-
Cisco Anomaly Guard Module Configuration Guide (Software Version 5.1)
-
Index
-
Preface
-
Product Overview
-
Configuring the Guard Module on the Supervisor Engine
-
Initializing the Guard Module
-
Configuring the Guard Module
-
Configuring Traffic Diversion
-
Configuring Zones
-
Configuring Zone Filters
-
Configuring Policy Templates and Policies
-
Learning the Zone Traffic Characteristics
-
Protecting Zones
-
Using Interactive Protect Mode
-
Understanding Attack Reports
-
Using Guard Module Diagnostics Tools
-
Performing Maintenance Tasks
-
Analyzing Guard Module Mitigation
-
Table Of Contents
Configuring the Guard Module on the Supervisor Engine
Verifying the Guard Module Installation
Setting Up Guard Module Management
Configuring VLANs on the Supervisor Engine
Assigning VLANs to the Guard Module
Configuring the Layer 3 Interfaces on the VLANs
Establishing a Session with the Guard Module
Verifying the Guard Module Configuration
Configuring Multiple Guard Modules in a Single Switch or Router
Redundancy and High Availability
Configuring the Guard Module on the Supervisor Engine
This chapter describes how to configure the Cisco Anomaly Guard Module (Guard module) on the supervisor engine. You must configure the Guard module on the supervisor engine before you can establish a session with the Guard module to configure it.
You can install the Cisco Anomaly Guard Module (Guard module) in a Catalyst 6500 series switch or a 7600 series router. See the "Understanding the Cisco Anomaly Guard Module" section on page 1-1 for more information.
This chapter consists of the following sections:
•
Verifying the Guard Module Installation
•
•
•
•
To configure the Guard module on the supervisor engine, you must have EXEC privileges and must be in configuration mode.
To save all configuration changes to the Flash memory, use the write memory command in privileged EXEC mode.
Verifying the Guard Module Installation
Verify that the supervisor engine acknowledges the new Guard module and has brought it online.
Note
To verify the installation, perform the following steps:
Step 1
Step 2
show moduleThis example shows the output of the show module command:
Sup# show module Mod Ports Card Type Model Serial No.—- ——- ——————————————————— ————————— —————-1 2 Catalyst 6000 supervisor 2(Active) WS-X6K-SUP2-2GE SAL081230TJ... ...6 3 Anomaly Guard module Module WS-SVC-agm-1-K9 SAD081000GGMod MAC addresses Hw Fw Sw Status--- -------------------------------- ----- ------- ----------- -------...6 000e.847f.fe04 to 000e.847f.fe0b 3.0 7.2(1) 4.0(0.10) Ok...Sup#
Note
Setting Up Guard Module Management
To establish a remote management session with the Guard module, you must set the Guard module management port.
To select a VLAN for management, use the following command:
anomaly-guard module module_number port port_number [allowed-vlan vlan_range | native-vlan vlan_id]
Table 2-1 provides the arguments and keywords for the anomaly-guard module command.
The following example shows how to select VLAN 5 for a module inserted in slot number 4 in the chassis for management:
Sup(config)# anomaly-guard module 4 port 1 allowed-vlan 5To establish a remote management session with the Guard module, you must also configure the following on the Guard module:
•
•
Configuring VLANs
To configure VLANs on the supervisor engine to forward traffic to the Guard module, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Configuring VLANs on the Supervisor Engine
You must configure VLANs on the supervisor engine to forward traffic to the Guard module. To create a VLAN on the supervisor engine, use the following command and define the VLAN range that you plan to assign to the Guard module:
vlan vlan_range
The vlan_range argument specifies a single number, a range of VLANs, or several VLANs in a comma-separated list (do not enter space characters). The vlan range can be one or more VLANs (from 1 to 4094).
The following example shows how to define VLANs:
Sup(config)# vlan 86-89,99See the "Configuring a VLAN" section on page 3-12 for information on how to configure VLANs on the Guard module.
Assigning VLANs to the Guard Module
Assigning VLANs to the Guard module requires that you understand the mapping between the Guard module and the Ethernet ports that connect the Guard module to the switch fabric.
To assign VLANs to the Guard module, use the following command at the supervisor engine prompt:
anomaly-guard module module_number port port_number [allowed-vlan vlan_range | native-vlan vlan_id]
Table 2-2 provides the arguments and keywords for the anomaly-guard module command.
The following example shows how to assign VLANs to the Guard module:
Sup# anomaly-guard module 7 port 2 allowed-vlan 1,3,6-15
Note
Configuring the Layer 3 Interfaces on the VLANs
You can configure Layer 3 interfaces on the VLANs if required by the application.
Note
To configure a Layer 3 VLAN interface, perform the following steps:
Step 1
interface vlan vlan-idThe vlan-id argument specifies the number of the VLAN; valid values are from 1 to 4094.
Step 2
ip address ip_address subnet_maskThe ip-addr and subnet-mask arguments define the interface IP address.
Step 3
no shutdownThe following example shows how to configure a Layer 3 VLAN interface:
sup (config)# interface vlan 5sup (config-if)# ip address 192.168.89.100 255.255.255.0sup (config-if)# no shutdownEstablishing a Session with the Guard Module
To log in to the Guard module, perform the following steps:
Step 1
Step 2
session slot slot_number processor processor_numberTable 2-3 provides the arguments and keywords for the session slot command.
Step 3
login: adminStep 4
If this is the first time that you are establishing a session with the Guard module, you must choose a password for the admin and the riverhead user accounts. The password must be between 6 to 24 characters with no spaces. You can change the password at any time. See the "Changing Your Password" section on page 4-9 for more information.
After a successful login, the command-line prompt is represented as user@GUARD#. You can change the prompt by entering the hostname command.
Rebooting the Guard Module
Cisco IOS software provides the following commands to control the Guard module: boot, shutdown, power enable and reset:
Caution
•
hw-module module slot_number shutdownThe slot_number argument specifies the number of the slot in which the module is inserted in the chassis.
You must then enter the hw-module module module_number reset command to restart the Guard module.
The following example shows how to shut down the Guard module:
Sup# hw-module module 8 shutdown
Note
•
hw-module module slot_number reset [string]The slot_number argument specifies the number of the slot in which the module is inserted in the chassis. The string argument is an optional string for the PC boot sequence. Enter cf:1 to reset to the MP and cf:4 to reset to the AP. See the "Upgrading the Guard Module Software" section on page 14-11 for more information.
The following example shows how to reset the Guard module:
Sup# hw-module module 8 reset•
no power enable module slot_numberThe slot_number argument specifies the number of the slot in which the module is inserted in the chassis.
To switch the module on again, use the following command:
power enable module slot_numberThe following example shows how to shut down the Guard module:
Sup (config)# no power enable module 8•
boot device module slot_number cf:1The slot_number argument specifies the number of the slot in which the module is inserted in the chassis.
To enable the Guard module to boot to the default partition, which is the AP, at the next boot cycle, use the following command at the supervisor engine prompt:
no boot device module slot_number cf:1The following example shows how to configure the Guard module to boot to the AP at the next boot cycle:
Sup# boot device module 8 cf:1
Caution
Verifying the Guard Module Configuration
To verify the Guard module configuration on the supervisor engine, use the following command at the supervisor engine prompt:
show anomaly-guard module slot_number port port_number [state | traffic]
Table 2-4 provides the arguments and keywords for the show module command.
The following example shows how to display the Guard module configuration on the supervisor engine:
Sup# show anomaly-guard module 8 port 2 stateConfiguring Multiple Guard Modules in a Single Switch or Router
You can install several Guard modules in a Catalyst 6500 series switch or a Cisco 7600 series router as long as at least one supervisor engine is installed. Refer to the most current Release Note for the exact number of modules.
Note
http://www.cisco.com/en/US/products/hw/modules/ps2706/prod_release_notes_list.html
You can configure multiple Guard modules in one of the following configurations:
•
Load Sharing
You can configure several Guard modules to handle the zone traffic. The supervisor engine distributes the traffic equally between the Guard modules whenever it has more than one equal cost route to the same destination.
To configure more than one Guard module for load sharing, perform the following tasks:
•
•
•
•
Note
Redundancy and High Availability
You can configure two Guard modules (or groups of Guard modules) for high availability. If the active Guard module is not available, the supervisor engine diverts the zone traffic to the standby Guard module.
The supervisor engine forwards the traffic to the lower cost routes (the routes with the lowest weight). The supervisor engine forwards the traffic to the redundant routes only if it detects that the routes to the active Guard are down.
To configure Guard modules in redundant configuration, perform the following tasks:
•
•
•
•
•
•
