Kingsley,
For your Catalyst comment are you speaking of a VLAN-Bridge or Just Layer 3 aware routing on the Catalysts? I am unclear as to what you are referring. The sensors sensing interfaces are not Layer3, saying it simplified, aware so it doesn't have the capability to route traffic. Using a vlan pair is not an unusual deployment. It is common. The inline vlan pair would be applied to one of the virtual sensors and any traffic that goes from one device to another will be inspected. In regards to how it is done as the traffic comes in on the vlan the dot1q header is removed. The traffic is inspected and the dot1q header for the next vlan is attached to the packet and it is sent out the other side. HTH Regards, Tyson Scott - CCIE #13513 R&S and Security Technical Instructor - IPexpert, Inc. Telephone: +1.810.326.1444 Cell: +1.248.504.7309 Fax: +1.810.454.0130 Mailto: [email protected] Join our free online support and peer group communities: <http://www.IPexpert.com/communities> http://www.IPexpert.com/communities IPexpert - The Global Leader in Self-Study, Classroom-Based, Video On Demand and Audio Certification Training Tools for the Cisco CCIE R&S Lab, CCIE Security Lab, CCIE Service Provider Lab , CCIE Voice Lab and CCIE Storage Lab Certifications. From: Kingsley Charles [mailto:[email protected]] Sent: Saturday, August 29, 2009 11:11 AM To: Tyson Scott; Paul Stewart; [email protected]; [email protected] Cc: [email protected] Subject: Re: [OSL | CCIE_Security] IPS Sensor inter vlan pair mode with vlans in different subnet Hi If the sensor needs to bridge traffic from one vlan to other vlan then it should do either inter vlan routing (having routng intelligence) or be a dummy device like a hub. I am aware that switches like 3550/3560 can also do inter-vlan routing without the need of a router. Does the sensor also do the same? But that is not possible without a routing vlan interface. As per my understanding sensor can either be just as a dummy device as a hub and transmit traffic with inline pair mode. If sensor needs to inspect trunk traffic, the we need configure the trunking sub-interface and use vlan groups. The following are the cases, where sensor will bridge between two vlans. 1. Configure a sensor interface in inline vlan pair mode and connect the switch interface as trunk.The switch bridges between two vlans. 2. Configure a sensor in inline interface pair mode and connect two interfaces (access mode) of same switch with two different vlans. The switch bridges between two vlans. 3. Configure a sensor in inline interface pair mode and connect two interfaces (access mode) of two different switch with two different vlans. The switch bridges between two vlans. 4. Configure a sensor in inline interface pair mode and connect two interfaces (trunk mode) of two different switch with multiple vlans. The switch bridges between all vlans.vlan groups can be used with different virtual sensors. For the 2nd and 3rd case, the sensor will act just like an hub. It is an usual deployment, where sensor is just placed in between. For the 4th case, the sensor act like a trunking pipe. It is an usual deployment, where sensor is just placed in between. I have the following questions for 1st case with inline apri mode: * It acts as a vlan bridge between same subnet between two vlans. This is not an usual deployment. Where will actually inline vlan pair be used? * Also based on which criteria does the sensor bridge the vlan ids. How does the sensor bridge between vlans. Or does it bridge/swap all trunk packets coming with VLAN ID configured in the vlan pair? With regards Kings On Sat, Aug 29, 2009 at 7:44 PM, Tyson Scott <[email protected]> wrote: Kingsley, It is possible to bridge two disparate networks together using inline pair or vlan pair. The problem is not the IPS it would be the two devices on each side. They will have no idea how to communicate with each other as they are on separate networks. So although the IPS could technically do it no traffic is going to flow thru the IPS because routing requires communication from end to end. Regards, Tyson Scott - CCIE #13513 R&S and Security Technical Instructor - IPexpert, Inc. Telephone: +1.810.326.1444 Cell: +1.248.504.7309 Fax: +1.810.454.0130 Mailto: [email protected] Join our free online support and peer group communities: <http://www.ipexpert.com/communities> http://www.IPexpert.com/communities IPexpert - The Global Leader in Self-Study, Classroom-Based, Video On Demand and Audio Certification Training Tools for the Cisco CCIE R&S Lab, CCIE Security Lab, CCIE Service Provider Lab , CCIE Voice Lab and CCIE Storage Lab Certifications. From: [email protected] [mailto:[email protected]] On Behalf Of Kingsley Charles Sent: Saturday, August 29, 2009 7:20 AM To: Stuart Hare Cc: [email protected] Subject: Re: [OSL | CCIE_Security] IPS Sensor inter vlan pair mode with vlans in different subnet Hi Stu In most of the cases, each vlan has it's own subnet. Sensor interface supports 802.1q trunking but doesn't support interface vlan routing. I think, the limitation of not having inter vlan routing prevents bridging with routing of vlans with different subnets. In the case of inline vlan pair mode, how does the sensor decide/know which packet that it needs to bridge between the vlan pairs. With regards Kings On Sat, Aug 29, 2009 at 3:11 PM, Stuart Hare <[email protected]> wrote: Kings This is where u would use inline interface pairs instead of vlan pairs. Set up the switchports as access to ur respective vlans and assign both of the interfaces to a single inline pair. Hth Stu Sent from my iPhone On 29 Aug 2009, at 10:14, Kingsley Charles <[email protected]> wrote: Hi all IPS Sensor supports inter vlan pair mode with interface in the trunking mode. The sensor actually bridges i.e., swaps the vlan id of the incoming frame. Here, should both VLANs should be in same subnet. Can the VLAN be in different subnets? VLAN A - 10.20.30.0/24 VLAN B - 10.30.20.0/24 Can the sensor's interface be configured in inline vlan pair mode between vlan A and B? With regards Kings _______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com <http://www.ipexpert.com/>
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
