-
Cisco Anomaly Guard Module Configuration Guide (Software Version 4.0)
-
Index
-
Preface
-
Introduction
-
Configuring the Guard Module on the Supervisor Engine Module
-
Initializing the Guard Module
-
Configuring the Guard Module
-
Configuring Zone Traffic Diversion
-
Configuring Zones
-
Configuring Zone Filters
-
Configuring Policy Templates and Policies
-
Interactive Protect Mode
-
Attack Reports
-
Guard Module Diagnostics and Maintenance
-
Analyzing Guard Module Mitigation
-
Glossary
-
Table Of Contents
Configuring the Guard Module on the Supervisor Engine Module
Verifying the Guard Module Installation
Setting Up Guard Module Management
Configuring VLANs on the Supervisor Engine Module
Assigning VLANs to the Guard Module
Configuring Layer 3 Interfaces on the VLANs
Establishing a Session with the Guard Module
Verifying the Guard Module Configuration
Configuring Multiple Guard Modules on One Switch
Redundancy and High Availability
Configuring the Guard Module on the Supervisor Engine Module
This chapter describes how to configure the Cisco Anomaly Guard Module (Guard module) on the Supervisor Engine module (supervisor).
The Cisco Anomaly Guard Module (Guard module) is a Cisco IOS application module that you can install in the Catalyst 6500 series switch with a Supervisor Engine 2 with a Multilayer Switch Feature Card (MSFC) or Supervisor Engine 720.
To configure the Guard module on the supervisor you must have EXEC privileges and must be in configuration mode.
To save all configuration changes to Flash memory, you must enter the write memory command in privileged EXEC mode.
This chapter consists of the following sections:
•
Verifying the Guard Module Installation
•
•
•
•
•
•
Verifying the Guard Module Installation
Verify that the Supervisor Engine module acknowledges the new Guard module and has brought it online.
Note
To verify the installation, perform the following steps:
Step 1
Step 2
show moduleThis example shows the output of the show module command:
Sup# show module Mod Ports Card Type Model Serial No.—- ——- ——————————————————— ————————— —————-1 2 Catalyst 6000 supervisor 2(Active) WS-X6K-SUP2-2GE SAL081230TJ... ...6 3 Anomaly Guard module Module WS-SVC-AGM-1-K9 SAD081000GGMod MAC addresses Hw Fw Sw Status--- -------------------------------- ----- ------- ----------- -------...6 000e.847f.fe04 to 000e.847f.fe0b 3.0 7.2(1) 4.0(0.10) Ok...Sup#
Note
Setting Up Guard Module Management
To establish a remote management session with the Guard module, you must set the Guard module management port.
To select a VLAN for management, enter the following command:
anomaly-guard module module_number port port_number [allowed-vlan vlan_range | native-vlan vlan_id]
Table 2-1 provides the arguments and keywords for the anomaly-guard module command.
This example shows how to select VLAN 5 for a module inserted in slot number 4 in the chassis for management.
Sup(config)# anomaly-guard module 4 port 1 allowed-vlan 5To establish a remote management session with the Guard module, you must also configure the following on the Guard module:
•
•
Configuring VLANs
To configure VLANs on the Supervisor Engine module to forward traffic to the Guard module, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Configuring VLANs on the Supervisor Engine Module
You must configure VLANs on the Supervisor Engine module to forward traffic to the Guard module.
To create a VLAN on the Supervisor Engine module, enter the vlan command and define the VLAN range that you plan to assign to the Guard module. Enter the following command:
vlan vlan_range
The vlan_range argument specifies a single number, a range of VLANs, or several VLANs in a comma-separated list (do not enter space characters). The vlan range can be one or more VLANs (from 1 to 4094).
For example:
Sup(config)# vlan 86-89,99See the "Configuring a VLAN" section for information on how to configure VLANs on the Guard module.
Assigning VLANs to the Guard Module
Assigning VLANs to the Guard module requires that you understand the mapping between the Guard module and the Ethernet ports that connect the Guard module to the switch fabric.
To assign VLANs to the Guard module, enter the following command at the Supervisor Engine module prompt:
anomaly-guard module module_number port port_number [allowed-vlan vlan_range | native-vlan vlan_id]
Table 2-2 provides the arguments for the anomaly-guard module command.
For example:
Sup# anomaly-guard module 7 port 2 allowed-vlan 1,3,6-15
Note
Configuring Layer 3 Interfaces on the VLANs
You can configure layer 3 interfaces on the VLANs if required by the application.
Note
To configure a Layer 3 VLAN interface, perform the following steps:
Step 1
Enter the following command at the Supervisor Engine module prompt:
interface vlan vlan-idThe vlan-id argument specifies the number of the VLAN; valid values are from 1 to 4094.
Step 2
ip address ip_address subnet_maskThe ip-addr and subnet-mask arguments define the interface IP address.
Step 3
no shutdownFor example:
sup (config)# interface vlan 5sup (config-if)# ip address 192.168.89.100 255.255.255.0sup (config-if)# no shutdownEstablishing a Session with the Guard Module
To login to the Guard module, perform the following steps:
Step 1
Step 2
session slot slot_number processor processor_numberTable 2-3 provides the arguments for the session slot command.
Log in at the Guard module login prompt:
login: adminStep 3
If this is the first time you are establishing a session with the Guard module, you must choose a password. The password must be 6 to 24 characters long with no spaces. You can change the password at any time. See the "Changing a Password" section for further details.
After a successful login, the command-line prompt is represented as admin@GUARD#. This guide uses this prompt as its writing convention. You can change the prompt by changing the hostname. See the "Changing the Host Name" section for further details.
Rebooting the Guard Module
The Cisco IOS provides the following commands to control the Guard module: boot, shutdown, power enable and reset:
Caution
•
hw-module module slot_number shutdownThe slot_number argument specifies the number of slot in which the module is inserted in the chassis.
You must then enter the hw-module module module_number reset command to restart the Guard module.
For example:
Sup# hw-module module 8 shutdown
Note
•
hw-module module slot_number reset [string]The slot_number argument specifies the number of slot in which the module is inserted in the chassis and the string argument is an optional string for the PC boot sequence. Enter cf:1 to reset to the MP and cf:4 to reset to the AP. See the "Upgrading the Guard Module Version" section for more information
For example:
Sup# hw-module module 8 reset•
no power enable module slot_numberThe slot_number argument specifies the number of slot in which the module is inserted in the chassis.
To switch the module on again, enter the following command:
power enable module slot_numberFor example:
Sup (config)# no power enable module 8•
boot device module slot_number cf:1The slot_number argument specifies the number of slot in which the module is inserted in the chassis.
To enable the Guard module to boot to the default partition (AP) at the next boot cycle, enter the following command:
no boot device module slot_number cf:1For example:
Sup# boot device module 8 cf:1
Caution
Verifying the Guard Module Configuration
To verify the Guard module configuration on the Supervisor Engine module, type the following command at the Supervisor Engine module prompt:
show anomaly-guard module slot_number port port_number [state | traffic]
Table 2-4 provides the arguments and keywords for the show module command.
For example:
Sup# show anomaly-guard module 8 port 2 stateConfiguring Multiple Guard Modules on One Switch
You can install several Guard modules in a Catalyst 6500 series switch as long as at least one Supervisor Engine module is installed. Refer to the relevant version Release Note for the exact number of modules.
You can configure the multiple Guard modules in one of the following configurations:
•
Load Sharing
You can configure several Guard modules to handle the zone traffic. The Supervisor Engine module will distribute the zone traffic equally between the Guard modules. The Supervisor Engine module distributes the traffic equally between the Guard modules whenever it has more than one equal cost route to the same destination.
To configure more than one Guard module for load sharing, perform the following:
•
•
•
•
Note
Redundancy and High Availability
You can configure two Guard modules (or groups of Guard modules) for high availability. This way, if the active Guard module is not available, the Supervisor Engine module will divert the zone traffic to the Guard module in standby.
The Supervisor Engine module forwards the traffic to the lower cost routes (the routes with the lowest weight). It only forwards the traffic to the redundant routes if it detects that the routes to the active Guard are down.
To configure Guard modules in redundancy, perform the following:
•
•
•
•
•
•
