Capturing
with One Sensor and a Single VLAN
Capturing using one sensor and a single VLAN is the simplest
case and should be easy to configure. If you are using an external sensor,
simply create a SPAN session, either local or remote, for the VLAN you want to
monitor and forward all traffic to the port where the sensor is connected. The
same configuration can be used with IDSM, setting port 1 of the IDS module card
as the SPAN destination.
The simple local SPAN for a 2900 series switch can be configured
in this way (see Figure 9.10):
!
interface FastEthernet3/1
port monitor FastEthernet0/1
port monitor FastEthernet0/2
port monitor FastEthernet0/3
switchport access vlan 100
!
interface FastEthernet0/1
switchport access vlan 100
!
interface FastEthernet0/2
switchport access vlan 100
!
interface FastEthernet0/3
switchport access vlan 100
!
On a Catalyst (with CatOS), similar results can be achieved with
just one command:
Switch (enable) set span 100 5/1 rx create
An IOS-based Catalyst requires the following:
Switch(config)# monitor session 1 source vlan 100 rx
Switch(config)# monitor session 1 destination interface Fa5/1
VACL-based capture can be configured as follows:
switch>(enable) set security acl ip WEBCAP permit tcp any any eq 80 capture
switch>(enable) set security acl ip WEBCAP permit tcp any eq 80 any capture
switch>(enable) commit security acl WEBCAP
switch>(enable) set security acl map WEBCAP 100
switch>(enable) set security acl capture-ports 5/1
VACLs can also be configured on an IOS-based Catalyst switch, as
described earlier. It is also worth noting that you can use trunking
configuration commands to filter traffic reaching the sensor port of an IDSM.
This is more important when using several sensors monitoring multiple VLANs,
because it helps distributing traffic. The monitoring interface of an IDSM is
set as trunk by default. We will use the following commands to filter traffic
from all VLANs but 100:
switch>(enable)clear trunk 5/1 1-1024
switch>(enable)set trunk 5/1 100
switch>(enable)set vlan 100 5/1
Sections
Comments (0 posted)
Syndication
