Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 6.0
Configuring IDSM-2
Downloads: This chapterpdf (PDF - 515.0KB) The complete bookPDF (PDF - 8.39MB) | Feedback

Configuring the IDSM2

Table Of Contents

Configuring the IDSM2

Configuration Sequence

Verifying the IDSM2 Installation

Minimum Supported IDSM2 Configurations

Configuring the Catalyst 6500 Series Switch for Command and Control Access to the IDSM2

Catalyst Software

Cisco IOS Software

IDSM2 Sensing Modes

Configuring the Catalyst Series 6500 Switch for the IDSM2 in Promiscuous Mode

Using the TCP Reset Interface

Configuring SPAN

Catalyst Software

Cisco IOS Software

Configuring VACL Capture

Catalyst Software

Cisco IOS Software

Configuring the mls ip ids Command

Catalyst Software

Cisco IOS Software

Configuring the Catalyst Series 6500 Switch for the IDSM2 in Inline Mode

Catalyst Software

Cisco IOS Software

Configuring the Catalyst Series 6500 Switch for the IDSM2 for Inline VLAN Pair Mode

Catalyst Software

Cisco IOS Software

Configuring EtherChannel Load Balancing

Overview

EtherChannel and the Three Sensing Modes

Enabling ECLB

Catalyst Software

Cisco IOS Software

Disabling ECLB

Catalyst Software

Cisco IOS Software

Verifying ECLB

Catalyst Software

Cisco IOS Software

Administrative Tasks for the IDSM2

Enabling Full Memory Tests

Catalyst Software

Cisco IOS Software

Resetting the IDSM2

Catalyst Software

Cisco IOS Software

Catalyst and Cisco IOS Software Commands

Catalyst Software

Supported Supervisor Engine Commands

Unsupported Supervisor Engine Commands

Cisco IOS Software

EXEC Commands

Configuration Commands


Configuring the IDSM2



Note The number of concurrent CLI sessions is limited based on the platform. IDS 4215 and NM CIDS are limited to three concurrent CLI sessions. All other platforms allow ten concurrent sessions.



Note Catalyst 6500 Series Switch is used generically to refer to both the 6500 series switches and the 7600 series routers.


This chapter contains procedures that are specific to configuring the IDSM2. Once you set up the IDSM2 to receive traffic from the network, you can configure it for intrusion prevention. It contains the following sections:

Configuration Sequence

Verifying the IDSM2 Installation

Minimum Supported IDSM2 Configurations

Configuring the Catalyst 6500 Series Switch for Command and Control Access to the IDSM2

IDSM2 Sensing Modes

Configuring the Catalyst Series 6500 Switch for the IDSM2 in Promiscuous Mode

Configuring the Catalyst Series 6500 Switch for the IDSM2 in Inline Mode

Configuring the Catalyst Series 6500 Switch for the IDSM2 for Inline VLAN Pair Mode

Configuring EtherChannel Load Balancing

Administrative Tasks for the IDSM2

Catalyst and Cisco IOS Software Commands

Configuration Sequence

Perform the following tasks to configure the IDSM2:

1. Configure the Catalyst 6500 series switch for command and control access to the IDSM2.

2. Log in to the IDSM2.

3. Configure the switch to send traffic to be monitored to the IDSM2.

4. Initialize the IDSM2. Run the setup command to initialize the IDSM2. During setup, you can configure the interfaces of the IDSM2.

5. Create the service account.

6. Perform the other initial tasks, such as adding users, trusted hosts, and so forth.

7. Configure intrusion prevention.

8. Perform miscellaneous tasks to keep the IDSM2 running smoothly.

9. Upgrade the IPS software with new signature updates and service packs.

10. Reimage the application partition and the maintenance partition when needed.

For More Information

For the procedure for configuring command and control access to the IDSM2, see Configuring the Catalyst 6500 Series Switch for Command and Control Access to the IDSM2.

For the procedure to session to the IDSM2, see Logging In to the IDSM2.

For the procedures for configuring the switch to send traffic to the IDSM2, see the following procedures:

Configuring the Catalyst Series 6500 Switch for the IDSM2 in Promiscuous Mode

Configuring the Catalyst Series 6500 Switch for the IDSM2 in Inline Mode

Configuring the Catalyst Series 6500 Switch for the IDSM2 for Inline VLAN Pair Mode

Configuring EtherChannel Load Balancing

For the procedure for using the setup command to initialize the IDSM2, see Initializing the IDSM2.

If you need to change the interface configuration, see Chapter 5 "Configuring Interfaces."

For the procedure for creating the service account, see Creating the Service Account.

For the procedures for setting up the sensor, see Chapter 4 "Initial Configuration Tasks."

For the procedures for configuring intrusion prevention, see the following procedures:

Chapter 9 "Configuring Anomaly Detection"

Chapter 8 "Configuring Event Action Rules"

Chapter 6 "Defining Signatures"

Chapter 13 "Configuring Attack Response Controller for Blocking and Rate Limiting"

For the administrative procedures, see Chapter 16 "Administrative Tasks for the Sensor" and Administrative Tasks for the IDSM2.

For more information on obtaining IPS software, see Obtaining Cisco IPS Software.

For the procedures for reimaging the IDSM2, see Installing the IDSM2 System Image.

Verifying the IDSM2 Installation

Use the show module command to verify that the switch acknowledges the IDSM2 and has brought it online. To verify the installation, follow these steps:


Step 1 Log in to the console.

Step 2 For Catalyst software.

console> (enable) show module
Mod Slot Ports Module-Type               Model               Sub Status
--- ---- ----- ------------------------- ------------------- --- --------
1   1    2     1000BaseX Supervisor      WS-X6K-SUP1A-2GE    yes ok
15  1    1     Multilayer Switch Feature WS-F6K-MSFC         no  ok
2   2    48    10/100BaseTX Ethernet     WS-X6248-RJ-45      no  ok
3   3    48    10/100/1000BaseT Ethernet WS-X6548-GE-TX      no  ok
4   4    16    1000BaseX Ethernet        WS-X6516A-GBIC      no  ok
6   6    8     Intrusion Detection Mod   WS-SVC-IDSM2        yes ok
 
   
Mod Module-Name          Serial-Num
--- -------------------- -----------
1                        SAD041308AN
15                       SAD04120BRB
2                        SAD03475400
3                        SAD073906RC
4                        SAL0751QYN0
6                        SAD062004LV
 
   
Mod MAC-Address(es)                        Hw     Fw         Sw
--- -------------------------------------- ------ ---------- -----------------
1   00-d0-c0-cc-0e-d2 to 00-d0-c0-cc-0e-d3 3.1    5.3.1      8.4(1)
    00-d0-c0-cc-0e-d0 to 00-d0-c0-cc-0e-d1
    00-30-71-34-10-00 to 00-30-71-34-13-ff
15  00-30-7b-91-77-b0 to 00-30-7b-91-77-ef 1.4    12.1(23)E2 12.1(23)E2
2   00-30-96-2b-c7-2c to 00-30-96-2b-c7-5b 1.1    4.2(0.24)V 8.4(1)
3   00-0d-29-f6-01-98 to 00-0d-29-f6-01-c7 5.0    7.2(1)     8.4(1)
4   00-0e-83-af-15-48 to 00-0e-83-af-15-57 1.0    7.2(1)     8.4(1)
6   00-e0-b0-ff-3b-80 to 00-e0-b0-ff-3b-87 0.102  7.2(0.67)  5.0(0.30)
 
   
Mod Sub-Type                Sub-Model           Sub-Serial  Sub-Hw Sub-Sw
--- ----------------------- ------------------- ----------- ------ ------
1   L3 Switching Engine     WS-F6K-PFC          SAD041303G6 1.1
6   IDS 2 accelerator board WS-SVC-IDSUPG       .           2.0
console> (enable)
 
   

Step 3 For Cisco IOS software.

router# show module
Mod Ports Card Type                              Model              Serial No.
--- ----- -------------------------------------- ------------------ -----------
  1   48  48 port 10/100 mb RJ-45 ethernet       WS-X6248-RJ-45     SAD0401012S
  2   48  48 port 10/100 mb RJ45                 WS-X6348-RJ-45     SAL04483QBL
  3   48  SFM-capable 48 port 10/100/1000mb RJ45 WS-X6548-GE-TX     SAD073906GH
  6   16  SFM-capable 16 port 1000mb GBIC        WS-X6516A-GBIC     SAL0740MMYJ
  7    2  Supervisor Engine 720 (Active)         WS-SUP720-3BXL     SAD08320L2T
  9    1  1 port 10-Gigabit Ethernet Module      WS-X6502-10GE      SAD071903BT
 10    3  Anomaly Detector Module                WS-SVC-ADM-1-K9    SAD084104JR
 11    8  Intrusion Detection System             WS-SVC-IDSM2       SAD05380608
 13    8  Intrusion Detection System             WS-SVC-IDSM-2      SAD072405D8
 
   
Mod MAC addresses                       Hw    Fw           Sw           Status
--- ---------------------------------- ------ ------------ ------------ -------
  1  00d0.d328.e2ac to 00d0.d328.e2db   1.1   4.2(0.24)VAI 8.5(0.46)ROC Ok
  2  0003.6c14.e1d0 to 0003.6c14.e1ff   1.4   5.4(2)       8.5(0.46)ROC Ok
  3  000d.29f6.7a80 to 000d.29f6.7aaf   5.0   7.2(1)       8.5(0.46)ROC Ok
  6  000d.ed23.1658 to 000d.ed23.1667   1.0   7.2(1)       8.5(0.46)ROC Ok
  7  0011.21a1.1398 to 0011.21a1.139b   4.0   8.1(3)       12.2(PIKESPE Ok
  9  000d.29c1.41bc to 000d.29c1.41bc   1.3   Unknown      Unknown      PwrDown
 10  000b.fcf8.2ca8 to 000b.fcf8.2caf   0.101 7.2(1)       4.0(0.25)    Ok
 11  00e0.b0ff.3340 to 00e0.b0ff.3347   0.102 7.2(0.67)    5.0(1)       Ok
 13  0003.feab.c850 to 0003.feab.c857   4.0   7.2(1)       5.0(1)       Ok
 
   
Mod Sub-Module                  Model              Serial        Hw     Status
--- --------------------------- ------------------ ------------ ------- -------
  7 Policy Feature Card 3       WS-F6K-PFC3BXL     SAD083305A1   1.3    Ok
  7 MSFC3 Daughterboard         WS-SUP720          SAD083206JX   2.1    Ok
 11 IDS 2 accelerator board     WS-SVC-IDSUPG      .             2.0    Ok
 13 IDS 2 accelerator board     WS-SVC-IDSUPG      0347331976    2.0    Ok
 
   
Mod Online Diag Status
--- -------------------
  1 Pass
  2 Pass
  3 Pass
  6 Pass
  7 Pass
  9 Unknown
 10 Not Applicable
 11 Pass
 13 Pass
router#
 
   

Note It is normal for the status to read other when the IDSM2 is first installed. After the IDSM2 completes the diagnostics routines and comes online, the status reads ok. Allow up to 5 minutes for the IDSM2 to come online.



For More Information

For information on enabling a full memory test after verifying the IDSM2 installation, see Enabling Full Memory Tests.

Minimum Supported IDSM2 Configurations


Note The following matrix is not intended to recommend any particular version, but rather lists the earliest supported versions.


Table 19-1 lists the minimum supported configurations for the IDSM2.

Table 19-1 Minimum Catalyst 6500 Software Version for IDSM2 Feature Support 

Catalyst/IDSM2 Feature
Catalyst Software
Cisco IOS Software
 
Sup1
Sup2
Sup32
Sup720
Sup1
Sup2
Sup32
Sup720

SPAN

7.5(1)

7.5(1)

8.4(1)

8.1(1)

12.1(19)E1

12.1(19)E1
12.2(18)SXF1

12.2(18)SXF1

12.2(14)SX1

VACL capture1

7.5(1)

7.5(1)

8.4(1)

8.1(1)

12.1(19)E1

12.1(19)E1
12.2(18)SXF1

12.2(18)SXF1

12.2(14)SX1

ECLB with VACL capture2

8.5(1)

8.5(1)

8.5(1)

8.5(1)

N/A

12.2(18)SXF4

12.2(18)SXF1

12.2(18)SXE1

Inline interface pairs

8.4(1)

8.4(1)

8.4(1)

8.4(1)

N/A

12.2(18)SXF4

12.2(18)SXF4

12.2(18)SXE1

ECLB with inline interface pairs

8.5(1)

8.5(1)

8.5(1)

8.5(1)

N/A

12.2(18)SXF4

12.2(18)SXF4

12.2(18)SXF4

Inline VLAN pairs

8.4(1)

8.4(1)

8.4(1)

8.4(1)

N/A

12.2(18)SXF4

12.2(18)SXF4

12.2(18)SXF4

ECLB with inline VLAN pairs

8.5(1)

8.5(1)

8.5(1)

8.5(1)

N/A

12.2(18)SXF4

12.2(18)SXF4

12.2(18)SXF4

1 Requires PFC2/3 or MSFC2/3.

2 Requires PFC2/3 or MSFC2/3.


Configuring the Catalyst 6500 Series Switch for Command and Control Access to the IDSM2

You must configure the Catalyst 6500 series switch to have command and control access to the IDSM2. This section describes how to configure the switch to have command and control access, and contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

To configure the Catalyst 6500 series switch to have command and control access to the IDSM2, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Put the command and control port in to the correct VLAN.

console> (enable) set vlan command_and_control_vlan_number 
idsm2_slot_number/command_and_control_port_number
 
   

Example:

console> (enable) set vlan 147 6/2
VLAN 147 modified.
VLAN 146 modified.
VLAN  Mod/Ports
---- -----------------------
147   2/5,2/16-18
      6/2
 
   

The command and control port number is always 2.

Step 4 Session to the IDSM2 and ping a network IP address.

console> session slot_number
idsm-2# ping network_ip_address
 
   

Example:

console> (enable) session 6
Trying IDS-6...
Connected to IDS-6.
Escape character is '^]'.
 
   
login: cisco
Password: 
Last login: Thu Mar 3 09:40:53 from 127.0.0.11
***NOTICE***
This product contains cryptographic features and is subject to United States and local 
country laws governing import, export, transfer and use. Delivery of Cisco cryptographic 
products does not imply third-party authority to import, export, distribute or use 
encryption. Importers, exporters, distributors and users are responsible for compliance 
with U.S. and local country laws. By using this product you agree to comply with 
applicable laws and regulations. If you are unable to comply with U.S. and local laws, 
return this product immediately.
 
   
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
 
   
If you require further assistance please contact us by sending email to
export@cisco.com.
 
   
***LICENSE NOTICE***
There is no license key installed on the system.
Please go to http://www.cisco.com/go/license to obtain a new license or install a license.
idsm-2# ping 10.89.149.126
PING 10.89.149.126 (10.89.149.126): 56 data bytes
64 bytes from 10.89.149.126: icmp_seq=0 ttl=255 time=0.3 ms
64 bytes from 10.89.149.126: icmp_seq=1 ttl=255 time=0.3 ms
64 bytes from 10.89.149.126: icmp_seq=2 ttl=255 time=0.3 ms
64 bytes from 10.89.149.126: icmp_seq=3 ttl=255 time=0.3 ms
--- 10.89.149.126 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 0.3/0.3/0.3 ms
idsm-2# exit
console> (enable) 
 
   

Step 5 Initialize the IDSM2.

Step 6 Ping the default router of the IDSM2.

Step 7 Verify the management station can ping, SSH or Telnet, and web browse to the IDSM2.


For More Information

For the procedure for using the setup command to initialize the IDSM2, see Initializing the IDSM2.

Cisco IOS Software

To configure the Catalyst 6500 series switch to have command and control access to the IDSM2, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal
 
   

Step 3 Put the command and control port in to the correct VLAN.

router (config)# intrusion-detection module module_number management-port access-vlan 
vlan_number
 
   

Example:

router (config)# intrusion-detection module 11 management-port access-vlan 146
 
   

Step 4 Verify that you have connectivity by sessioning in to the IDSM2 and pinging a network IP address.

router# session slot module_number processor 1
idsm-2# ping network_ip_address
 
   

Example:

router# session slot 11 processor 1
The default escape character is Ctrl-^, then x.
You can also type 'exit' at the remote prompt to end the session
Trying 127.0.0.91 ... Open
 
   
login: cisco
Password: 
***NOTICE***
This product contains cryptographic features and is subject to United States and local 
country laws governing import, export, transfer and use. Delivery of Cisco cryptographic 
products does not imply third-party authority to import, export, distribute or use 
encryption. Importers, exporters, distributors and users are responsible for compliance 
with U.S. and local country laws. By using this product you agree to comply with 
applicable laws and regulations. If you are unable to comply with U.S. and local laws, 
return this product immediately.
 
   
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
 
   
If you require further assistance please contact us by sending email to
export@cisco.com.
***LICENSE NOTICE***
There is no license key installed on the system.
Please go to http://www.cisco.com/go/license
to obtain a new license or install a license.
idsm-2# ping 10.89.149.254
PING 10.89.149.254 (10.89.149.254): 56 data bytes
64 bytes from 10.89.149.254: icmp_seq=0 ttl=255 time=0.2 ms
64 bytes from 10.89.149.254: icmp_seq=1 ttl=255 time=0.2 ms
64 bytes from 10.89.149.254: icmp_seq=2 ttl=255 time=0.2 ms
64 bytes from 10.89.149.254: icmp_seq=3 ttl=255 time=0.2 ms
--- 10.89.149.254 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
idsm-2# exit
[Connection to 127.0.0.91 closed by foreign host]
router#
 
   

Step 5 Initialize the IDSM2.


For More Information

For the procedure for using the setup command to initialize the IDSM2, see Initializing the IDSM2.

IDSM2 Sensing Modes


Note You can mix sensing modes on the IDSM2. For example, you can configure one data port for promiscuous mode and the other data port for inline VLAN pair mode. But because the IDSM2 only has two data ports and inline mode requires the use of both data ports as a pair, you cannot mix inline mode with either of the other two modes.


The IDSM2 supports three sensing modes:

Promiscuous mode—When the IDSM2 was introduced, promiscuous mode was the only sensing mode supported on the IDSM2 and it is the default sensing mode for both data ports.

In promiscuous mode, the IDSM2 passively monitors network traffic copied to its data ports by the Catalyst switch. The data ports operate as 802.1q trunks and you can configure the two data ports to trunk the same or different VLANs. The Catalyst switch uses either SPAN or VACL capture to copy specific traffic to the data ports. You can send the same or different traffic to the two data ports. Because the IDSM2 is passive in this mode, it cannot drop packets to block a network intrusion attempt, but you can configure it to send TCP resets to both sides of the network connection to try to break the connection.


Note Because the Catalyst switch does not forward traffic received from a capture destination port, the IDSM2 cannot send TCP resets over the data ports to try to block an intrusion. Therefore, a separate reset port available only in promiscuous mode is reserved for this purpose.


Inline mode—Beginning with IPS 5.0(1), you can configure the IDSM2 to be an active network device in Inline Interface Pair mode. The two data ports operate together to bridge two VLANs through the IDSM2. You configure each data port as an access port and assign a different VLAN to each data port. The IDSM2 bridges the two VLANs by forwarding traffic between the two data ports. It inspects the traffic it receives on each data port and can either forward the packets to the other data port or drop the packet if it detects intrusion. You must configure the switch for inline mode and then create the inline interface pairs on the IDSM2.

Inline VLAN pair mode—Beginning with IPS 5.1(1), you can configure the IDSM2 in inline VLAN pair mode. The IDSM2 performs VLAN bridging between pairs of VLANs within the same data port operating as an 802.1q trunk. The IDSM2 inspects the traffic it receives on each VLAN in a VLAN pair and can either forward the packets on the other VLAN in the pair (on the same data port on which the packet was received) or drop the packet if an intrusion is detected. You can configure the IDSM2 to simultaneously bridge up to 255 VLAN pairs on each data port. The IDSM2 replaces the VLAN ID field in the 802.1q header of each packet with the ID of the VLAN on which the packet is forwarded. It drops any packets received on VLANs that are not assigned to an inline VLAN pair.


Note You are responsible for coordinating the IPS and switch configuration to make sure each of the VLANS associated with an inline VLAN pair is also an allowed VLAN for the data port trunk.


For More Information

For more information on promiscuous mode on the sensor, see Configuring Promiscuous Mode.

For more information on TCP reset, see TCP Reset Interfaces.

For the procedure for configuring SPAN, see Configuring SPAN. For the procedure for configuring VACL capture, see Configuring VACL Capture.

For more information on inline mode for sensors, see Configuring Inline Interface Mode.

For more information on configuring inline mode for the IDSM2, Configuring the Catalyst Series 6500 Switch for the IDSM2 in Inline Mode),

For more information on Inline Interface mode, see Understanding Inline Interface Mode).

For more information on Inline VLAN pair mode, see Configuring Inline VLAN Pair Mode.

For the procedure for configuring the IDSM2 Inline VLAN pair mode, see Configuring the Catalyst Series 6500 Switch for the IDSM2 for Inline VLAN Pair Mode.

Configuring the Catalyst Series 6500 Switch for the IDSM2 in Promiscuous Mode

Traffic is captured for promiscuous analysis on the IDSM2 through SPAN or VACL capture (if you are running the Cisco IOS Firewall on the MSFC, you cannot use VACLs, but you can use the mls ip ids command). Port 1 (GigabitEthernet0/1) is used as the TCP reset port, port 2 (GigabitEthernet0/2) is the command and control port, and ports 7 and 8 (GigabitEthernet0/7 and GigabitEthernet0/8) are the monitoring ports. You can configure both monitoring ports to be either SPAN destination ports or VACL capture ports.


Caution If you configure both ports as monitoring ports, make sure that they are configured to monitor different traffic.


Caution You should not configure an IDSM2 data port as both a SPAN destination port and a VACL capture port, because the IDSM2 will not receive traffic. This dual configuration (SPAN and VACL) causes problems on the switch and traffic is not sent properly.


Note Before Catalyst Software 8.4(3), the IDSM2 data ports defaulted to trunking all VLANs. In Catalyst Software 8.4(3) and later, the IDSM2 data ports default to trunking no VLANs. Make sure that the IDSM2 ports are trunking the proper VLANs, especially if you are upgrading from pre-8.4(3) to 8.4(3) or later.


This section contains the following topics:

Using the TCP Reset Interface

Configuring SPAN

Configuring VACL Capture

Configuring the mls ip ids Command

Using the TCP Reset Interface

The IDSM2 has a TCP reset interface—port 1. The IDSM2 has a specific TCP reset interface because it cannot send TCP resets on its sensing ports.

If you have reset problems with the IDSM2, and the switch is running Catalyst software, try the following:

If the sensing ports are access ports (a single VLAN), you need to configure the reset port to be in the same VLAN.

If the sensing ports are dot1q trunk ports (multi-VLAN), the sensing ports and reset port all must have the same native VLAN, and the reset port must trunk all the VLANs being trunked by both the sensing ports.


Note In Cisco IOS when the IDSM2 is in promiscuous mode, the IDSM2 ports are always dot1q trunk ports (even when monitoring only 1 VLAN), and the TCP reset port is automatically set to a trunk port and is not configurable.


Configuring SPAN

The IDSM2 can analyze Ethernet VLAN traffic from Ethernet or Fast Ethernet SPAN source ports, or you can specify an Ethernet VLAN as the SPAN source.

This section describes how to configure SPAN, and contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software


Note The IDSM2 port numbers are 7 or 8 only.


Use the set span command in privileged mode to enable SPAN to the IDSM2.

The following options apply:

disable—Disables port monitoring.

module/port—Source module and port numbers.

vlan—Source VLAN numbers.

module/port—Destination module and port numbers.

both—Both receiving and transmitting traffic.

filter—Applies filter to VLAN.

inpkts—Enables/disables destination port incoming packets.

learning—Enables/disables MAC address learning.

multicast—Enables/disables multicast traffic.

rx—Receiving traffic.

session— Session number for SPAN session.

tx —Transmitting traffic.

To enable SPAN on the IDSM2, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Enable SPAN to the IDSM2:

From a source port:

console> (enable) set span 3/3 13/7
Destination     : Port 13/7
Admin Source    : Port 3/3
Oper Source     : Port 3/3
Direction       : transmit/receive
Incoming Packets: disabled
Learning        : enabled
Multicast       : enabled
Filter          : -
 
   
Session Number  : 1
 
   
console> (enable) 
 
   

Note Use the filter keyword to monitor traffic on specific VLANs on source trunk ports.


From a VLAN:

console> (enable) set span 650 13/7 rx
Destination     : Port 13/7
Admin Source    : VLAN 650
Oper Source     : Port 11/1,13/1
Direction       : receive
Incoming Packets: disabled
Learning        : enabled
Multicast       : enabled
Filter          : -
 
   
Session Number  : 1
 
   
console> (enable) 
 
   

Step 4 Show the SPAN sessions.

console> (enable) show span 
 
   
Destination     : Port 13/7
Admin Source    : VLAN 650
Oper Source     : Port 11/1,13/1
Direction       : receive
Incoming Packets: disabled
Learning        : enabled
Multicast       : enabled
Filter          : -
 
   
Session Number  : 1
 
   
Total local span sessions:  1
console> (enable) 
 
   

Step 5 To disable the SPAN session that is sending traffic to the IDSM2.

console> (enable) set span disable session 1
This command will disable your span session.
Do you want to continue (y/n) [n]? y
Disabled Port 13/7 to monitor receive traffic of VLAN 650
console> (enable)
 
   

For More Information

For more information on SPAN, refer to the appropriate Catalyst 6500 Series Switch Command Reference.

Cisco IOS Software

Use the monitor session command in global configuration mode to enable SPAN on the IDSM2.


Note Use 1 or 2 for the IDSM2 data port numbers.


The following options apply:

interface—SPAN source interface

remote—SPAN source Remote

vlan— SPAN source VLAN

GigabitEthernet— GigabitEthernet IEEE 802.3z

Port-channel— Ethernet Channel of interfaces

,— Specify another range of interfaces

--— Specify a range of interfaces

both— Monitor received and transmitted traffic

rx— Monitor received traffic only

tx— Monitor transmitted traffic only

intrusion-detection-module— SPAN destination intrusion detection module

destination— SPAN destination interface or VLAN

filter— SPAN filter VLAN

source— SPAN source interface, VLAN

type— Type of monitor session

To enable SPAN on the IDSM2, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal
 
   

Step 3 Set the source interfaces for the monitor session.

router(config)# monitor session (session_number) source interface interface/port_number 
[, | - | rx | tx | both]
 
   

Example:

router(config)# monitor session 1 source interface GigabitEthernet2/23 both
 
   

Step 4 Enable an IDSM2 data port as a SPAN destination.

router(config)# monitor session (session_number) destination intrusion-detection-module 
module_number data-port data_port_number
 
   

Example:

router(config)# monitor session 1 destination intrusion-detection-module 9 data-port 1
 
   

Step 5 Make sure autostate is included for the data port.

router(config)# intrusion-detection module module_number data-port data_port_number 
autostate include
 
   

Example:

router(config)# intrusion-detection module 9 data-port 1 autostate include
 
   

This allows the switch virtual interface to stay up if the data port is the only port in the VLAN. The default is no include.

Step 6 (Optional) Enable PortFast for the data port.

router(config)# intrusion-detection module module_number data-port data_port_number 
portfast enable
 
   

Example:

router(config)# intrusion-detection module 9 data-port 1 portfast enable
 
   

The default is disabled.

Step 7 (Optional) To disable the monitor session.

router(config)# no monitor session session_number
 
   

Step 8 (Optional) To filter the SPAN session so that only certain VLANs are seen from switch port trunks.

router(config)# monitor session (session_number) {filter vlan {vlan_ID} [, | - ]}
 
   

Example:

router(config)# monitor session 1 filter vlan 146
 
   

Step 9 Exit configuration mode.

router(config)# exit
 
   

Step 10 To show current monitor sessions.

router# show monitor session session_number
 
   

Example:

router# show monitor session 1
    Session 1
    ---------
    Type                   : Local Session
    Source Ports           : 
        Both               : Gi2/23
    Destination Ports      : intrusion-detection-module 9 data-port 1
 
   

For More Information

For more information on SPAN, autostate, and PortFast, refer to the appropriate Catalyst 6500 Series Cisco IOS Command Reference.

Configuring VACL Capture

You can set VACLs to capture traffic for IPS from a single VLAN or from multiple VLANs or from FLexWAN2 ports on the 7600 router when using Cisco IOS software. This section describes how to configure VACL capture, and contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software


Note Port 1 is set as the TCP reset port. Ports 7 and 8 are the sensing ports and can be configured as security ACL capture ports. By default, in Catalyst Software 8.4(1) and earlier releases, ports 7 and 8 are configured as trunk ports and trunk all VLANs on which a security ACL has been applied with the capture feature. If you want to monitor traffic from specific VLANs only, you need to clear the VLANs that you do not want to monitor so that they are not trunked to ports 7 and 8.


Use the set security acl command to configure security ACL capture ports.

The following options apply:

ACL—Sets security ACL features

capture-port—Sets ports for ACL capture

cram—Sets security ACL cram

ip —Sets IP security ACL features

ipx—Sets IPX security ACL features

mac—Sets MAC security ACL features

map— Sets security ACL to VLAN mapping

permit—Specifies packets to forward

deny—Specifies packets to reject

redirect—Specifies packets to redirect to ports

before—Inserts ACE before a specified ace in editbuffer

capture—Makes a copy of this flow in capture ports

modify— Modifies a specified ACE in editbuffer

To configure VACLs to capture IPS traffic on VLANs, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Create the VACL to capture traffic. Specify what traffic is permitted, denied, and captured.

console> (enable) set security acl ip acl_name permit ip [permit (...) | deny (...)] 
capture
 
   

Note Only permitted traffic can be captured. If you want to permit traffic but not capture it, do no use the capture keyword


Example:

console> (enable) set security acl ip CAPTUREALL permit ip any any capture
CAPTUREALL editbuffer modified. Use 'commit' command to apply changes.
 
   

Step 4 Commit the VACL.

console> (enable) commit security acl CAPTUREALL
ACL commit in progress.
 
   

Committing the VACL writes the VACL and associated ACEs to NVRAM.

Step 5 Map the VACL to the VLANs.

console> (enable) set security acl map acl_name vlan_number
 
   

Example:

console> (enable) set security acl map CAPTUREALL 650
Mapping in progress.
 
   
ACL CAPTUREALL successfully mapped to VLAN 650.
 
   

Step 6 Configure the IDSM2 ports (port 7 or 8) to be capture ports.

console> (enable) set security acl capture module_number/port_number
 
   

Example:

console> (enable) set security acl capture 2/7
Successfully set 2/7 to capture ACL traffic.
 
   

For More Information

For more information on trunk ports and ACLs, refer to the appropriate Catalyst 6500 Series Switch Command Reference.

Cisco IOS Software

Use the following commands to configure VACLs to capture IPS traffic on VLANs.

The following options apply:

ip-access-list—Named access list

extended—Extended Access List

hardware—Enable Hardware Fragment Handling

log-update—Control access list log updates

logging—Control access list logging

resequence—Resequence Access List

standard—Standard Access List

To configure VACLs to capture IPS traffic on VLANs, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal
 
   

Step 3 Define the ACL.

router(config)# ip access-list [standard | extended] acl_name
 
   

Example:

router(config)# ip access-list standard CAPTUREALL
router(config-std-nacl)# exit
 
   

Step 4 Define the VLAN access map.

router(config)# vlan access-map map_name [0-65535]
 
   

Step 5 Configure a match clause in a VLAN access map sequence.

router(config-access-map)# match [ip address {1-199 | 1300-2699 | acl_name}]
 
   

Step 6 Configure an action clause in the VLAN access map sequence to accompany the preceding match clause.

router(config-access-map)# action forward capture
 
   

Step 7 Apply the VLAN access-map to the specified VLANs.

router(config)# vlan filter map_name vlan-list vlan_list
 
   

Step 8 Configure the IDSM2 data ports to capture the captured-flagged traffic:

router(config)# intrusion-detection module module_number data-port data_port_number 
capture allowed-vlan capture_vlans
 
   

Note When the switch is routing traffic, you should configure the IDSM2 to monitor all VLANs being routed. If you apply the VACL to a FlexWan2 port, you need to configure the IDSM2 to monitor all VLANs.


Step 9 Enable the capture function on the IDSM2.

router(config)# intrusion-detection module module_number data-port data_port_number 
capture
 
   

This example shows the output from the show run command:

router# show run
intrusion-detection module 4 data-port 1 capture allowed-vlan 450,1002-1005
intrusion-detection module 4 data-port 1 capture
.
.
.
vlan access-map CAPTUREALL 10 
match ip address MATCHALL 
action forward capture 
.
.
vlan filter CAPTUREALL vlan-list 450,1002-1005
.
ip access-list extended MATCHALL 
permit ip any any
router# 
 
   

Step 10 Make sure autostate is included for the data port.

router(config)# intrusion-detection module module_number data-port data_port_number 
autostate include
 
   

Example:

router(config)# intrusion-detection module 4 data-port 1 autostate include
 
   

This allows the switch virtual interface to stay up if the data port is the only port in the VLAN. The default is no include.

Step 11 (Optional) Enable PortFast for the data port.

router(config)# intrusion-detection module module_number data-port data_port_number 
portfast enable
 
   

Example:

router(config)# intrusion-detection module 4 data-port 1 portfast enable
 
   

The default is disabled.


For More Information

For more information on autostate and PortFast, refer to the appropriate Catalyst 6500 Series Cisco IOS Command Reference.

Configuring the mls ip ids Command

This section describes how to use the mls ip ids command to capture IPS traffic. It contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

When you are running the Cisco IOS Firewall on the MSFC, you cannot use VACLs to capture traffic for the IDSM2, because you cannot apply VACLs to a VLAN in which you have applied an IP inspect rule for the Cisco IOS Firewall. However, you can use the mls ip ids command to designate which packets are captured. Packets that are permitted by the ACL are captured. Those denied by the ACL are not captured. The permit/deny parameter does not affect whether a packet is forwarded to destination ports. Packets coming in to that router interface are checked against the IPS ACL to determine if they should be captured. The mls ip ids command is applied as part of the MSFC configuration instead of the supervisor configuration. The mls ip ids command only captures incoming traffic. Use the mls ip ids command on both the client-side router interface and server-side router interface, so that both directions of the connection are captured.

To use the mls ip ids command to capture IPS traffic, follow these steps:


Step 1 Log in to the MSFC.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Enter configuration mode.

router# configure terminal
 
   

Step 4 Configure an ACL to designate which packets will be captured.

router(config)# ip access-list extended word
 
   

Step 5 Select the interface that carries the packets to be captured.

router(config)# interface interface_name
 
   

Step 6 Apply the ACL created in Step 4 to the interface selected in Step 5.

router(config-if)# mls ip ids word
 
   

Step 7 Log in to the supervisor engine.

Step 8 Enter privileged mode.

console> enable
 
   

Step 9 On the supervisor engine, add the IDSM2 monitoring port (port 7 or 8) to the VACL capture list.

console> (enable) set security acl capture module_number/port_number
 
   

Caution For the IDSM2 to capture all packets marked by the mls ip ids command, port 7 or 8 of the IDSM2 must be a member of all VLANs to which those packets are routed.


Cisco IOS Software

When you are using ports as router interfaces rather than switch ports, there is no VLAN on which to apply a VACL.

You can use the mls ip ids command to designate which packets are captured. Packets that are permitted by the ACL are captured. Those denied by the ACL are not captured. The permit/deny parameter does not affect whether a packet is forwarded to destination ports. Packets coming in to that router interface are checked against the IPS ACL to determine if they should be captured.

To use the mls ip ids command to capture IDS traffic, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal
 
   

Step 3 Configure an ACL to designate which packets will be captured.

router(config)# ip access-list extended word
 
   

Step 4 Select the interface that carries the packets to be captured.

router(config)# interface interface_name
 
   

Step 5 Specify the capture VLANs.

router(config)# intrusion-detection module module_number data-port data_port_number 
capture allowed-vlan capture_vlans 
 
   

Example:

router(config)# intrusion-detection module 4 data-port 1 capture allowed-vlan 165
 
   

Step 6 Apply the ACL created in Step 4 to the interface selected in Step 5.

router(config-if)# mls ip ids word
 
   

Caution For the IDSM2 to capture all packets marked by the mls ip ids command, data port 1 or data port 2 of the IDSM2 must be a member of all VLANs to which those packets are routed.


Configuring the Catalyst Series 6500 Switch for the IDSM2 in Inline Mode

You can use IDM or the CLI to configure the IDSM2 to operate in inline mode between two separate VLANs (one VLAN for each side of the IDSM2). To prepare the IDSM2 for inline mode, you must configure the switch as well as the IDSM2. Configure the switch first, then configure the IDSM2 interfaces for inline mode. This section describes how to configure the switch so that the IDSM2 can operate in inline mode, and contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

You configure the IDSM2 monitoring ports as trunk ports for inline operation for Catalyst software 8.4(1) or later with Supervisor Engine 1a, Supervisor Engine 2, Supervisor Engine 32, or Supervisor Engine 720. Because the native VLAN is the same as the sole VLAN being trunked, the traffic is not 802.1q encapsulated.


Caution Before Catalyst software 8.4.(3), the default configuration for the IDSM2 ports 7 and 8 is to trunk all VLANs 1 to 4094. If you clear the IDSM2 configuration ( clear configuration module_number), the IDSM2 trunks all VLANs. If the IDSM2 interfaces are configured for inline, spanning tree loops will likely be created and a storm will occur. A storm is numerous packets looping and never reaching their destination.

To configure the monitoring ports on the IDSM2 for inline operation, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Set the native VLAN for each IDSM2 monitoring port.

console (enable)> set vlan vlan_number slot_number/port_number
 
   

Example:

console (enable)> set vlan 651 9/7

console (enable)> set vlan 652 9/8

Step 4 Clear all VLANs from each IDSM2 monitoring port (port 7 and 8).

console (enable)> clear trunk slot_number/port_number vlan_range

Example:

console (enable)> clear trunk 9/7 1-4094
console (enable)> clear trunk 9/8 1-4094
 
   

Step 5 Configure the IDSM2 monitoring ports 7 and 8 to trunk the single native VLAN configured in Step 3.

console (enable)> set trunk slot_number/port_number vlan_number

Example:

console (enable)> set trunk 9/7 651
console (enable)> set trunk 9/8 652
 
   

Step 6 Use the IPS CLI or IDM to pair the interfaces from Step 3 on the IDSM2.


For More Information

For the procedure for creating inline interface pairs, see Creating Inline Interface Pairs.

Cisco IOS Software

Configure the IDSM2 monitoring ports as access ports for inline operation. To configure inline VLANs, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal
 
   

Step 3 Select the VLANs the IDSM2 will link.

Step 4 Configure each IDSM2 data port to be on a single VLAN.

router(config)# intrusion-detection module slot_number data-port {1 | 2} access-vlan 
vlan_number 
router(config)# exit
 
   

Example:

router(config)# intrusion-detection module 13 data-port 1 access-vlan 661 
router(config)# intrusion-detection module 13 data-port 2 access-vlan 662 
router(config)# exit
 
   

Step 5 Verify the configuration.:


Note In these examples, the IDSM2 in slot 13 is inline between VLANs 661 and 662. The IDSM2 data port 1 is on VLAN 661 and data port 2 is on VLAN 662.


a. Verify the IDSM2 intrusion detection settings.

router# show run | include intrusion-detection 
intrusion-detection module 13 management-port access-vlan 147 
intrusion-detection module 13 data-port 1 access-vlan 661 
intrusion-detection module 13 data-port 2 access-vlan 662 
router#
 
   

b. Verify that the IDSM2 data port 1 is an access port on VLAN 661.

router# show intrusion-detection module slot_number data-port data_port_number state 
 
   

Example:

router# show intrusion-detection module 13 data-port 1 state
Intrusion-detection module 13 data-port 1:
 
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: 
native Negotiation of Trunking: Off Access Mode VLAN: 661 (inline-vlan-1) Trunking 
Native Mode VLAN: 1 (default) Trunking VLANs Enabled: NONE Pruning VLANs Enabled: 
2-1001 Vlans allowed on trunk:661 Vlans allowed and active in management domain: 661 
Vlans in spanning tree forwarding state and not pruned: 661
Administrative Capture Mode: Disabled
Administrative Capture Allowed-vlans: <empty>
 
   

c. Verify the VLAN number.

router# show vlan id vlan-number
 
   

Example:

router# show vlan id 661
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
661  ward-attack3                     active    Gi3/2, Gi13/d1
 
   
VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
661  enet  100661     1500  -      -      -        -    -        0      0
 
   
Remote SPAN VLAN
----------------
Disabled
 
   
Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
router#
 
   

Step 6 Use the IPS CLI or IDM to pair the interfaces from Step 4 on the IDSM2.


For More Information

For the procedure for creating inline interface pairs, see Creating Inline Interface Pairs.

Configuring the Catalyst Series 6500 Switch for the IDSM2 for Inline VLAN Pair Mode

You can use IDM or the CLI to configure the IDSM2 to operate in inline VLAN pair mode. To prepare the IDSM2 for inline VLAN pair mode, you must configure the switch as well as the IDSM2. Configure the switch first, then configure the IDSM2 interfaces for inline VLAN pair mode. This section describes how to configure the switch so that the IDSM2 can operate in inline VLAN pair mode, and contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

You configure the IDSM2 monitoring ports as trunk ports for inline VLAN pair mode for Catalyst software 8.4(1) or later with Supervisor Engine 1a, Supervisor Engine 2, Supervisor Engine 32, or Supervisor Engine 720.

To configure the monitoring ports on the IDSM2 for inline VLAN pair mode, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Clear all VLANs from the IDSM2 monitoring port.

console (enable)> clear trunk slot_number/port_number 1-4094
 
   

Example:

console (enable)> clear trunk 9/7 1-4094
 
   

Note Before Catalyst software 8.4.(3), the value for the VLAN range when clearing VLANs from the IDSM2 monitoring port was 1-1005, 1024-4094. In later versions you can clear the entire VLAN range, 1-4094.


Step 4 Configure the IDSM2 monitoring port to trunk the VLANs to be paired.

console (enable)> set trunk slot_number/port_number vlans_to_be_paired
 
   

Example:

console (enable)> set trunk 9/7 651,652
 
   

Step 5 Set the native VLAN for the IDSM2 monitoring port to a value other than the paired VLANs used in Step 4.

console (enable)> set vlan vlan-number slot_number/port_number
 
   

Example:

console (enable)> set vlan 1 9/7

The default native VLAN is VLAN 1.

Step 6 Repeat Step 4 for other VLANs to be paired on the IDSM2 monitoring port.

Step 7 To configure the other monitoring port, repeat Steps 3 through 6.

Step 8 Use the IPS CLI or IDM to pair the VLANs from Step 4 on the IDSM2.


For More Information

For the procedure for creating inline VLAN pairs, see Creating Inline VLAN Pairs.

Cisco IOS Software

Configure the IDSM2 monitoring ports as trunk ports for inline VLAN pair operation. To configure inline VLAN pairs, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal
 
   

Step 3 Configure one IDSM2 data port to trunk the VLANs to be paired.

router(config)# intrusion-detection module slot_number data-port data_port_number trunk 
allowed-vlan vlans_to_be_paired
router(config)# exit
 
   

Example:

router(config)# intrusion-detection module 13 data-port 1 trunk allowed-vlan 661,662 
router(config)# exit
 
   

Step 4 Verify the configuration.:


Note In these examples, data port 1 of the IDSM2 in slot 13 is trunking VLANs 661 and 662.


a. Verify the IDSM2 intrusion detection settings.

router# show run | include intrusion-detection 
intrusion-detection module 13 management-port access-vlan 147 
intrusion-detection module 13 data-port 1 trunk allowed-vlan 661,662 
router#
 
   

b. Verify that the IDSM2 data port is trunking the proper VLANs.

router# show intrusion-detection module slot_number data-port data_port_number state 
 
   

Example:

router# show intrusion-detection module 13 data-port 1 state
Intrusion-detection module 13 data-port 1:
 
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: 661,662
Pruning VLANs Enabled: 2-1001
Vlans allowed on trunk: 661-662
Vlans allowed and active in management domain: none
Vlans in spanning tree forwarding state and not pruned: 
   none
Administrative Capture Mode: Disabled
Administrative Capture Allowed-vlans: empty
Autostate mode: excluded
Portfast mode: default
 
router#
 
   

Step 5 Use the IPS CLI or IDM to pair the VLANs from Step 3 on the IDSM2.


For More Information

For the procedure for creating inline VLAN pairs, see Creating Inline VLAN Pairs.

Configuring EtherChannel Load Balancing

This section describes how to configure ECLB on the IDSM2. It contains the following topics:

Overview

EtherChannel and the Three Sensing Modes

Enabling ECLB

Disabling ECLB

Verifying ECLB

Overview

Supervisor Engines in the Catalyst 6500 series chassis recognize the IDSM2 devices that are running IPS 5.x and greater as EtherChannel devices. This lets you install up to eight IDSM2 devices in the same chassis.

The IDSM2 in the Catalyst 6500 series switch has eight internal ports. Only four of these ports are used. Port 1 is a TCP/IP reset port. Port 2 is the command and control port. Ports 7 and 8 are the sensing ports for Catalyst software and data ports 1 and 2 for Cisco IOS software. The other ports are not used.

The backplane is 1000 Mbps, which is why the IDSM2 shows 1000 Mbps even though it can only handle about 600 Mbps of performance. ECLB allows up to eight IDSM2 devices to participate in the load balancing on either port 7 or port 8.

EtherChannel and the Three Sensing Modes

EtherChannel provides load balancing and failover between multiple IDSM2s in all three sensing modes. The IDSM2 does not participate in EtherChannel protocols, such as LACP or PAgP. Cisco IOS only allows load balancing using src-dst-ip algorithm so that all packets between a given pair of IP addresses are always mapped to the same channel. Catalyst software uses the ip both algorithm. This is necessary so the IDSM2 can correctly track the connections between two hosts.


Caution You cannot mix the IDSM2 data ports with other port types in an EtherChannel group. You must configure all data ports in an EtherChannel group identically.

EtherChannel and the IDSM2 operate in the following way in the three sensing modes:

EtherChannel and promiscuous mode—When the IDSM2 operates in promiscuous mode, the two data ports operate independently of each other. If you configure the switch so that a data port has two or more IDSM2s in a group, the switch distributes traffic between the IDSM2s. This balances the traffic between multiple IDSM2s. You should rebalance the channel when a data port goes to the errDisabled state, or the IDSM2 is shut down, powered down, or reset.

EtherChannel and inline mode—When you configure multiple IDSM2s for inline mode, you can load balance the traffic between the IDSM2s by putting data port 1 of each IDSM2 in to one channel group and data port 2 of each IDSM2 in to another channel group.


Caution To make sure that the same traffic is assigned to the two data ports on each IDSM2, you must assign the same EtherChannel index to both data ports on each of the IDSM2s even though they are in different EtherChannel groups.

EtherChannel and inline VLAN pair mode—When the IDSM2 is in inline on-a-stick mode, the two data ports operate independently of each other. The same restrictions apply as for promiscuous mode.

Enabling ECLB

This section describes how to enable ECLB for Cisco IOS and Catalyst software. It contains the following sections:

Catalyst Software

Cisco IOS Software

Catalyst Software

This section describes how to enable ECLB for the three sensing modes in Catalyst software. It contains the following topics:

ECLB in Promiscuous and VLAN Pair Mode

ECLB in Inline Mode

ECLB in Promiscuous and VLAN Pair Mode

For promiscuous mode and inline VLAN pair mode, add the single port (port 7 or port 8) from each IDSM2 to an EtherChannel.

To configure the monitoring ports on the IDSM2 for ECLB in promiscuous or inline VLAN pair mode, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Configure each IDSM2 for promiscuous or inline VLAN pair mode.

Use the IPS CLI or IDM to pair the VLANs on the IDSM2.

Step 4 Add the IDSM2 monitoring ports to an EtherChannel.

console (enable)> set port channel slot_number/port_number channel_number
 
   

Example:

console (enable)> set port channel 1/7,7/7 1
 
   

Step 5 Set the distribution method.

console (enable)> set port channel all distribution ip both
Channel distribution is set to ip both.
console (enable)>
 
   

Step 6 Enable ECLB.

console (enable)> set port channel slot_number/port_number mode on
 
   

Example:

console (enable)> set port channel 1/7,7/7 mode on

For More Information

For the procedure for creating inline VLAN pairs, see Creating Inline VLAN Pairs.

ECLB in Inline Mode

For inline mode, add the single port 7 from each IDSM2 to an EtherChannel and port 8 from each IDSM2 to a different EtherChannel.

To configure the monitoring ports on the IDSM2 for ECLB in inline mode, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Configure each IDSM2 for inline mode.

Use the IPS CLI or IDM to pair the interfaces on the IDSM2.

Step 4 Add the IDSM2 monitoring port 7s to an EtherChannel.

console (enable)> set port channel slot_number/7 channel_A_number
 
   

Example:

console (enable)> set port channel 1/7,7/7 1
 
   

Step 5 Enable ECLB for that EtherChannel.

console (enable)> set port channel slot_number/7 mode on
 
   

Example:

console (enable)> set port channel 1/7,7/7 mode on
 
   

Step 6 Add the IDSM2 monitoring port 8s to another EtherChannel.

console (enable)> set port channel slot_number/8 channel_B_number
 
   

Example:

console (enable)> set port channel 1/8,7/8 2
 
   

Step 7 Enable ECLB for that EtherChannel.

console (enable)> set port channel slot_number/8 mode on
 
   

Example:

console (enable)> set port channel 1/8,7/8 mode on
 
   

Step 8 Set the distribution method.

console (enable)> set port channel all distribution ip both
Channel distribution is set to ip both.
console (enable)>
 
   

For More Information

For the procedure for creating inline VLAN pairs, see Creating Inline VLAN Pairs.

Cisco IOS Software


Note IOS 12.2(18)SXF4 or later is required for inline mode.


This section describes how to enable ECLB for the three sensing modes in Cisco IOS software, and contains the following topics:

Restoring Defaults

ECLB in Promiscuous Mode

ECLB in Inline Mode

ECLB in Inline VLAN Pair Mode

Restoring Defaults

Use the intrusion-detection module module_number data-port {1 | 2} default command to restore the defaults to the specified data port. This command restores the following defaults: allowed VLANs, autostate, portfast, cost, and priority settings. If the data port belongs to a port channel, this command has no effect. This command is useful for clearing the data port before you add it to a port channel group.

This command is equivalent to using all of the following commands:

no intrusion-detection module module_number data-port {1 | 2} trunk allowed-vlan

intrusion-detection module module_number data-port {1 | 2} access vlan

intrusion-detection module module_number data-port {1 | 2} autostate include

intrusion-detection module module_number data-port {1 | 2} portfast

intrusion-detection module module_number data-port {1 | 2} spanning-tree cost

intrusion-detection module module_number data-port {1 | 2} spanning-tree priority

ECLB in Promiscuous Mode


Note For Cisco IOS version and supervisor requirements for EtherChannel load balancing on the IDSM2, see Table 19-1.



Note Cisco IOS supports promiscuous IDSM2 EtherChannel using VACL capture (not SPAN or monitor).


An EtherChannel balances the traffic load across the links in an EtherChannel by reducing part of the binary pattern formed from the addresses in the frame to a numerical value that selects one of the links in the channel.

EtherChannel load balancing can use MAC addresses, IP addresses, or Layer 4 port numbers, which can be source or destination or both source and destination addresses or ports. The selected mode applies to all EtherChannels configured on the switch. ECLB can also use MPLS Layer 2 information.

Use the option that provides the balance criteria with the greatest variety in your configuration. For example, if the traffic on an EtherChannel is going only to a single MAC address and you use the destination MAC address as the basis of ECLB, the EtherChannel always chooses the same link in the EtherChannel; using source addresses or IP addresses might result in better load balancing.

To configure ECLB for promiscuous operation on the IDSM2, follow these steps:


Step 1 Configure each IDSM2 for promiscuous operation.


Note Make sure that all IDSM2 VACL capture or SPAN or monitor configuration lines have been removed before configuring ECLB for the IDSM2.


Step 2 Log in to the console.

Step 3 Enter global configuration mode:

router# configure terminal 
 
   

Step 4 Create the VACL.

router(config)# ip access-list extended vacl_name
 
   

Example:

router(config)# ip access-list extended idstest
 
   

Step 5 Add any access control entries, for example, permit any any.

router(config-ext-nacl)# permit ip any any
 
   

Step 6 Create at least one VLAN access map sequence.

router(config-ext-nacl)# vlan access-map vlan_access_map_name sequence_number
router(config-access-map)# match ip address vacl_name
router(config-access-map)# action forward capture 
 
   

Example:

router(config)# vlan access-map idstestmap 10
router(config-access-map)# match ip address idstest
router(config-access-map)# action forward capture
 
   

Step 7 Apply the VLAN access map to the VLAN(s).

router(config-access-map)# vlan filter vlan_access_map_name vlan-list vlan-list
 
   

Example:

router(config)# vlan filter idstestmap vlan-list 50-60 
 
   

Step 8 For each IDSM2, add the desired data ports in to the desired EtherChannel:.

router(config)# intrusion-detection module module_number data-port data_port_number 
channel-group channel_number
 
   

Example:

router(config)# intrusion-detection module 13 data-port 1 channel-group 3
router(config)# intrusion-detection module 12 data-port 1 channel-group 3
 
   

Each EtherChannel has a numbered port channel interface. You can configure a maximum of 64 port channel interfaces, numbered from 1 to 256.

Step 9 Configure ECLB.

router(config)# port-channel load-balance src-dst-ip 
 
   

The default and only load balancing algorithm supported for the IDSM2 is src-dst-ip, which means EtherChannel uses the combination of source and destination IP addresses for its distribution method.

Step 10 Verify the load balancing.

router# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip
 
   
EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address
  MPLS: Label or IP
 
   

Step 11 Set the VLANs to be captured to the EtherChannel:.

router(config)# intrusion-detection port-channel channel_number capture allowed-vlan 
vlan_list
 
   

Example:

router(config)# intrusion-detection port-channel 3 capture allowed-vlan 10
 
   

Step 12 Enable capture to the EtherChannel:.

router(config)# intrusion-detection port-channel channel_number capture
 
   

Example:

router(config)# intrusion-detection port-channel 3 capture
 
   

Step 13 Make sure autostate is included for the channel group.

router(config)# intrusion-detection port-channel channel_number autostate include
 
   

Example:

router(config)# intrusion-detection port-channel 3 autostate include
 
   

This allows the switch virtual interface to stay up if the data port is the only port in the VLAN. The default is no include.

Step 14 (Optional) Enable PortFast for the channel group.

router(config)# intrusion-detection port-channel channel_number portfast enable
 
   

Example:

router(config)# intrusion-detection port-channel 3 portfast enable
 
   

The default is disabled.

Step 15 Exit global configuration mode.

router(config)# exit
 
   

Step 16 To save the changes.

router# write memory
 
   

For More Information

For more information on EtherChannel, refer to Catalyst 6500 Release 12.2SXF and Rebuilds Software Configuration Guide.

For the procedure for configuring the IDSM2 in promiscuous mode, see Configuring the Catalyst Series 6500 Switch for the IDSM2 in Promiscuous Mode.

For more information on autostate and PortFast, refer to the appropriate Catalyst 6500 Series Cisco IOS Command Reference.

ECLB in Inline Mode


Note Make sure that all IDSM2 VACL capture or SPAN or monitor configuration lines have been removed before configuring ECLB for the IDSM2. You receive an error if you try to change the channel group to inline mode if you have capture enabled on any of the ports.


To configure ECLB for inline mode on the IDSM2, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal 
 
   

Step 3 For each IDSM2, add all data port 1s in to an EtherChannel.

router(config)# intrusion-detection module module_number data-port 1 port-channel 
channel_number
 
   

Example:

router(config)# intrusion-detection module 1 data-port 1 port-channel 5
 
   

Each EtherChannel has a numbered port channel interface. You can configure a maximum of 64 port channel interfaces, numbered from 1 to 256. If the channel group and port channel have not been created, this command creates it with an empty allowed VLAN list. If the port channel exists, its allowed VLAN list, port fast, autostate, spanning tree cost, and priority settings are assigned to the data port.


Note You receive an error if you try to add a data port to a channel group that contains other port types or if you try to add another port type to a port channel containing one or more data ports.


Step 4 For each IDSM2, add all data port 2s in to a different EtherChannel.

router(config)# intrusion-detection module module_number data-port 2 port-channel 
channel_number
 
   

Example:

router(config)# intrusion-detection module 1 data-port 2 port-channel 6
 
   

Step 5 Set the sensing mode to access (inline) and set the access VLAN for the channel group that contains the data port 1s.

router(config)# intrusion-detection port-channel channel_number access-vlan vlan_id
 
   

Example:

router(config)# intrusion-detection port-channel 5 access-vlan 1050
 
   

Note You receive an error message if the port channel does not exist or if the port channel is already configured for trunk or capture mode. You must create the port channel or remove the port channel from trunk or capture mode.


Step 6 Set the sensing mode to access (inline) and set the access VLAN for the channel group that contains the data port 2s.

router(config)# intrusion-detection port-channel channel_number access-vlan vlan_id
 
   

Example:

router(config)# intrusion-detection port-channel 6 access-vlan 10
 
   

Step 7 Configure ECLB.

router(config)# port-channel load-balance src-dst-ip
 
   

The default is src-dst-ip, which means EtherChannel uses the combination of source and destination IP addresses for its distribution method.

Example:

router(config)# port-channel load-balance src-dst-ip
 
   

Step 8 Verify ECLB.

router# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip
 
   
EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address
  MPLS: Label or IP
 
   

Step 9 For access (inline) mode, set autostate to include each channel group.

router(config)# intrusion-detection port-channel channel_number autostate include
 
   

Example:

router(config)# intrusion-detection port-channel 5 autostate include
 
   

The default is no include. This prevents the switch virtual interface from going down if the data port is up and in the VLAN.

Step 10 (Optional) You can enable or disable PortFast for each channel group.

router(config)# intrusion-detection port-channel channel_number portfast enable
 
   

Example:

router(config)# intrusion-detection port-channel 5 portfast enable
 
   

The default is disabled.

Step 11 (Optional) Set the spanning tree path cost for each of the two channel groups.

router(config)# intrusion-detection port-channel channel_number spanning-tree cost 
port_cost
 
   

Example:

router(config)# intrusion-detection port-channel 5 spanning-tree cost 4

Both channel groups must be set to the same port cost to make sure that data port 1 and data port 2 of each IDSM2 are in the same state (forwarding versus blocking).

Step 12 (Optional) Set the spanning tree port priority for each of the two channel groups.

router(config)# intrusion-detection port-channel channel_number spanning-tree priority 
priority
 
   

Example:

router(config)# intrusion-detection port-channel 5 spanning-tree priority 16

The possible port priority value is a multiple of 16 from 0 to 240. The default is 32.

Step 13 Exit global configuration mode.

router(config)# exit
 
   

Step 14 To save the changes.

router# write memory
 
   

For More Information

For more information on autostate and PortFast, refer to the appropriate Catalyst 6500 Series Cisco IOS Command Reference.

For the procedure for configuring the IDSM2 in inline mode, see Configuring the Catalyst Series 6500 Switch for the IDSM2 in Inline Mode.

ECLB in Inline VLAN Pair Mode


Note Make sure that all IDSM2 VACL capture or SPAN or monitor configuration lines have been removed before configuring ECLB for the IDSM2. You receive an error if you try to change the channel group to inline VLAN pair mode if you have capture enabled on any of the ports.


To configure ECLB for inline VLAN pair mode on the IDSM2, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal 
 
   

Step 3 Add the data port (either data port 1 or data port 2) from each IDSM2 to the Etherchannel.

router(config)# intrusion-detection module module_number data-port [1:2] port-channel 
channel_number
 
   

Example:

router(config)# intrusion-detection module 1 data-port 1 port-channel 5
 
   

Each EtherChannel has a numbered port channel interface. You can configure a maximum of 64 port channel interfaces, numbered from 1 to 256. If the channel group and port channel have not been created, this command creates it with an empty allowed VLAN list. If the port channel exists, its allowed VLAN list, port fast, autostate, spanning tree cost, and priority settings are assigned to the data port.


Note You receive an error if you try to add a data port to a channel group that contains other port types or if you try to add another port type to a port channel containing one or more data ports.


Step 4 Set the sensing mode to trunk (inline VLAN pair) and set the allowed VLANs for the channel group that contains the data port 1s. Determine which VLANs are going to be paired (100 and 200, 101 and 201) and set the allowed VLAN list to include all VLANs in all the pairs.

router(config)# intrusion-detection port-channel channel_number trunk allowed-vlan 
vlan_list
 
   

Example:

router(config)# intrusion-detection port-channel 5 trunk allowed-vlans 100,101,200,201
 
   

Note The allowed VLAN list on the switch must include all VLANs that are paired as inline VLAN pairs on the IDSM2. Otherwise, traffic may be dropped.



Note You receive an error message if the port channel does not exist or if the port channel is already configured for trunk or capture mode. You must create the port channel or remove the port channel from trunk or capture mode.


Step 5 Configure ECLB.

router(config)# port-channel load-balance src-dst-ip 
 
   

The default is src-dst-ip, which means EtherChannel uses the combination of source and destination IP addresses for its distribution method.

Example:

router(config)# port-channel load-balance src-dst-ip
 
   

Step 6 Verify ECLB.

router# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip
 
   
EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address
  MPLS: Label or IP
 
   

Step 7 For access (inline) mode, set autostate to include the channel group.

router(config)# intrusion-detection port-channel channel_number autostate include
 
   

Example:

router(config)# intrusion-detection port-channel 5 autostate include
 
   

The default is no include. This prevents the switch virtual interface from going down if the data port is up and in the VLAN.

Step 8 (Optional) You can enable or disable PortFast for the channel group.

router(config)# intrusion-detection port-channel channel_number portfast enable
 
   

Example:

router(config)# intrusion-detection port-channel 5 portfast enable
 
   

The default is disabled.

Step 9 (Optional) Set the spanning tree port cost for the channel group.

router(config)# intrusion-detection port-channel channel_number spanning-tree cost 
port_cost
 
   

Example:

router(config)# intrusion-detection port-channel 5 spanning-tree cost 4

Step 10 (Optional) Set the spanning tree port priority for the channel group.

router(config)# intrusion-detection port-channel channel_number spanning-tree priority 
priority
 
   

Example:

router(config)# intrusion-detection port-channel 5 spanning-tree priority 16

The possible port priority value is a multiple of 16 from 0 to 240. The default is 32.

Step 11 Exit global configuration mode.

router(config)# exit
 
   

Step 12 To save the changes.

router# write memory
 
   

Step 13 Use the IPS CLI or IDM to pair the VLANs from Step 4 on the IDSM2.


For More Information

For more information on autostate and PortFast, refer to the appropriate Catalyst 6500 Series Cisco IOS Command Reference.

For the procedure for creating inline VLAN pairs, see Creating Inline VLAN Pairs.

Disabling ECLB

This section explains how to disable ECLB, and contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

To disable ECLB, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Disable ECLB for promiscuous or inline VLAN pair mode.

console (enable)> set port channel slot_number/port_number mode off
 
   

Example:

console (enable)> set port channel 1/7,7/7 mode off
 
   

Step 4 Disable ECLB for inline mode:

a. Disable ECLB for one EtherChannel.

console (enable)> set port channel slot_number/7 mode off
 
   

Example:

console (enable)> set port channel 1/7,7/7 mode off
 
   

b. Disable ECLB for the other EtherChannel.

console (enable)> set port channel slot_number/8 mode off
 
   

Example:

console (enable)> set port channel 1/8,7/8 mode off
 
   

Cisco IOS Software

To disable ECLB for the IDSM2, follow these steps:


Step 1 Log in to the console.

Step 2 Enter global configuration mode.

router# configure terminal
 
   

Step 3 To remove a single IDSM2 from the EtherChannel.

router(config)# no intrusion-detection module module_number data-port data_port_number 
channel-group channel_number 
 
   

Example:

router(config)# no intrusion-detection module 1 data-port 1 channel-group 5 
 
   

Step 4 To remove the whole EtherChannel.

router(config)# no intrusion-detection module port-channel channel_number
 
   

Example:

router(config)# no intrusion-detection module port-channel 5

Note The VACL capture commands for the IDSM2 are left.



Verifying ECLB

This section explains how to verify your ECLB configuration, and contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

To verify the ECLB configuration, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 To see all EtherChannels.

console (enable)> show channel slot_number/port_number mode off
 
   

Example:

console> (enable) show channel 
Channel Id   Ports
-----------  -----------------------------------------------
1669         1/7,7/7                                        
1698         2/1-6                                          
console> (enable)
 
   

Note In this output, an EtherChannel with ID 1669 is created to have two IDSM2 data ports. Port 1/7 is for port 7 on the IDSM2 in slot 1 while port 7/7 is for port 7 on the IDSM2 in slot 7. Both IDSM2s are configured for promiscuous operation. The switch load balances between each of the two IDSM2 ports (one port on each IDSM2).


Step 4 To see specific EtherChannel status.

console (enable)> show channel hash channel_id source_ip_addr dest_ip_addr
 
   

Example:

console> (enable) show channel hash 1669 10.20.2.1 10.20.5.3
Selected channel port: 1/7
console> (enable)

Note This output shows that traffic from 10.20.2.1 to 10.20.5.3 will be sent to port 1/7 (port 7 for the IDSM2 in slot 1).



Cisco IOS Software

To verify the IDSM2 ECLB configuration, follow these steps:


Step 1 Log in to the console.

Step 2 Display all EtherChannels.

router# show etherchannel
                Channel-group listing:
                -----------------------
 
   
Group: 10
----------
Group state = L2
Ports: 0   Maxports = 8
Port-channels: 1 Max Port-channels = 1
Protocol:    -
 
   
router#
 
   

Step 3 Display specific EtherChannel status.

router# show etherchannel 1 [summary | detail | port | port-channel | protocol]
 
   

Example:

router# show etherchannel 1 summary
Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator
 
   
        u - unsuitable for bundling
Number of channel-groups in use: 1
Number of aggregators:           1
 
   
Group  Port-channel  Protocol    Ports
------+-------------+-----------+----------------------------
 
   
router#
 
   

Step 4 Display the ECLB setting.

router# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip
        mpls label-ip
 
   
EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address
  MPLS: Label or IP
router#
 
   

Step 5 Display the IDSM2 data port information.

router# show intrusion-detection module module_number data-port data_port_number state
 
   

Example:

router# show intrusion-detection module 11 data-port 2 state
Intrusion-detection module 11 data-port 2:
 
   
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 662 (ward-victim3)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: NONE
Pruning VLANs Enabled: 2-1001
Vlans allowed on trunk:none
Vlans allowed and active in management domain: none
Vlans in spanning tree forwarding state and not pruned:
   none
Administrative Capture Mode: Disabled
Administrative Capture Allowed-vlans: empty
 
   

Administrative Tasks for the IDSM2

This section contains procedures that help you with administrative tasks for the IDSM2. It contains the following topics:

Enabling Full Memory Tests

Resetting the IDSM2

Enabling Full Memory Tests

When the IDSM2 initially boots, by default it runs a partial memory test. You can enable a full memory test in Catalyst software and Cisco IOS software. This section contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

Use the set boot device boot_sequence module_number mem-test-full command to enable a full memory test. The full memory test takes about 12 minutes.

To enable a full memory test, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Enable the full memory test:

console> (enable) set boot dev cf:1 3 mem-test-full
Device BOOT variable = cf:1
Memory-test set to FULL
Warning: Device list is not verified but still set in the boot string.
console> (enable) set boot dev hdd:1 3 mem-test-full
Device BOOT variable = hdd:1
Memory-test set to FULL
Warning: Device list is not verified but still set in the boot string.
console> (enable) 
 
   

The set boot device command can either contain cf:1 or hdd:1.

Step 4 Reset the IDSM2. The full memory test runs.


Note A full memory test takes more time to complete than a partial memory test.



For More Information

For the procedure for resetting the IDSM2, see Resetting the IDSM2.

Cisco IOS Software

Use the hw-module module module_number reset mem-test-full command to enable a full memory test. The full memory test takes about 12 minutes.

To enable a full memory test, follow these steps:


Step 1 Log in to the console.

Step 2 Enable the full memory test.

router# hw-module module 9 reset mem-test-full
    Device BOOT variable for reset = <empty>
    Warning: Device list is not verified.
 
   
    Proceed with reload of module?[confirm]
    % reset issued for module 9
router#
 
   

Step 3 Reset the IDSM2. The full memory test runs.


Note A full memory test takes more time to complete than a partial memory test.



For More Information

For the procedure for resetting the IDSM2, see Resetting the IDSM2.

Resetting the IDSM2

If for some reason you cannot communicate with the IDSM2 through SSH, Telnet, or the switch session command, you must reset the IDSM2 from the switch console. The reset process requires several minutes.

This section contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

To reset the IDSM2 from the CLI, follow these steps:


Step 1 Log in to the console.

Step 2 Enter privileged mode.

console> enable
 
   

Step 3 Reset the IDSM2 to the application partition or the maintenance partition.

console> (enable) reset module_number {hdd:1 | cf:1}
 
   

Note If you do not specify either the application partition (hdd:1 the default) or the maintenance partition (cf:1), the IDSM2 uses the boot device variable.


Example:

console> (enable) reset 3 
2003 Feb 01 00:18:23 %SYS-5-MOD_RESET: Module 3 reset from console// 
Resetting module 3... This may take several minutes. 
2003 Feb 01 00:20:03 %SYS-5-MOD_OK: Module 3 is online. 
console> (enable)
 
   

Caution If the IDSM2 is removed from the switch chassis without first being shut down, or the chassis loses power, you may need to reset the IDSM2 more than once. If the IDSM2 fails to respond after three reset attempts, boot the maintenance partition, and perform the instructions for restoring the application partition.


For More Information

For the procedure for reimaging the IDSM2, see Installing the IDSM2 System Image

Cisco IOS Software

Use the hw-module module slot_number reset [hdd:1 | cf:1] command in EXEC mode to reset the IDSM2. The reset process takes several minutes. The IDSM2 boots in to the boot partition you specify. If you do not specify the boot string, the default boot string is used.

To reset the IDSM2 from the CLI, follow these steps:


Step 1 Log in to the console.

Step 2 Reset the IDSM2.

router# hw-module module module-number reset {hdd:1 | cf:1}
 
   

Note If you do not specify either the application partition (hdd:1 the default) or the maintenance partition (cf:1), the IDSM2 uses the boot device variable.


Example:

router# hw-module module 8 reset
Device BOOT variable for reset = 
Warning: Device list is not verified. 
Proceed with reload of module? [confirm] 
% reset issued for module 8
router#
 
   

Catalyst and Cisco IOS Software Commands


Note For more detailed information on Catalyst and Cisco IOS software commands, refer to the command references found on Cisco.com. For instructions on how to locate these documents, refer to Documentation Roadmap for Cisco Intrusion Prevention System 6.0.


This section lists the Catalyst and Cisco IOS software commands that pertain to the IDSM2. It contains the following topics:

Catalyst Software

Cisco IOS Software

Catalyst Software

This section lists supported and unsupported Catalyst Software Commands. It contains the following topics:

Supported Supervisor Engine Commands

Unsupported Supervisor Engine Commands

Supported Supervisor Engine Commands

The IDSM2 also supports the following supervisor engine CLI commands, which are described in more detail in the Catalyst 6500 Series Command References.

clear config module_number

Clears the configuration on the supervisor engine that is associated with the specified IDSM2.

clear log module_number

Deletes all entries in the error log for the specified IDSM2.

session slot_number

Logs in to the console of the IDSM2 from the switch console.

set module commands (all other set module commands return an error message):

set module name module_number

Sets the name of the module.

set module power module_number {up | down}

Enables or disables power to the specified IDSM2.

set port name module_number

Configures the name for the specified IDSM2 port.

set span

Configures port 1 as a SPAN destination port. You cannot use port 1 on the IDSM2 as a SPAN source port.

set trunk

Configures trunk ports.

set vlan

Configures VLAN capture ports.

show config

Displays the supervisor engine NVRAM configurations.

show log

Displays the error logs for the specified IDSM2.

show mac module_number

Displays the MAC counters for the specified IDSM2.

show module module_number

With an IDSM2 installed, displays Intrusion Detection System Module under Module-Type.

show port module_number

Displays the port status for the specified IDSM2.

show port capabilities [module | module_number]

Displays the capabilities of the module and ports.

show test

Displays the errors reported from the diagnostic tests for both the SPAN port (port 1) and the management port (port 2) and the BIOS and CMOS boot results.

Unsupported Supervisor Engine Commands

The following supervisor engine CLI commands are not supported by the IDSM2:

set module {enable | disable} module_number

set port broadcast

set port channel

set port cops

set port disable

set port enable

set port flowcontrol

set port gmrp

set port gvrp

set port host

set port inlinepower

set port jumbo

set port membership

set port negotiation

set port protocol

set port qos

set port rsvp

set port security

set port speed

set port trap

set protocolfilter

set rgmp

set snmp

set spantree

set udld

set vtp

Cisco IOS Software

This section lists the Cisco IOS software commands that the IDSM2 supports. These commands are grouped according to mode. This section contains the following topics:

EXEC Commands

Configuration Commands

EXEC Commands

The following commands are all performed in EXEC mode:

clock read-calendar

Updates the clock time to the calendar time.

clock set time date

Sets the current time and date.

clock update-calendar

Updates the calendar time to the clock time.

hw-module module module_number reset {cf:1 | hdd:1}

Resets the IDSM2 in to the partition specified by the boot device variable; if the boot device variable has not been set, the IDSM2 is reset to the application partition by default. Use the command show boot device module module_number to view the current setting of the boot device variable. cf:1 is the maintenance partition. hdd:1 is the application partition.

hw-module module module_number shutdown

Shuts down the IDSM2 so that it can be safely removed from the chassis.

reload

Reloads the entire switch.

session slot module_number processor processor_number

Logs in to the console of the IDSM2 from the switch console.

show boot device module module_number

Displays the current boot string for the specified module.

show diagnostic result module module_number

Displays the results of the online diagnostics that were performed when the IDSM2 was last booted up.

show interface port-channel channel_number

Displays the status of the port channel.

show intrusion-detection module module_number data-port {1 | 2} {state | traffic}

Displays the state or traffic statistics of the specified IDSM2 data port.

show intrusion-detection module module_number management-port {state | traffic}

Displays the state or traffic statistics of the IDSM2 management port.

show ip access-lists

Displays the current access lists.

show module [module_number | all | version]

Displays the installed modules, versions, and states.

show monitor session session_number

Displays the SPAN source and destination for the specified session.

show running-config

Displays the configuration that is currently running.

show spanning-tree active

Displays spanning tree state information for active interfaces only.

show spanning-tree detail

Displays detailed spanning tree state information.

show spanning-tree summary [totals]

Displays the high level state of spanning tree. Does not show interface specific information.

show spanning-tree vlan vlan_number

Displays spanning tree state information for the specified VLAN. Includes list of ports on which those VLANs are forwarded or blocked.

show startup-config

Displays the saved configuration.

show vlan access-map

Displays all current VLAN access maps.

Configuration Commands

The following configuration commands are all performed in either global configuration mode, interface configuration mode, or VACL configuration submode:

Global configuration mode

boot device module number_number {cf:1 | hdd:1}

Sets the default boot device for the specified module. cf:1 boots to the MP and hdd:1 boots to the AP. The no option clears the boot string, which sets the default boot device to the AP.

clock calendar valid

Sets the current calendar time as the switch time on bootup.

clock summer-time zone recurring

Sets the switch to use the summertime settings.

clock timezone zone offset

Sets the timezone for the switch/IDSM2.

fabric switching-mode force busmode

Lets service modules that do not support packet recirculation, be forced in to communicating through the chassis shared bus instead of the switched fabric. This forces the supervisor to handle the packet recirculation centrally and lets the service module communicate properly on VLANs meeting the conditions stated above. Other fabric enabled modules that are not affected by this problem continue to communicate through the switch fabric even if this command is enabled.

[no] intrusion-detection module module_number data-port {1 | 2} access vlan vlan_id

Sets the data port to access (inline) mode and sets the access VLAN for the data port for the specified module.

[no] intrusion-detection module module_number data-port {1 | 2} autostate include

Includes (or excludes) the specified data port in the autostate calculation. When included, the switch virtual interface associated with an MSFC or WLAN port remains up while the data port of the module is enabled. When excluded, the switch virtual interface associated with the MSFC or WAN port goes down if the specified data port of the module is the only active port in the VLAN. The default is no include.

[no] intrusion-detection module module_number data-port {1 | 2} capture

Configures the specified data port as a capture destination port. You must also set the allowed VLAN list through the intrusion-detection module module_number data-port {1 | 2} capture command before any packets are captured. The IDSM2 must be in promiscuous mode.

[no] intrusion-detection module module_number data-port {1 | 2} capture allowed-vlan vlan_list

Sets the allowed VLANs on the specified data port for packet capture. You must also enable capture mode on the data port through the intrusion-detection module module_number data-port {1 | 2} capture command before traffic is captured on the data port.

intrusion-detection module module_number data-port {1 | 2} default

Restores the allowed VLANs, autostate, PortFast, port cost, and priority settings for the specified data port to the default values. This command is useful to remove any configuration from a data port before you add it to a channel group.

[no] intrusion-detection module module_number data-port {1 | 2}port-channel channel_number

Adds the data port for the specified module to the channel group, which creates a port channel with the same numeric ID. If the channel group and port channel have not been created, this command creates it with an empty allowed VLAN list. The no option removes the data port from the channel group, restores the data port settings to their defaults, and deletes the port channel if it is empty.

[no] intrusion-detection module module_number data-port {1 | 2}portfast {enable | disable} [trunk]

Enables or disables PortFast on the data port. When PortFast is enabled, traffic is forwarded by the switch to the IDSM2 data port while the spanning tree is being built. When disabled, traffic is inhibited until after the tree is built and the backplane port is in the forwarding state. The default is disabled. The trunk option enables or disables PortFast when the data port is configured as a trunk (in promiscuous or inline VLAN pairs mode).

[no] intrusion-detection module module_number data-port {1 | 2} spanning-tree cost path_cost

Sets the spanning tree path cost for the data port on the specified module. The no option restores the spanning tree cost for the data port on the specified module to the default cost value.

[no] intrusion-detection module module_number data-port {1 | 2} trunk allowed-vlan vlan_list

Sets the data port to trunking mode and sets the list of allowed VLANs on the data port for the specified module. The no option removes the data port from trunking mode and clears the list of allowed VLANs on the data port for the specified module.

intrusion-detection module module_number management-port access-vlan vlan_number

Sets the access VLAN for the IDSM2 command and control port.

intrusion-detection module module_number data-port data_port_number capture allowed-vlan allowed_capture_vlan(s)

Configures the VLAN(s) for VACL capture.

intrusion-detection module module_number data-port data_port_number capture

Enables VACL capture for the specified IDSM2 data port.

[no] intrusion-detection port-channel channel_number access vlan vlan_id

Sets all data ports in the specified port channel to access mode and sets the access VLAN for the data ports. The no option clears the list of allowed VLANs on the data ports of all modules in the specified port channel.

[no] intrusion-detection port-channel channel_number autostate include

Includes or excludes all data ports in the specified port channel from the autostate calculation. When included, the virtual switch interface associated with an MSFC or WLAN port remains up while the data port is enabled. When excluded, the virtual switch interface associated with the MSFC or WAN port goes down if the data port is the only active port in the VLAN. The data ports are excluded from the autostate calculations by default.

[no] intrusion-detection port-channel channel_number capture

Configures all data ports in the channel group as capture ports. The no option disables the capture function on all data ports in the channel group.

[no] intrusion-detection port-channel channel_number capture allowed-vlan vlan_id

Sets the list of capture VLANs on the data ports of all modules in the specified port channel. This command does not set the channel group to capture mode. Use the intrusion-detection port-channel channel_number capture command to set the channel group to capture mode. The no option clears the list of capture VLANs on the data ports of all modules in the specified port channel.

[no] intrusion-detection port-channel channel_number portfast [enable | disable] [trunk]

Enables or disables PortFast on the data ports in the port channel. When PortFast is enabled, traffic is forwarded by the switch to the data port while the spanning tree is being built. When disabled, traffic is inhibited until after the tree is built and the backplane port is in the forwarding state. Use the trunk option to enable or disable PortFast when the data port is configured as a trunk (in promiscuous or inline VLAN pair mode). Do not use the trunk option when the data ports are configured as access ports (inline mode). PortFast and PortFast trunk are disabled by default.

[no] intrusion-detection port-channel channel_number spanning-tree cost port_cost

Sets the spanning tree port cost for the data port on the specified module. The no option restores the spanning tree port cost for the data port on the specified module to the default value.

[no] intrusion-detection port-channel channel_number spanning-tree priority priority

Sets the spanning tree port priority for the data port on the specified module. The no option restores the spanning tree port priority for the data port on the specified module to the default value.

[no] intrusion-detection port-channel channel_number trunk allowed-vlan vlan_id

Sets the list of allowed VLANs on the data ports of all modules in the specified port channel. The no option clears the list of allowed VLANs on the data ports of all modules in the specified port channel.

ip access-list extended word

Creates access lists for use in the VACL maps.

[no] monitor session session_number destination intrusion-detection module module_number data-port {1 | 2}

Configures a SPAN destination port, which can be either a standard line card port or an IDSM2 data port.

[no] monitor session session_number {source {interface interface_number} | {vlan vlan_id}} [ , | - | rx | tx | both]

Sets the sources for a SPAN session.

[no] power enable module module_number

Powers the IDSM2 off or on.

[no] spanning tree mode [pvst | mst | rapid-pvst]

Selects the spanning tree protocol (PVST+, MST, or Rapid-PVST+) to be used globally on the switch. The default is PVST. MST is not supported for the IDSM2. The no option restores the spanning tree mode to the default.

vlan access-map map_name_sequence

Creates the VACL maps.

vlan filter map_name vlan-list vlans

Maps the VACL maps to VLANs.

Interface configuration mode

switchport

Sets the interface as a switch port.

switchport access vlan vlan

Sets the access VLAN for the interface.

switchport capture

Sets the interface as a capture port.

switchport mode access

Sets the interface as an access port.

switchport mode trunk

Sets the interface as a trunk port.

switchport trunk allowed vlan vlans

Sets the allowed VLANs for trunk.

switchport trunk encapsulation dot1q

Sets dot1q as the encapsulation type.

switchport trunk native vlan vlan

Sets the native VLAN for the trunk port.

VACL configuration submode

action forward capture

Designates that matched packets should be captured.

match ip address [1-199 | 1300-2699 | acl_name]

Specifies filtering in the VACL.