RE: IDS deployment on a Cat6500 series & which Snort box?

[JR <rameskr () yahoo com>]

Adam,

Yes, we have msfc card in it and runs as layer
3(native IOS). The monitor session command allows to
monitor the source vlan / port on either directions.

But to receive incoming packet back from the IDS box
into the switch port is not enabled. Due to this, we
can connect to the box or shot any unwanted traffic
using TCP resets.

Cisco search revealed that only from 12.1(13)EA1 it
supports span port for IDS on IOS.

The Catalyst 2955 and 2950 Enhance Image (EI) Software
receives support for Switch Port Analyzer (SPAN) for
Intrusion Detection System (IDS). This feature enables
bi-directional traffic on the destination SPAN port,
which is necessary if IDS devices are to send
Transmission Control Protocol (TCP) resets, or to
control devices like distributed sniffers

Click the URL:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1833/prod_bulletin09186a008014eed1.html

Again here it doesn't talk about the Cisco 6509 and
nowhere Cisco 6509's IOS span support for IDS is
mentioned(except their own IDS module).

I am worried to upgrade the cisco code on my current
stable 6509 just to see if this feature is available
or not. With no document evidence, i find it might be
just status quo for the issue, but the upgrade
bringing more other issues. I wish I get spare systems
to play around first before touching the production
ones.

Cheers!

Ramesh

--- "Kliarsky, Adam D." <adam.kliarsky () wamu net>
wrote:
> How is your 6500 set up? Do you have a MSFC card,
> VACLs etc?
> As for the monitor session command, I use the
> command with my 3550's,
> and append 'both' at the end to allow capture for
> both tx/rx - have not
> ran into any issues
>
> R/
> Adam
>
>
>
> -----Original Message-----
> From: JR [mailto:rameskr () yahoo com] 
> Sent: Sunday, June 06, 2004 1:06 AM
> To: Gary Halleen; 'Carles Fragoso i Mariscal';
> 'James Williams'
> Cc: focus-ids () securityfocus com
> Subject: RE: IDS deployment on a Cat6500 series &
> which Snort box?
>
>
> Hi,
>
> While setting up the Cisco 6500 port for span in
> Native IOS, we lose an basic option of enabling
> incoming pkts which was possible in all CATOS
> switches
> and hence you can't connect to that IDS box through
> that span port remotely and also that IDS connected
> to
> that span port can't do packet injection like
> blocking
> unwanted traffic. It will be just in promisuous
> mode(a
> passive listener).
>
> I have tested this and don't find any way out. Has
> anyone seen this problem with "session monitor"
> command?
>
> Regards,
>
> Ramesh
>
>
>
>
> --- Gary Halleen <ghalleen () cisco com> wrote:
> > Carlos,
> >
> > I'll also reply privately.
> >
> > I have a presentation I can send you that
> describes
> > in detail the various
> > methods of capturing traffic for and IDS.  I work
> > for Cisco, so obviously
> > this is focused towards using a Cisco sensor, but
> > you'll find it valuable
> > for others as well.
> >
> > Gary
> >
> >
> > > -----Original Message-----
> > > From: Carles Fragoso i Mariscal
> > [mailto:cfragoso () cesca es]
> > > Sent: Tuesday, May 25, 2004 4:13 PM
> > > To: James Williams
> > > Cc: focus-ids () securityfocus com
> > > Subject: RE: IDS deployment on a Cat6500 series
> &
> > which Snort box?
> > > Hi James,
> > >
> > > Thank you for your answer.
> > >
> > > I know how to do a span port, I maybe did not
> > explained my
> > > question very well.
> > >
> > > If the traffic comes from different Gigabit
> ports
> > and also
> > > comes aggregated with other traffic is not very
> > useful to do
> > > a span port because you need a sensor for each
> > span, and each
> > > one has to deal with more traffic than the
> > interesting one.
> > > So if we define certain hosts or IP ranges to
> > monitor, a
> > > granular solution is needed. I have been told
> that
> > Cisco
> > > Cat6500 could do it in two ways:
> > >
> > >  - ACE's in ACL's which can be used to set some
> > traffic to be captured
> > >    by IDSM blade.
> > >
> > >  - ACE's in VACL's which can be applied to VLANs
> > in order to forward a
> > >    copy of the traffic to a designed 'switchport
> > monitor'
> > > I just wanted to know if someone has used it in
> > order to get
> > > some feedback and to know which one is more
> > convenient. I
> > > mentioned Snort because the second way I
> described
> > could
> > > allow to monitor a subset of traffic without
> using
> > a blade
> > > in-switch solution.
> > >
> > > Thanks also to those guys who replied privately
> to
> > me,
> > > -- Carlos
> > >
> > > -----Mensaje original-----
> > > De: James Williams
> > [mailto:jwilliams () itexch wtamu edu]
> > > Enviado el: martes, 25 de mayo de 2004 22:01
> > > Para: Carles Fragoso i Mariscal
> > > CC: focus-ids () securityfocus com
> > > Asunto: RE: IDS deployment on a Cat6500 series &
> > which Snort box?
> > > Setting up a SPAN port on the Catalyst 6500
> series
> > switch is
> > > easy. The command is:
> > >
> > > set span <source port/vlan> <destination port>
> > both
> > > For Example:
> > >
> > > set span 1/1 1/2 both - creates a span port on
> > port 1/2 that
> > > sends all traffic from 1/1 to 1/2.
> > >
> > > set span 111 1/2 both - creates a span port on
> > port 1/2 that
> > > sends all traffic from vlan 111 to 1/2.
> > >
> > > Here is a document on configuring SPAN ports.
http://www.cisco.com/en/US/products/hw/switches/ps708/products
> > > _configuration
> > > _guide_chapter09186a008007e6fa.html
> > >
> > > SourceFire is a commercial version of Snort. The
> > packaging is
> > > very similar and the way it works is nearly
> > identical. Snort
> > > can handle gigabit interfaces very easily.
> > Depending on your
> > > snort setup would determine what kind of
> hardware
> > you would
> > > want. I personally like a distributed setup with
> > at least two
> > > IDS sensors and one management console. The IDS
> > sensors will
> > > need to have at least two nic cards. One nic
> will
> > be
> > > dedicated to listening for data on the span port
> > and the
> > > second nic will have a standard tcp/ip
> > configuration. The
> > > management station is a web server/database
> server
> > and all
> > > the IDS logs get stored into a database and
> viewed
> > via a web
> > > interface. It's very nice.
> > >
> > > Here are some excellent docs for you:
> > >
> > > http://www.snort.org/docs/
> > >
> > > If you go with snort a very good book to read is
> > "Snort 2.1 -
> > > Intrusion Detection"
=== message truncated ===



        
                
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 

---------------------------------------------------------------------------

---------------------------------------------------------------------------