Cisco IPS-4255-K9 Installation Guide - Page 31

Chapter 1 Introducing the Sensor How the Sensor Functions Figure 1-2 illustrates promiscuous mode. Figure 1-2 Promiscuous Mode Switch Router VLAN A Host Span port sending copies of VLAN A traffic 253443 Sensor For More Information For a list of restrictions pertaining to IPS sensor interfaces, see Interface Restrictions, page 1-10. IPv6, Switches, and Lack of VACL Capture VACLs on Catalyst switches do not have IPv6 support. The most common method for copying traffic to a sensor configured in promiscuous mode is to use VACL capture. If you want to have IPv6 support, you can use SPAN ports. However, you can only configure up to two monitor sessions on a switch unless you use the following configuration: • Monitor session • Multiple trunks to one or more sensors • Restrict per trunk port which VLANs are allowed to perform monitoring of many VLANs to more than two different sensors or virtual sensors within one IPS The following configuration uses one SPAN session to send all of the traffic on any of the specified VLANs to all of the specified ports. Each port configuration only allows a particular VLAN or VLANs to pass. Thus you can send data from different VLANs to different sensors or virtual sensors all with one SPAN configuration line: clear trunk 4/1-4 1-4094 set trunk 4/1 on dot1q 930 set trunk 4/2 on dot1q 932 set trunk 4/3 on dot1q 960 set trunk 4/4 on dot1q 962 set span 930, 932, 960, 962 4/1-4 both Note The SPAN/Monitor configuration is valuable when you want to assign different IPS policies per VLAN or when you have more bandwidth to monitor than one interface can handle. OL-18504-01 Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0 1-13