36-3
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter36 Managing IPS Device Interfaces
Understanding Interface Modes
assistance from other networking devices, for example, routers and firewalls, to respond to an attack.
While such response actions can prevent some classes of attacks, in atomic attacks the single packet has
the chance of reaching the target system before the promiscuous-based sensor can apply an ACL
modification on a managed device (such as a firewall, switch, or router).
By default, all sensing interfaces are in promiscuous mode. To change an interface from inline interface
mode to promiscuous mode, delete any inline interface that contains that interface and delete any inline
VLAN pair subinterfaces of that interface from the interface configuration.
Related Topics
•Understanding Interfaces, page 36-1
•Configuring Physical Interfaces, page 36-10
Inline Interface Mode
Operating in inline interface pair mode puts the IPS directly into the traffic flow and affects
packet-forwarding rates making them slower by adding latency. This allows the sensor to stop attacks by
dropping malicious traffic before it reaches the intended target, thus providing a protective service. Not
only is the inline device processing information on Layers 3 and 4, but it is also analyzing the contents
and payload of the packets for more sophisticated embedded attacks (Layers 3 to 7). This deeper analysis
lets the system identify and stop or block attacks that would normally pass through a traditional firewall
device.
In inline interface pair mode, a packet comes in through the first interface of the pair on the sensor and
out the second interface of the pair. The packet is sent to the second interface of the pair unless that
packet is being denied or modified by a signature.
Notes:
•If the paired interfaces are connected to the same switch, you should configure them on the switch
as access ports with different access VLANs for the two ports. Otherwise, traffic does not flow
through the inline interface.
•You can configure IPS modules for routers and ASA devices to operate inline even though these
modules have only one sensing interface.
Related Topics
•Understanding Interfaces, page 36-1
•Configuring Inline Interface Pairs, page 36-13
Inline VLAN Pair Mode
You can associate VLANs in pairs on a physical interface. This is known as inline VLAN pair mode.
Packets received on one of the paired VLANs are analyzed and then forwarded to the other VLAN in the
pair.
Inline VLAN pair mode is an active sensing mode where a sensing interface acts as an 802.1q trunk port,
and the sensor performs VLAN bridging between pairs of VLANs on the trunk. The sensor inspects the
traffic it receives on each VLAN in each pair, and can either forward the packets on the other VLAN in
the pair, or drop the packet if an intrusion attempt is detected. You can configure an IPS sensor to
simultaneously bridge up to 255 VLAN pairs on each sensing interface. The sensor replaces the VLAN