4-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter4 Configuring Interfaces
Understanding Interfaces
Sensing Interfaces
Sensing interfaces are used by the sensor to analyze traffic for security violations. A sensor has one or
more sensing interfaces depending on the sensor. Sensing interfaces can operate individually in
promiscuous mode or you can pair them to create inline interfaces.
Note
On appliances, all sensing interfaces are disabled by default. You must enable them to use them. On
modules, the sensing interfaces are permanently enabled.
Some appliances support optional interface cards that add sensing interfaces to the sensor. You must
insert or remove these optional cards while the sensor is powered off. The sensor detects the addition or
removal of a supported interface card. If you remove an optional interface card, some of the interface
configuration is deleted, such as the speed, duplex, description string, enabled/disabled state of the
interface, and any inline interface pairings. These settings are restored to their default settings when the
card is reinstalled. However, the assignment of promiscuous and inline interfaces to the Analysis Engine
is not deleted from the Analysis Engine configuration, but is ignored until those cards are reinserted and
you create the inline interface pairs again.
For More Information
•
For more information on supported interfaces , see Interface Support, page 4-6.
•
For more information on interface modes, see Configuring Promiscuous Mode, page 4-14,
Configuring Inline Interface Mode, page4-16, Configuring Inline VLAN Pair Mode, page 4-21,
Configuring VLAN Group Mode, page4-26, Configuring Inline Bypass Mode, page 4-33.
TCP Reset Interfaces
This section explains the TCP reset interfaces and when to use them. It contains the following topics:
•
Understanding Alternate TCP Reset Interfaces, page 4-4
•
Designating the Alternate TCP Reset Interface, page 4-5

Understanding Alternate TCP Reset Interfaces

You can configure sensors to send TCP reset packets to try to reset a network connection between an
attacker host and its intended target host. In some installations when the interface is operating in
promiscuous mode, the sensor may not be able to send the TCP rese t packets over the same sensing
interface on which the attack was detected. In such cases, you can associate the sensing interface with
an alternate TCP reset interface and any TCP resets that would otherwise be sent on the se nsing interface
when it is operating in promiscuous mode are instead sent out on the associated alternate TCP reset
interface.
If a sensing interface is associated with an alternate TCP reset interface, that association applies when
the sensor is configured for promiscuous mode but is ignored wh en the sensing interface is configured
for inline mode. any sensing interface can serve as the alternate TCP reset interface for another sensing
interface.
1. The 4500 series sensors have two management ports, Management 0/0 and
Management 0/1, but Management 0/1 is reserved for future use.