Sensing Interfaces; Interface Support - Cisco IPS-4255-K9 - Intrusion Protection Sys 4255 Installation Manual

How the Sensor Functions
Table 1-1
Sensor
IPS 4255
IPS 4260
IPS 4270-20
NME IPS

Sensing Interfaces

Sensing interfaces are used by the sensor to analyze traffic for security violations. A sensor has one or
more sensing interfaces depending on the sensor. Sensing interfaces can operate individually in
promiscuous mode or you can pair them to create inline interfaces.
On appliances, all sensing interfaces are disabled by default. You must enable them to use them. On
Note
modules, the sensing interfaces are permanently enabled.
Some appliances support optional interface cards that add sensing interfaces to the sensor. You must
insert or remove these optional cards while the sensor is powered off. The sensor detects the addition or
removal of a supported interface card. If you remove an optional interface card, some of the interface
configuration is deleted, such as the speed, duplex, description string, enabled/disabled state of the
interface, and any inline interface pairings. These settings are restored to their default settings when the
card is reinstalled. However, the assignment of promiscuous and inline interfaces to the Analysis Engine
is not deleted from the Analysis Engine configuration, but is ignored until those cards are reinserted and
you create the inline interface pairs again.

Interface Support

Table 1-2
Table 1-2 Interface Support
Added
Interface
Base Chassis Cards
AIM IPS —
AIP SSM-10 —
Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0
1-6
Command and Control Interfaces (continued)
Command and Control Interface
Management0/0
Management0/0
Management0/0
Management0/01
describes the interface support for appliances and modules running Cisco IPS.
Interfaces Supporting
Inline VLAN Pairs (Sensing
Ports)
GigabitEthernet0/1 by
ids-service-module
command in the router
configuration instead of
VLAN pair or inline
interface pair
GigabitEthernet0/1 by
security context instead of
VLAN pair or inline
interface pair
Combinations Supporting Inline
Interface Pairs
GigabitEthernet0/1 by
ids-service-module command
in the router configuration
instead of VLAN pair or inline
interface pair
GigabitEthernet0/1 by security
context instead of VLAN pair
or inline interface pair
Chapter 1 Introducing the Sensor
Interfaces Not Supporting
Inline (Command and
Control Port)
Management0/0
GigabitEthernet0/0
OL-18504-01