Re: Auto-sensing for IPS devices

[Packet Man <packetman () altsec info>]

ferg () furg net wrote:

> Hi there,
>
> In a typical enterprise IPS deployment would it be normal to leave auto-sensing on the IPS and on the switches it was 
> connected to, especially in 10/100/1000, or would it be wiser to set both ends to a particular speed? I have heard 
> there may be issues with CRC errors etc.
>
>  

Ferg;

My experience has been, even with large networks, that the
switch ports should be set to the desired mode, bypassing
autonegotiation.

Regarding almost all auto-negotiation problems, they crop up
when there's a conflict between the timing of the link peers
trying to sync up and they're both set to negotiate.  It's kind
of like two chatty gossips trying to talk at the same time -
they're always interrupting each other.

This problem is pretty well documented for many pairs of
common network switch/NIC combinations, where switch
brand A is known to fail negotiation with NIC brand B.

Setting a switch port to 100-TX will force any decent NIC on a
host to link up at that setting.  I would trash any NIC that
doesn't.  It's not necessary to force the link mode of the NIC
if the switch doesn't auto-negotiate - the host NIC will find
the desired link setting.

You can force the setting for both the switch port and host
NIC, but that can create a management nightmare for sure.

I hope this helps.  It's just the way I do things.  Your mileage
may vary. :)

Mark

- - - - - - - - - - - - - -
http://www.altsec.info


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------