Cisco IPS-4255-K9 Installation Guide - Page 30

How the Sensor Functions Chapter 1 Introducing the Sensor - An interface can have no more than 255 user-defined VLAN groups. - When you pair a physical interface, you cannot subdivide it; you can subdivide the pair. - You can use a VLAN on multiple interfaces; however, you receive a warning for this configuration. - You can assign a virtual sensor to any combination of one or more physical interfaces and inline VLAN pairs, subdivided or not. - You can subdivide both physical and logical interfaces into VLAN groups. - CLI, IDM, and IME prompt you to remove any dangling references. You can leave the dangling references and continue editing the configuration. - CLI, IDM, and IME do not allow configuration changes in Analysis Engine that conflict with the interface configuration. - CLI allows configuration changes in the interface configuration that cause conflicts in the Analysis Engine configuration. IDM and IME do not allow changes in the interface configuration that cause conflicts in the Analysis Engine configuration. Interface Modes The following section describes the interface modes, and contains the following topics: • Promiscuous Mode, page 1-12 • IPv6, Switches, and Lack of VACL Capture, page 1-13 • Inline Interface Pair Mode, page 1-14 • Inline VLAN Pair Mode, page 1-15 • VLAN Group Mode, page 1-15 • Deploying VLAN Groups, page 1-16 Promiscuous Mode In promiscuous mode, packets do not flow through the sensor. The sensor analyzes a copy of the monitored traffic rather than the actual forwarded packet. The advantage of operating in promiscuous mode is that the sensor does not affect the packet flow with the forwarded traffic. The disadvantage of operating in promiscuous mode, however, is the sensor cannot stop malicious traffic from reaching its intended target for certain types of attacks, such as atomic attacks (single-packet attacks). The response actions implemented by promiscuous sensor devices are post-event responses and often require assistance from other networking devices, for example, routers and firewalls, to respond to an attack. While such response actions can prevent some classes of attacks, in atomic attacks the single packet has the chance of reaching the target system before the promiscuous-based sensor can apply an ACL modification on a managed device (such as a firewall, switch, or router). By default, all sensing interfaces are in promiscuous mode. To change an interface from inline interface mode to promiscuous mode, delete any inline interface that contains that interface and delete any inline VLAN pair subinterfaces of that interface from the interface configuration. 1-12 Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0 OL-18504-01