Cisco IPS-4255-K9 Installation Guide - Page 29
Alternate TCP Reset Interface, Inline Interface Pairs
UPC - 746320951096
View all Cisco IPS-4255-K9 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 29 highlights
Chapter 1 Introducing the Sensor How the Sensor Functions • Inline Interface Pairs - Inline interface pairs can contain any combination of sensing interfaces regardless of the physical interface type (copper versus fiber), speed, or duplex settings of the interface. However, pairing interfaces of different media type, speeds, and duplex settings may not be fully tested or supported. - The command and control interface cannot be a member of an inline interface pair. - You cannot pair a physical interface with itself in an inline interface pair. - A physical interface can be a member of only one inline interface pair. - You can only configure bypass mode and create inline interface pairs on sensor platforms that support inline mode. - A physical interface cannot be a member of an inline interface pair unless the subinterface mode of the physical interface is none. • Inline VLAN Pairs - You cannot pair a VLAN with itself. - You cannot use the default VLAN as one of the paired VLANs in an inline VLAN pair. - For a given sensing interface, a VLAN can be a member of only one inline VLAN pair. However, a given VLAN can be a member of an inline VLAN pair on more than one sensing interface. - The order in which you specify the VLANs in an inline VLAN pair is not significant. - A sensing interface in inline VLAN pair mode can have from 1 to 255 inline VLAN pairs. • Alternate TCP Reset Interface - You can only assign the alternate TCP reset interface to a sensing interface. You cannot configure the command and control interface as an alternate TCP reset interface. The alternate TCP reset interface option is set to none as the default and is protected for all interfaces except the sensing interfaces. - You can assign the same physical interface as an alternate TCP reset interface for multiple sensing interfaces. - A physical interface can serve as both a sensing interface and an alternate TCP reset interface. - The command and control interface cannot serve as the alternate TCP reset interface for a sensing interface. - A sensing interface cannot serve as its own alternate TCP reset interface. - You can only configure interfaces that are capable of TCP resets as alternate TCP reset interfaces. Note The exception to this restriction is the IDSM2. The alternate TCP reset interface assignments for both sensing interfaces is System0/1 (protected). • VLAN Groups - You can configure any single interface for promiscuous, inline interface pair, or inline VLAN pair mode, but no combination of these modes is allowed. - You cannot add a VLAN to more than one group on each interface. - You cannot add a VLAN group to multiple virtual sensors. OL-18504-01 Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0 1-11