inline VLAN pair mode can have from 1 to 255 inline VLAN pairs.

•Alternate TCP Reset Interface

–You can only assign the alternate TCP reset interface to a sensing interface. You cannot configure the command and control interface as an alternate TCP reset interface. The alternate TCP reset interface option is set to none as the default and is protected for all interfaces except the sensing interfaces.

–You can assign the same physical interface as an alternate TCP reset interface for multiple sensing interfaces.

–A physical interface can serve as both a sensing interface and an alternate TCP reset interface.

–The command and control interface cannot serve as the alternate TCP reset interface for a sensing interface.

–A sensing interface cannot serve as its own alternate TCP reset interface.

–You can only configure interfaces that are capable of TCP resets as alternate TCP reset interfaces.

Note The exception to this restriction is the IDSM-2. The alternate TCP reset interface assignments for both sensing interfaces is System0/1 (protected).

•VLAN Groups

–You can configure any single interface for promiscuous, inline interface pair, or inline VLAN pair mode, but no combination of these modes is allowed.

–You cannot add a VLAN to more than one group on each interface.

–You cannot add a VLAN group to multiple virtual sensors.

–An interface can have no more than 255 user-defined VLAN groups.

–When you pair a physical interface, you cannot subdivide it; you can subdivide the pair.

–You can use a VLAN on multiple interfaces; however, you receive a warning for this configuration.

–You can assign a virtual sensor to any combination of one or more physical interfaces and inline VLAN pairs, subdivided or not.

–You can subdivide both physical and logical interfaces into VLAN groups.

–CLI and IDM prompt you to remove any dangling references. You can leave the dangling references and continue editing the configuration.

–CLI and IDM do not allow configuration changes in Analysis Engine that conflict with the interface configuration.

–CLI allows configuration changes in the interface configuration that cause conflicts in the Analysis Engine configuration. IDM does not allow changes in the interface configuration that cause conflicts in the Analysis Engine configuration.

Hardware Bypass Mode

In addition to IPS 6.0 software bypass, IPS-4260 and IPS 4270-20 also support hardware bypass.

This section describes the hardware bypass card and its configuration restrictions. For the procedure for installing and removing the hardware bypass card, for IPS-4260, refer to "Installing and Removing PCI Cards," in Installing Cisco Intrusion Prevention System Appliances and Modules 6.0. For IPS 4270-20, refer to "Installing and Removing PCI Cards," in Installing Cisco Intrusion Prevention System Appliances and Modules 6.0.

This section contains the following topics:

•Hardware Bypass Card

•Hardware Bypass Configuration Restrictions

Hardware Bypass Card

IPS-4260 and IPS 4270-20 support the 4-port GigabitEthernet card (part number IPS-4GE-BP-INT=) with hardware bypass. This 4GE bypass interface card supports hardware bypass only between ports 0 and 1 and between ports 2 and 3.

Note To disable hardware bypass, pair the interfaces in any other combination, for example 2/0<->2/2 and 2/1<->2/3.

Hardware bypass complements the existing software bypass feature in IPS 6.0. For more information on software bypass mode, see Configuring Bypass Mode. The following conditions apply to hardware bypass and software bypass:

•When bypass is set to OFF, software bypass is not active.

For each inline interface for which hardware bypass is available, the component interfaces are set to disable the fail-open capability. If SensorApp fails, the sensor is powered off, reset, or if the NIC interface drivers fail or are unloaded, the paired interfaces enter the fail-closed state (no traffic flows through inline interface or inline VLAN subinterfaces).

•When bypass is set to ON, software bypass is active.

Software bypass forwards packets between the paired physical interfaces in each inline interface and between the paired VLANs in each inline VLAN subinterface. For each inline interface on which hardware bypass is available, the component interfaces are set to standby mode. If the sensor is powered off, reset, or if the NIC interfaces fail or are unloaded, those paired interfaces enter fail-open state in hardware (traffic flows unimpeded through inline interface). Any other inline interfaces enter fail-closed state.

•When bypass is set to AUTO (traffic flows without inspection), software bypass is activated if sensorApp fails.

For each inline interface on which hardware bypass is available, the component interfaces are set to standby mode. If the sensor is powered off, reset, or if the NIC interfaces fail or are unloaded, those paired interfaces enter fail-open state in hardware. Any other inline interfaces enter the fail-closed state.

Note To test fail-over, set the bypass mode to ON or AUTO, create one or more inline interfaces and power down the sensor and verify that traffic still flows through the inline path.

Hardware Bypass Configuration Restrictions

To use the hardware bypass feature on the 4GE bypass interface card, you must pair interfaces to support the hardware design of the card. If you create an inline interface that pairs a hardware-bypass-capable interface with an interface that violates one or more of the hardware-bypass configuration restrictions, hardware bypass is deactivated on the inline interface and you receive a warning message similar to the following:
Hardware bypass functionality is not available on Inline-interface pair0. 
Physical-interface GigabitEthernet2/0 is capable of performing hardware bypass only when 
paired with GigabitEthernet2/1, and both interfaces are enabled and configured with the 
same speed and duplex settings.
The following configuration restrictions apply to hardware bypass:

•The 4-port bypass card is only supported on IPS-4260 and IPS 4270-20.

•Fail-open hardware bypass only works on inline interfaces (interface pairs), not on inline VLAN pairs.

•Fail-open hardware bypass is available on an inline interface if all of the following conditions are met:

–Both of the physical interfaces support hardware bypass.

–Both of the physical interfaces are on the same interface card.

–The two physical interfaces are associated in hardware as a bypass pair.

–The speed and duplex settings are identical on the physical interfaces.

–Both of the interfaces are administratively enabled.

•Autonegotiation must be set on MDI/X switch ports connected to IPS-4260 and IPS 4270-20.

You must configure both the sensor ports and the switch ports for autonegotiation for hardware bypass to work. The switch ports must support MDI/X, which automatically reverses the transmit and receive lines if necessary to correct any cabling problems. The sensor is only guaranteed to operate correctly with the switch if both of them are configured for identical speed and duplex, which means that the sensor must be set for autonegotiation too.

Understanding Interface Modes

This section explains the various interface modes, and contains the following topics:

•Promiscuous Mode

•Inline Interface Mode

•Inline VLAN Pair Mode

•VLAN Group Mode

Promiscuous Mode

In promiscuous mode, packets do not flow through the sensor. The sensor analyzes a copy of the monitored traffic rather than the actual forwarded packet. The advantage of operating in promiscuous mode is that the sensor does not affect the packet flow with the forwarded traffic. The disadvantage of operating in promiscuous mode, however, is the sensor cannot stop malicious traffic from reaching its intended target for certain types of attacks, such as atomic attacks (single-packet attacks). The response actions implemented by promiscuous sensor devices are post-event responses and often require assistance from other networking devices, for example, routers and firewalls, to respond to an attack. While such response actions can prevent some classes of attacks, in atomic attacks the single packet has the chance of reaching the target system before the promiscuous-based sensor can apply an ACL modification on a managed device (such as a firewall, switch, or router).

Inline Interface Mode

Operating in inline interface pair mode puts the IPS directly into the traffic flow and affects packet-forwarding rates making them slower by adding latency. This allows the sensor to stop attacks by dropping malicious traffic before it reaches the intended target, thus providing a protective service. Not only is the inline device processing information on Layers 3 and 4, but it is also analyzing the contents and payload of the packets for more sophisticated embedded attacks (Layers 3 to 7). This deeper analysis lets the system identify and stop and/or block attacks that would normally pass through a traditional firewall device.

In inline interface pair mode, a packet comes in through the first interface of the pair on the sensor and out the second interface of the pair. The packet is sent to the second interface of the pair unless that packet is being denied or modified by a signature.

Note You can configure AIM-IPS and AIP-SSM to operate inline even though these modules have only one sensing interface.

Note If the paired interfaces are connected to the same switch, you should configure them on the switch as access ports with different access VLANs for the two ports. Otherwise, traffic does not flow through the inline interface.

Inline VLAN Pair Mode

You can associate VLANs in pairs on a physical interface. This is known as inline VLAN pair mode. Packets received on one of the paired VLANs are analyzed and then forwarded to the other VLAN in the pair. Inline VLAN pairs are supported on all sensors that are compatible with IPS 6.0 except AIM-IPS and AIP-SSM, and NM-CIDS.

Inline VLAN pair mode is an active sensing mode where a sensing interface acts as an 802.1q trunk port, and the sensor performs VLAN bridging between pairs of VLANs on the trunk. The sensor inspects the traffic it receives on each VLAN in each pair, and can either forward the packets on the other VLAN in the pair, or drop the packet if an intrusion attempt is detected. You can configure an IPS sensor to simultaneously bridge up to 255 VLAN pairs on each sensing interface. The sensor replaces the VLAN ID field in the 802.1q header of each received packet with the ID of the egress VLAN on which the sensor forwards the packet. The sensor drops all packets received on any VLANs that are not assigned to inline VLAN pairs.

VLAN Group Mode

You can divide each physical interface or inline interface into VLAN group subinterfaces, each of which consists of a group of VLANs on that interface. Analysis Engine supports multiple virtual sensors, each of which can monitor one or more of these interfaces.

This lets you apply multiple policies to the same sensor. The advantage is that now you can use a sensor with only a few interfaces as if it had many interfaces.

Note You cannot divide physical interfaces that are in inline VLAN pairs into VLAN groups.

VLAN group subinterfaces associate a set of VLANs with a physical or inline interface. No VLAN can be a member of more than one VLAN group subinterface. Each VLAN group subinterface is identified by a number between 1 and 255.

Subinterface 0 is a reserved subinterface number used to represent the entire unvirtualized physical or logical interface. You cannot create, delete, or modify subinterface 0 and no statistics are reported for it.

An unassigned VLAN group is maintained that contains all VLANs that are not specifically assigned to another VLAN group. You cannot directly specify the VLANs that are in the unassigned group. When a VLAN is added to or deleted from another VLAN group subinterface, the unassigned group is updated.

Packets in the native VLAN of an 802.1q trunk do not normally have 802.1q encapsulation headers to identify the VLAN number to which the packets belong. A default VLAN variable is associated with each physical interface and you should set this variable to the VLAN number of the native VLAN or to 0. The value 0 indicates that the native VLAN is either unknown or you do not care if it is specified. If the default VLAN setting is 0, the following occurs:

•Any alerts triggered by packets without 802.1q encapsulation have a VLAN value of 0 reported in the alert.

•Non-802.1q encapsulated traffic is associated with the unassigned VLAN group and it is not possible to assign the native VLAN to any other VLAN group.

Note You can configure a port on a switch as either an access port or a trunk port. On an access port, all traffic is in a single VLAN is called the access VLAN. On a trunk port, multiple VLANs can be carried over the port, and each packet has a special header attached called the 802.1q header that contains the VLAN ID. This header is commonly referred as the VLAN tag. However a trunk port has a special VLAN called the native VLAN. Packets in the native VLAN do not have the 802.1q headers attached. IDSM-2 can read the 802.1q headers for all nonnative traffic to determine the VLAN ID for that packet. However, IDSM-2 does not know which VLAN is configured as the native VLAN for the port in the switch configuration, so it does not know what VLAN the native packets are in. Therefore you must tell IDSM-2 which VLAN is the native VLAN for that port. Then IDSM-2 treats any untagged packets as if they were tagged with the native VLAN ID.

Interface Configuration Summary

This section describes the Summary pane, and contains the following topics:

•Overview

•Supported User Role

•Field Definitions

Overview

The Summary pane provides a summary of how you have configured the sensing interfaces—the interfaces you have configured for promiscuous mode, the interfaces you have configured as inline pairs, and the interfaces you have configured as inline VLAN pairs. The content of this pane changes when you change your interface configuration.

Caution You can configure any single physical interface to run in promiscuous mode, inline pair mode, or inline VLAN pair mode, but you cannot configure an interface in a combination of these modes.

Supported User Role

The following user roles are supported:

•Administrator

•Operator

•Viewer

Field Definitions

The following fields and buttons are found in the Summary pane:

Field Descriptions:

•Name—Name of the interface.

The values are FastEthernet or GigabitEthernet for promiscuous interfaces. For inline interfaces, the name is whatever you assigned to the pair.

•Details—Tells you whether the interface is promiscuous or inline and whether there are VLAN pairs.

•Assigned Virtual Sensor—Whether the interface or interface pair has been assigned to a virtual sensor.

•Description—Your description of the interface.

Configuring Interfaces

This section describes how to configure interfaces on the sensor, and contains the following topics:

•Overview

•Supported User Role

•Field Definitions

•Enabling and Disabling Interfaces

•Editing Interfaces

Overview

The Interfaces pane lists the existing physical interfaces on your sensor and their associated settings. The sensor detects the interfaces and populates the interfaces list in the Interfaces pane.

To configure the sensor to monitor traffic, you must enable the interface. When you initialized the sensor using the setup command, you assigned the interface or the inline pair to a virtual sensor, and enabled the interface or inline pair. If you need to change your interfaces settings, you can do so in the Interfaces pane.To add a virtual sensor and assign it an interface in the Add Virtual Sensor dialog box, choose Configuration > Analysis Engine > Virtual Sensors > Add.

Supported User Role

The following user roles are supported:

•Administrator

•Operator

•Viewer

You must be Administrator to edit the interfaces on the sensor.

Field Definitions

This section lists the field definitions for interfaces, and contains the following topics:

•Interfaces Pane

•Edit Interface Dialog Box

Interfaces Pane

The following fields and buttons are found in the Interfaces pane:

Field Descriptions:

•Interface Name—Name of the interface.

The values are FastEthernet or GigabitEthernet for all interfaces.

•Enabled—Whether or not the interface is enabled.

•Media Type—Indicates the media type.

The media type options are the following:

–TX—Copper media

–SX—Fiber media

–XL—Network accelerator card

–Backplane interface—An internal interface that connects the module to the backplane of the parent chassis.

•Duplex—Indicates the duplex setting of the interface.

The duplex type options are the following:

–Auto—Sets the interface to auto negotiate duplex.

–Full—Sets the interface to full duplex.

–Half—Sets the interface to half duplex.

•Speed—Indicates the speed setting of the interface.

The speed type options are the following:

–Auto—Sets the interface to auto negotiate speed.

–10 MB—Sets the interface to 10 MB (for TX interfaces only).

–100 MB—Sets the interface to 100 MB (for TX interfaces only).

–1000—Sets the interface to 1 GB (for gigabit interfaces only).

•Default VLAN—Indicates which VLAN the interface is assigned to.

•Alternate TCP Reset Interface—If selected, sends TCP resets on an alternate interface when this interface is used for promiscuous monitoring and the reset action is triggered by a signature firing.

•Description—Lets you provide a description of the interface.

Button Functions:

•Select All—Lets you select all entries in the list.

•Edit—Opens the Edit Interface dialog box. In this dialog box, you can change some of the values associated with this interface.

•Enable—Enables this interface.

•Disable—Disables this interface.

•Apply—Applies your changes and saves the revised configuration.

•Reset—Refreshes the pane by replacing any edits you made with the previously saved value.

Edit Interface Dialog Box

The following fields and buttons are found in the Edit Interface dialog box:

Field Descriptions:

•Interface Name—Name of the interface.

The values are FastEthernet or GigabitEthernet for all interfaces.

•Enabled—Whether or not the interface is enabled.

•Media Type—Indicates the media type.

The media types are the following:

–TX—Copper media

–SX—Fiber media

–XL—Network accelerator card

–Backplane interface—An internal interface that connects the module to the backplane of the parent chassis.

•Duplex—Indicates the duplex setting of the interface.

The duplex types are the following:

–Auto—Sets the interface to auto negotiate duplex.

–Full—Sets the interface to full duplex.

–Half—Sets the interface to half duplex.

•Speed—Indicates the speed setting of the interface.

The speed types are the following:

–Auto—Sets the interface to auto negotiate speed.

–10 MB—Sets the interface to 10 MB (for TX interfaces only).

–100 MB—Sets the interface to 100 MB (for TX interfaces only).

–1000—Sets the interface to 1 GB (for gigabit interfaces only).

•Default VLAN—Vlan ID associated with native traffic, or 0 if unknown or if you do not care which VLAN it is.

•Use Alternate TCP Reset Interface—If checked, sends TCP resets on an alternate interface when this interface is used for promiscuous monitoring and the reset action is triggered by a signature firing.

–Select Interface—Sets the interface that sends the TCP reset.

•Description—Lets you provide a description of the interface.

Button Functions:

•OK—Accepts your changes and closes the dialog box.

•Cancel—Discards your changes and closes the dialog box.

•Help—Displays the help topic for this feature.

Enabling and Disabling Interfaces

To enable or disable an interface, follow these steps:

Step 1 Log in to IDM using an account with administrator privileges.

Step 2 Choose Configuration > Interface Configuration > Interfaces.

The Interfaces pane appears.

Step 3 Select the interface and click Enable.

The interface is enabled. To have the interface monitor traffic, it must also be assigned to a virtual sensor. For the procedure, see Adding, Editing, and Deleting Virtual Sensors, page 4-6.

Step 4 Click OK.

The Enabled column reads Yes in the list in the Interfaces pane.

Tip To undo your changes, click Reset.

Step 5 To disable an interface, select it, and click Disable.

The Enabled column reads No in the list in the Interfaces pane.

Step 6 Click Apply to apply your changes and save the revised configuration.

Editing Interfaces

To edit the interface settings, follow these steps:

Step 1 Log in to IDM using an account with administrator privileges.

Step 2 Choose Configuration > Interface Configuration > Interfaces.

The Interfaces pane appears.

Step 3 Select the interface and click Edit.

The Edit Interface dialog box appears.

Note You can also double-click the interface and the Edit Interface dialog box appears.

Step 4 You can change the description in the Description field, or change the state from enabled to disabled by checking the No or Yes check box. You can have the interface use the alternate TCP reset interface by checking the Use Alternative TCP Reset Interface check box.

Tip To discard your changes and close the dialog box, click Cancel.

Step 5 Click OK.

The edited interface appears in the list in the Interfaces pane.

Tip To undo your changes, click Reset.

Step 6 Click Apply to apply your changes and save the revised configuration.

Configuring Inline Interface Pairs

This section describes how to set up inline interface pairs, and contains the following topics:

•Overview

•Supported User Role

•Field Definitions

•Configuring Inline Interface Pairs

Overview

You can pair interfaces on your sensor if your sensor is capable of inline monitoring.

Note AIP-SSM does not need an inline pair for monitoring. You only need to add the physical interface to a virtual sensor. For information on how to configure virtual sensors for AIP-SSM, refer to "Configuring AIP-SSM," in Configuring the Cisco Intrusion Prevention System Sensor Using the Command Line Interface 6.0.

Supported User Role

The following user roles are supported:

•Administrator

•Operator

•Viewer

You must be Administrator to configure interface pairs.

Field Definitions

This sections lists field definitions for interface pairs, and contains the following topics:

•Interface Pairs Pane

•Add and Edit Interface Pair Dialog Boxes

Interface Pairs Pane

The following fields and buttons are found in the Interface Pairs pane:

Field Descriptions:

•Interface Pair Name—The name you give the interface pair.

•Paired Interfaces—The two interfaces that you have paired (for example, GigabitEthernet0/0<->GigabitEthernet0/1).

•Description—Lets you add a description of this interface pair.

Button Functions:

•Select All—Selects all interface pairs.

•Add—Opens the Add Interface Pair dialog box. In this dialog box, you can add an interface pair.

•Edit—Opens the Edit Interface Pair dialog box. In this dialog box, you can edit the values of the interface pair.

•Delete—Deletes the selected interface pair.

•Apply—Applies your changes and saves the revised configuration.

•Reset—Refreshes the pane by replacing any edits you made with the previously saved value.

Add and Edit Interface Pair Dialog Boxes

The following fields and buttons are found in the Add and Edit Interface Pair dialog boxes:

Field Descriptions:

•Interface Pair Name—The name you give the interface pair.

•Select two interfaces—Lets you select two interfaces from the list to pair (for example, GigabitEthernet0/0<->GigabitEthernet0/1).

•Description—Lets you add a description of this interface pair.

Button Functions:

•OK—Accepts your changes and closes the dialog box.

•Cancel—Discards your changes and closes the dialog box.

•Help—Displays the help topic for this feature.

Configuring Inline Interface Pairs

To configure inline interface pairs, follow these steps:

Step 1 Log in to IDM using an account with administrator privileges.

Step 2 Choose Configuration > Interface Configuration > Interface Pairs.

The Interface Pairs pane appears.

Step 3 Click Add to add inline interface pairs.

The Add Interface Pair dialog box appears.

Step 4 Enter a name in the Interface Pair Name field.

The inline interface name is a name that you create.

Step 5 Select two interfaces to form a pair in the Select two interfaces field.

For example, GigabitEthernet0/0 and GigabitEthernet0/1.

Step 6 You can add a description of the inline interface pair in the Description field if you want to.

Tip To discard your changes and close the dialog box, click Cancel.

Step 7 Click OK.

The new inline interface pair appears in the list in the Interface Pairs pane.

Step 8 To edit an inline interface pair, select it, and click Edit.

The Edit Interface Pair dialog box appears.

Step 9 You can change the name, choose a new inline interface pair, or edit the description.

Tip To discard your changes and close the dialog box, click Cancel.

Step 10 Click OK.

The edited inline interface pair appears in the list in the Interface Pairs pane.

Step 11 To delete an inline interface pair, select it, and click Delete.

The inline interface pair no longer appears in the list in the Interface Pairs pane.

Tip To undo your changes, click Reset.

Step 12 Click Apply to apply your changes and save the revised configuration.

Configuring Inline VLAN Pairs

This section describes how to configure inline VLAN pairs, and contains the following topics:

•Overview

•Supported User Role

•Field Definitions

•Configuring Inline VLAN Pairs

Overview

The VLAN Pairs pane displays the existing inline VLAN pairs for each physical interface. Click Add to create an inline VLAN pair.

Note You cannot create an inline VLAN pair for an interface that has already been paired with another interface or for an interface that is in promiscuous mode and assigned to a virtual sensor.

To create an inline VLAN pair for an interface that is in promiscuous mode, you must remove the interface from the virtual sensor and then create the inline VLAN pair. If the interface is already paired or in promiscuous mode, you receive an error message when you try to create an inline VLAN pair.