Cisco Systems IPS4510K9 manual Advantages and Restrictions of Virtualization

Appendix C Troubleshooting

Advantages and Restrictions of Virtualization

To ensure the integrity of the time stamp on the event records, you must clear the event archive of the older events by using the clear events command.

Note You cannot remove individual events.

For More Information

For the procedure for clearing events, see Clearing Events, page C-101.

Advantages and Restrictions of Virtualization

To avoid configuration problems on your sensor, make sure you understand the advantages and restrictions of virtualization on your sensor.

Virtualization has the following advantages:

•You can apply different configurations to different sets of traffic.

•You can monitor two networks with overlapping IP spaces with one sensor.

•You can monitor both inside and outside of a firewall or NAT device. Virtualization has the following restrictions:

•You must assign both sides of asymmetric traffic to the same virtual sensor.

•Using VACL capture or SPAN (promiscuous monitoring) is inconsistent with regard to VLAN tagging, which causes problems with VLAN groups.

–When using Cisco IOS software, a VACL capture port or a SPAN target does not always receive tagged packets even if it is configured for trunking.

–When using the MSFC, fast path switching of learned routes changes the behavior of VACL captures and SPAN.

•Persistent store is limited.

Virtualization has the following traffic capture requirements:

•The virtual sensor must receive traffic that has 802.1q headers (other than traffic on the native VLAN of the capture port).

•The sensor must see both directions of traffic in the same VLAN group in the same virtual sensor for any given sensor.

The following sensors support virtualization:

•ASA 5500-X IPS SSP

•ASA 5585-X IPS SSP

•IPS 4345

•IPS 4345-DC

•IPS 4360

•IPS 4510

•IPS 4520

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		C-17