Re: Auto-sensing for IPS devices

["Sap ." <0xsapx0 () gmail com>]

Auto-Negotiation is essential in larger networks. When you are talking
about 1000's of switch ports and PC's connecting/disconnecting
constantly (think public campus) how could you ever enforce a rule
like "OK, Set your NIC to 100/Full before you connect".

However for servers I believe it is a best practice to manually set
the ports at whatever they need to be.

Sap

On 9/15/05, McKinley, Jackson <Jackson.McKinley () team telstra com> wrote:
> I agree with Lachlan.
> Auto neg is the best bet in larger networks I find from personal
> experience.  I cant count the number of times ive seen Foundry and cisco
> miss-match when attempting to auto neg.  Working from past exp when a
> customer plugs into your network with a "no brand" switch / device
> (Think colo datacentre's) the first thing I always looked for was stupid
> MTU settings and duplex miss-match.
>
> Altho in a nice all cisco or all foundry or all
> whateverotherbrandyoulike enviroment im sure auto neg would work much
> better.  Ive just never had the pleasure of working in a centre like
> that ;) hahaha
>
> Cheers,
>
> Jack.
>
> -----Original Message-----
> From: Joel M Snyder [mailto:Joel.Snyder () Opus1 COM]
> Sent: Thursday, 15 September 2005 4:36 PM
> To: Lachlan Bowes
> Cc: focus-ids () securityfocus com
> Subject: Re: Auto-sensing for IPS devices
>
> I disagree that it is *always* a good idea.  I think that it's
> *occasionally* a good idea.  Either the standard for auto-sensing works
> or it doesn't.  If you have defective hardware that doesn't work right,
> then it's better to know about it than to patch around the problem---are
> you going to set every single port on a flakey switch?  Or should you
> get rid of the switch?
>
> However, if you decide that it *is* a good idea, just a reminder that
> you MUST set BOTH speed and duplex settings and you MUST set BOTH
> settings on BOTH sides.  There is no concept in 802.3 of having only one
> side autonegotiate and 'learn' what the other side wants.
>
> If you take one side out of auto-negotiate mode and hard code a
> speed/duplex setting, the other side has no way of figuring out what you
> did.
>
> I have seen people who think that they're making things more reliable
> actually break their networks by only setting one side of the connection
> and assuming that the other will follow along magically.
>
> jms
>
> --
> Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719
> Phone: +1 520 324 0494 (voice)  +1 520 324 0495 (FAX)
> jms () Opus1 COM    http://www.opus1.com/jms    Opus One
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------