Catalyst Software - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Configuring the Catalyst Series 6500 Switch for IDSM-2 in Promiscuous Mode

Catalyst Software

Port 1 is set as the TCP reset port. Ports 7 and 8 are the sensing ports and can be configured as security
Note
ACL capture ports. By default, in Catalyst Software 8.4(1) and earlier releases, ports 7 and 8 are
configured as trunk ports and trunk all VLANs on which a security ACL has been applied with the
capture feature. If you want to monitor traffic from specific VLANs only, you need to clear the VLANs
that you do not want to monitor so that they are not trunked to ports 7 and 8.
Use the set security acl command to configure security ACL capture ports.
The following options apply:
•
•
•
•
•
•
•
To configure VACLs to capture IPS traffic on VLANs, follow these steps:
Log in to the console.
Step 1
Enter privileged mode.
Step 2
cat6k> enable
Create the VACL to capture traffic. Specify what traffic is permitted, denied, and captured:
Step 3
cat6k> (enable) set security acl ip acl_name permit ip [permit (...) | deny (...)] capture
Note
Example:
console> (enable) set security acl ip CAPTUREALL permit ip any any capture
CAPTUREALL editbuffer modified. Use 'commit' command to apply changes.
Commit the VACL:
Step 4
console> (enable) commit security acl CAPTUREALL
ACL commit in progress.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
15-12
ACL—Sets security ACL features
capture-port—Sets ports for ACL capture
–
cram—Sets security ACL cram
–
ip —Sets IP security ACL features
–
ipx—Sets IPX security ACL features
–
mac—Sets MAC security ACL features
–
map— Sets security ACL to VLAN mapping
–
permit—Specifies packets to forward
deny—Specifies packets to reject
redirect—Specifies packets to redirect to ports
before—Inserts ACE before a specified ace in editbuffer
capture—Makes a copy of this flow in capture ports
modify— Modifies a specified ACE in editbuffer
Only permitted traffic can be captured. If you want to permit traffic but not capture it, do no use
the capture keyword
Chapter 15 Configuring IDSM-2
78-16527-01