Capturing
with Multiple Sensors and Multiple VLANs
The generic case of multiple sensors capturing traffic from
a number of VLANs can be very complex depending on the switch infrastructure.
The simplest implementation is when there are many 2900-type switches, and
sensors are connected to corresponding switches. In reality, this case is just a
multiplied "one VLAN, one sensor" case.
Assume now that we have a Catalyst 6000 with two IDSMs installed
and we need to capture VLANs 100 and 200 on the module in slot 5, and VLANs 300
and 400 on the module in slot 6. SPAN-based capture is again simpler to
configure:
Switch (enable) set span 100, 200 5/1 rx create
Switch (enable) set span 300, 400 6/1 rx create
Traffic capture using VACLs is more complex in the configuration
here, but it also produces the best results, as only interesting traffic is
forwarded to monitoring ports of IDSMs:
switch>(enable) set security acl ip WEBCAP permit tcp any any eq 80 capture
switch>(enable) set security acl ip WEBCAP permit tcp any eq 80 any capture
switch>(enable) commit security acl WEBCAP
switch>(enable) set security acl map WEBCAP 100, 200, 300, 400
switch>(enable) set security acl capture-ports 5/1, 6/1
Now we have the same VACL for IP traffic applied to VLANS 100,
200, 300, and 400. Remember that there can be only one VACL for each type of
traffic, and captured traffic is forwarded to all designated capture ports. In
order to separate the traffic between two IDSMs, we need to set trunking on
their monitoring ports:
switch>(enable)clear trunk 5/1 1-1024
switch>(enable)set trunk 5/1 100, 200
switch>(enable)set vlan 100 5/1
switch>(enable)clear trunk 6/1 1-1024
switch>(enable)set trunk 5/1 300, 400
switch>(enable)set vlan 300 5/1
After you have configured this, the configuration can be changed
to the one in the "one VLAN, one sensor" case by simply filtering out VLAN
100—for example, on the corresponding trunk. Thus, you can configure capturing
for many VLANs in advance and then filter already captured traffic before it
reaches IDSM by using trunking commands (see Figure 9.11).
Sections
Comments (0 posted)
Syndication
