TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Listfolk, I am the engineer in charge of rolling out 7 sensors into a switched environment that will monitor the interfaces of high availability firewall pairs. One sensor per firewall pair. I pondered a few different ways to gather and aggregate link information, some less acceptable than others. I am looking for input on maybe how you may have accomplished this task, but first let me share what I have considered thus far. 1) SPANS on existing switch infrastructure: Some of our switches only support one span at a time, thus breaking a common practice of using span as a tool for sniffing. Doesn't scale well. 2)TAPS: I have tested the Schomiti (SP?) and Netoptics fast Ethernet taps and they have a physical interruption when power fails, this is unacceptable? Are there any completely passive taps? Can you make a physical Ethernet *Y* cable then aggregate the TX and RX pairs in a switch? 3) Hubs: not full duplex... 4) dedicated switches (current idea): Insert a 2950-12 (2900 XL series is EOL) one each into the leg of each firewall, span the port and aggregate both monitor ports back at the IDS switch before the sensors. 5) Application layer switches (second idea): Application layer switch such as the Toplayer product (open to ideas here). Why rather pricey there are some nice looking value added features to complement a firewall and IDS combination. However I am hesitant to insert these devices as I have not seen many in the wild and not overly ambitious to hang my reputation on them. More specifically would anyone like to share their experiences with list? Are they reliable? Well supported? TIA Bill Northrup Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
