IDS mailing list archives
RE: IDS deployment on a Cat6500 series & which Snort box?
From: "Carles Fragoso i Mariscal" <cfragoso () cesca es>
Date: Wed, 26 May 2004 01:12:50 +0200
Hi James, Thank you for your answer. I know how to do a span port, I maybe did not explained my question very well. If the traffic comes from different Gigabit ports and also comes aggregated with other traffic is not very useful to do a span port because you need a sensor for each span, and each one has to deal with more traffic than the interesting one. So if we define certain hosts or IP ranges to monitor, a granular solution is needed. I have been told that Cisco Cat6500 could do it in two ways: - ACE's in ACL's which can be used to set some traffic to be captured by IDSM blade. - ACE's in VACL's which can be applied to VLANs in order to forward a copy of the traffic to a designed 'switchport monitor' I just wanted to know if someone has used it in order to get some feedback and to know which one is more convenient. I mentioned Snort because the second way I described could allow to monitor a subset of traffic without using a blade in-switch solution. Thanks also to those guys who replied privately to me, -- Carlos -----Mensaje original----- De: James Williams [mailto:jwilliams () itexch wtamu edu] Enviado el: martes, 25 de mayo de 2004 22:01 Para: Carles Fragoso i Mariscal CC: focus-ids () securityfocus com Asunto: RE: IDS deployment on a Cat6500 series & which Snort box? Setting up a SPAN port on the Catalyst 6500 series switch is easy. The command is: set span <source port/vlan> <destination port> both For Example: set span 1/1 1/2 both - creates a span port on port 1/2 that sends all traffic from 1/1 to 1/2. set span 111 1/2 both - creates a span port on port 1/2 that sends all traffic from vlan 111 to 1/2. Here is a document on configuring SPAN ports. http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration _guide_chapter09186a008007e6fa.html SourceFire is a commercial version of Snort. The packaging is very similar and the way it works is nearly identical. Snort can handle gigabit interfaces very easily. Depending on your snort setup would determine what kind of hardware you would want. I personally like a distributed setup with at least two IDS sensors and one management console. The IDS sensors will need to have at least two nic cards. One nic will be dedicated to listening for data on the span port and the second nic will have a standard tcp/ip configuration. The management station is a web server/database server and all the IDS logs get stored into a database and viewed via a web interface. It's very nice. Here are some excellent docs for you: http://www.snort.org/docs/ If you go with snort a very good book to read is "Snort 2.1 - Intrusion Detection" http://www.bookpool.com/.x/qd6gahkax8/sm/1931836043 If you the Netscreen/Juniper IDP you will not be able to use the intrusion prevention features with the SPAN setup. You will have to put the IDP in-line with the connection. The Cisco IDS module seems to be a good product and integrates well with the Catalyst 6500 series switch. http://www.cisco.com/en/US/products/hw/modules/ps2706/ps5058/index.html You may want to read more about it. There are some limitations that may not be acceptable for the company, like it can only inspect packets at 600Mbps (incoming/outgoing). So you will need to keep things like that in mind because the company may be to big for the Cisco IDS module to watch all that traffic. Or if the company is rapidly growing, it may rapidly out grow the IDS module. This would mean the company would need to choose a more robust product. Hope this answers your questions, James Williams, GISF Network Systems Technician West Texas A&M University \x4e\x65\x74\x77\x6f\x72\x6b\x20\x53\x65\x63\x75\x72\x69\x74\x79\x20\x47\x65 \x65\x6b -----Original Message----- From: Carles Fragoso i Mariscal [mailto:cfragoso () cesca es] Sent: Sunday, May 23, 2004 1:08 PM To: focus-ids () securityfocus com Subject: IDS deployment on a Cat6500 series & which Snort box? Hi, A customer of us is evaluating an outer IDS deployment on its Internet Data Center (IDC) core network which consists on a layer-3 enabled Cisco Catalyst 6500 series. Its network traffic is under Gig speed but over >200Mbps. They have been told that the best choice would be a Cisco IDSM2 which is a switch-in blade IDS because of it is a network-node IDS and because IOS provides some kind of L2/VLAN ACL's which could allow them to capture traffic from/to selected sources/destinations to IDS (for instance: critical hosts or subnets). Cisco IDSes seems not to be as well-featured as other products: Netscreen IDP, SourceFire, ISS Proventia etc. I have been documenting on that and it seems that also exists the possibility on Cat6500 to do L2/VLAN ACL's to forward matched traffic to a span port, that could open the chance of using any IDS on that port instead of switch-in only solution. - Has anyone a similar deployment to described that could provide their experience on that? - Any input regarding IDSM2 experience could also be useful. They have also asked me if an open-source solution such as Snort could deal with Gig traffic and which computer platform would be necessary? I have seen on NSS Group report that a dual Xeon CPU with 1 Gig mem minimum for Snort 2.x branch is recommended. I imagine that the NIC data bus with main board should be big enough. - Any recommendation on which architecture could fit their possible needs? Thanks in advance guys for your help, ---------------------------------------------------------------------------- ---- Carles Fragoso i Mariscal Anella Cientifica RREN Incident Response Team (ERIAC) - Incident Handler Communications and Operations Dept. - Supercomputing Center of Catalonia eMail: cfragoso () cesca es Phone: +34 932056464 Fax: +34 932056979 iDBA: 13041*CFM ---------------------------------------------------------------------------- ---- --------------------------------------------------------------------------- --------------------------------------------------------------------------- --------------------------------------------------------------------------- ---------------------------------------------------------------------------
Current thread:
- IDS deployment on a Cat6500 series & which Snort box? Carles Fragoso i Mariscal (May 25)
- Re: IDS deployment on a Cat6500 series & which Snort box? Tony Carter (May 27)
- RE: IDS deployment on a Cat6500 series & which Snort box? Carles Fragoso i Mariscal (May 28)
- RE: IDS deployment on a Cat6500 series & which Snort box? Gary Halleen (May 28)
- Re: IDS deployment on a Cat6500 series & which Snort box? James Fields (May 29)
- <Possible follow-ups>
- RE: IDS deployment on a Cat6500 series & which Snort box? Carles Fragoso i Mariscal (May 26)
- RE: IDS deployment on a Cat6500 series & which Snort box? Gary Halleen (May 26)
- Re: IDS deployment on a Cat6500 series & which Snort box? Tony Carter (May 27)