C-17
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix C Troubleshooting
Advantages and Restrictions of Virtualization
To ensure the integrity of the time stamp on the event records, you must clear the event archive of the
older events by using the clear events command.
Note
You cannot remove individual events.
For More Information
For the procedure for clearing events, see Clearing E vents, page C-101.
Advantages and Restrictions of Virtualization
To avoid configuration problems on your sensor, make sure you understand the advantages and
restrictions of virtualization on your sensor.
Virtualization has the following advantages:
•
You can apply different configurations to different sets of traffic.
•
You can monitor two networks with overlapping IP spaces with one sensor.
•
You can monitor both inside and outside of a firewall or NAT device.
Virtualization has the following restrictions:
•
You must assign both sides of asymmetric traffic to the same virtual sensor.
•
Using VACL capture or SPAN (promiscuous monitoring) is inconsistent with regard to VLAN
tagging, which causes problems with VLAN groups.
–
When using Cisco IOS software, a VACL capture port or a SPAN target does not always receive
tagged packets even if it is configured for trunking.
–
When using the MSFC, fast path switching of learned routes changes the behavior of VACL
captures and SPAN.
•
Persistent store is limited.
Virtualization has the following traffic capture requirements:
•
The virtual sensor must receive traffic that has 802.1q headers (other than traffic on the native VLAN
of the capture port).
•
The sensor must see both directions of traffic in the same VLAN group in the same virtual sensor
for any given sensor.
The following sensors support virtualization:
•
ASA 5500-X IPS SSP
•
ASA 5585-X IPS SSP
•
IPS 4345
•
IPS 4345-DC
•
IPS 4360
•
IPS 4510
•
IPS 4520