5-3
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter5 Configuring Virtual Sensors
Inline TCP Session Tracking Mode
Virtualization has the following restrictions:
•
You must assign both sides of asymmetric traffic to the same virtual sensor.
•
Using VACL capture or SPAN (promiscuous monitoring) is inconsistent with regard to VLAN
tagging, which causes problems with VLAN groups.
–
When using Cisco IOS software, a VACL capture port or a SPAN target does not always receive
tagged packets even if it is configured for trunking.
–
When using the MSFC, fast path switching of learned routes changes the behavior of VACL
captures and SPAN.
•
Persistent store is limited.
Virtualization has the following traffic capture requirements:
•
The virtual sensor must receive traffic that has 802.1q headers (other than traffic on the native VLAN
of the capture port).
•
The sensor must see both directions of traffic in the same VLAN group in the same virtual sensor
for any given sensor.
The following sensors support virtualization:
•
ASA 5500-X IPS SSP
•
ASA 5585-X IPS SSP
•
IPS 4345
•
IPS 4345-DC
•
IPS 4360
•
IPS 4510
•
IPS 4520
Inline TCP Session Tracking Mode
Note
The ASA IPS modules (ASA 5500-X IPS SSP and ASA 5585-X IPS SSP) do not support the inline TCP
session tracking mode.
When you choose to modify packets inline, if the packets from a stream are seen twice by the Normalizer
engine, it cannot properly track the stream state and often the stream is dropped. This situation occurs
most often when a stream is routed through multiple VLANs or interfaces that are being monitored by
the IPS. A further complication in this situation is the necessity of allowing asymmetric traffic to merge
for proper tracking of streams when the traffic for either direction is received from different VLANs or
interfaces. To deal with this situation, you can set the mode so that streams are perceived as unique if
they are received on separate interfaces and/or VLANs (or the subinterface for VLAN pairs).
The following inline TCP session tracking modes apply:
•
Interface and VLAN—All packets with the same sess ion key (AaBb) in the same VLAN (or inline
VLAN pair) and on the same interface belong to the same session. Packets with the same key but on
different VLANs are tracked separately.
•
VLAN Only—All packets with the same session key (AaBb) in the same VLAN (or inline VLAN
pair) regardless of the interface belong to the same session. Packets with the same key but on
different VLANs are tracked separately.