| This chapter covers the following subjects: Capturing Network Traffic Capturing Traffic for Inline Mode Capturing Traffic for Promiscuous Mode Configuring SPAN for Catalyst 4500 and 6500 Traffic Capture Configuring RSPAN for Catalyst 4500 and 6500 Traffic Capture Configuring VACLs for Catalyst 6500 Traffic Capture Configuring VACLs for Traffic Capture With Cisco Catalyst 6500 IOS Firewall Advanced Catalyst 6500 Traffic Capture
Effectively using either the IPS or IDS functionality of your Cisco IPS involves making sure that the traffic to be monitored reaches your IPS sensors. This configuration varies depending on whether your sensors are configured for inline processing or promiscuous traffic processing. You can even configure a single sensor to perform inline processing in conjunction with promiscuous processing. Using inline processing involves bridging traffic through the sensor between two separate VLANs. Each VLAN is connected to a separate sensor interface. With promiscuous processing, a single sensor interface passively collects network traffic. Configuring your system for both of these methods is vital to effectively protecting your network with Cisco IPS. "Do I Know This Already?" Quiz The purpose of the "Do I Know This Already?" quiz is to help you decide if you really need to read the entire chapter. If you already intend to read the entire chapter, you do not necessarily need to answer these questions now. The 10-question quiz, derived from the major sections in the "Foundation and Supplemental Topics" portion of the chapter, helps you determine how to spend your limited study time. Table 15-1 outlines the major topics discussed in this chapter and the "Do I Know This Already?" quiz questions that correspond to those topics. Table 15-1. "Do I Know This Already?" Foundation and Supplemental Topics MappingFoundation or Supplemental Topic | Questions Covering This Topic |
|---|
Capturing Traffic for Inline Mode | 1, 8 | Capturing Traffic for Promiscuous Mode | 2, 3, 9 | Configuring SPAN for Catalyst 4500 and 6500 Traffic Capture | 5 | Configuring RSPAN for Catalyst 4500 and 6500 Traffic Capture | | Configuring VACLs for Catalyst 6500 Traffic Capture | 6, 10 | Configuring VACLs for Traffic Capture With Cisco Catalyst 6500 IOS Firewall | 4, 7 | Advanced Catalyst 6500 Traffic Capture | - |
Caution The goal of self-assessment is to gauge your mastery of the topics in this chapter. If you do not know the answer to a question or are only partially sure of the answer, you should mark this question wrong for purposes of the self-assessment. Giving yourself credit for an answer you correctly guess skews your self-assessment results and might provide you with a false sense of security.
| 1. | Operating in inline mode requires how many sensor interfaces? Two One Three One or two None of the above
| | 2. | Which infrastructure device(s) enables your sensor to capture traffic by default? Switch Router Hub Firewall Switch and hub
| | 3. | Which switch capture mechanism enables you to capture traffic from multiple Cisco switches? SPAN RSPAN Network tap VACLs
| | 4. | Which switch capture mechanism requires special consideration when you use IOS Firewall functionality? VACLs SPAN RSPAN SPAN and RSPAN VACLs, SPAN, and RSPAN
| | 5. | Which IOS command enables you to configure SPAN to capture network traffic? set span monitor session switchport trunk switchport span monitor span
| | 6. | Which of the following is not a step in creating VACLs for IOS? Configure an ACL Commit VACL to memory Create a VLAN access map Configure capture ports Apply the access map to VLANs
| | 7. | Which of the following is not a step in creating VACLs when you use IOS Firewall? Configure the extended ACL Assign the capture port Apply ACL to an interface or VLAN Apply the access map to VLANs
| | 8. | Where do you need to create an artificial VLAN boundary to use inline mode? Between devices with virtual switch ports Between a router and a firewall Between a switch and a router Between a switch and a firewall Between two routers
| | 9. | Which switch traffic capture mechanism uses ACLs to specify interesting traffic? SPAN RSPAN VACL SPAN and VACL SPAN, RSPAN, and VACL
| | 10. | Which IOS command specifies the interface to receive the traffic from the VACL? switchport trunk switchport capture set security acl switchport acl set security capture
|
The answers to the "Do I Know This Already?" quiz are found in the appendix. The suggested choices for your next step are as follows: 8 or less overall score Read the entire chapter. This includes the "Foundation and Supplemental Topics" and "Foundation Summary" sections and the Q&A section. 9 or 10 overall score If you want more review on these topics, skip to the "Foundation Summary" section and then go to the Q&A section. Otherwise, move to the next chapter.
| 