Catalyst Software; Cisco Ios Software - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Chapter 15 Configuring IDSM-2

Catalyst Software

When you are running the Cisco IOS Firewall on the MSFC, you cannot use VACLs to capture traffic
for IDSM-2, because you cannot apply VACLs to a VLAN in which you have applied an IP inspect rule
for the Cisco IOS Firewall. However, you can use the mls ip ids command to designate which packets
are captured. Packets that are permitted by the ACL are captured. Those denied by the ACL are not
captured. The permit/deny parameter does not affect whether a packet is forwarded to destination ports.
Packets coming into that router interface are checked against the IPS ACL to determine if they should
be captured. The mls ip ids command is applied as part of the MSFC configuration instead of the
supervisor configuration. The mls ip ids command only captures incoming traffic. You will need to use
the mls ip ids command on both the client-side router interface and server-side router interface, so that
both directions of the connection will be captured.
To use the mls ip ids command to capture IPS traffic, follow these steps:
Log in to the MSFC.
Step 1
Enter privileged mode:
Step 2
cat6k> enable
Enter configuration mode:
Step 3
router# configure terminal
Configure an ACL to designate which packets will be captured:
Step 4
router(config)# ip access-list extended word
Step 5 Select the interface that carries the packets to be captured:
router(config)# interface interface_name
Step 6 Apply the ACL created in Step 4 to the interface selected in Step 5:
router(config-if)# mls ip ids word
Step 7 Log in to the supervisor engine.
Enter privileged mode.
Step 8
cat6k> enable
On the supervisor engine, add the IDSM-2 monitoring port (port 7 or 8) to the VACL capture list:
Step 9
cat6k> (enable) set security acl capture module_number/port_number
For IDSM-2 to capture all packets marked by the mls ip ids command, port 7 or 8 of IDSM-2 must be a
Caution
member of all VLANs to which those packets are routed.

Cisco IOS Software

When you are using ports as router interfaces rather than switch ports, there is no VLAN on which to
apply a VACL.
78-16527-01
Configuring the Catalyst Series 6500 Switch for IDSM-2 in Promiscuous Mode
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
15-15