Modos de Despliegue de los

Sensores

Modo Promiscuo

Inline interface pair mode

Inline VLAN pair mode

Inline VLAN group mode

Selective inline analysis mode

Despliegue de Sensores en Modo

Promiscuo
El modo de implementacin ms simple para los sensores IPS de Cisco es
tpicamente el modo promiscuo. Los paquetes en modo promiscuo no fluyen a
travs del sensor Cisco IPS. El sensor recibe una copia del trfico de red y analiza la
copia de los paquetes recibidos para determinar si contienen signos de actividad
sospechosa o maliciosa. Adems de ser simple de implementar, normalmente no
afecta el rendimiento de la red porque el sensor slo recibe una copia del trfico.
En este modo de implementacin es necesario conectar el sensor a un switch, y
configurar en este una sesin de monitoreo:
Ejemplo 1: Copiamos todo el trfico de una interface a otra

Configuracin de SPAN en el switch MLS

monitor session 1 source interface Fa1/0
monitor session 1 destination interface Fa1/2
Configuracin de VSPAN en el switch MLS
Adicionalmente, en caso de tener mltiples VLANs, podemos reenviar al puerto
destino las cabeceras 802.1q para indicarle la VLAN de origen del trfico al sensor.
monitor session 10 source vlan 11,12 rx

monitor session 10 destination fa1/2 encapsulation replicate

Flow-Based SPAN (FSPAN) esta opcin nos permite limitar la captura de trfico
especfico usando ACLs

ip access-list standard Capture_ACL

permit ip any host 10.1.1.1
permit ip host 10.1.1.1 any
!
monitor session 1 source vlan 11, 12 rx
monitor session 1 destination GigabitEthernet 0/40 ingress
monitor session 1 filter ip access-group Capture_ACL

Despliegue de Sensores en Modo Inline

Interface Pair

Todos los sensores IPS de Cisco, cuando se implementan en modo en lnea, actan
como dispositivos de reenvo de trfico. Uno de los modos ms simples y ms
comnmente desplegado es el modo Inline Interface Pair. En este modo, el
sensor utiliza un par de interfaces de red para interconectar redes fsicas o lgicas
(VLAN) y acta esencialmente como un cable entre dos segmentos de red. Todo el
trfico IPv4 e IPv6 que se reenva a travs del par de interfaces es inspeccionado
por el sensor.
Los principales beneficios
Mejora de la proteccin con la capacidad de modificar el trfico en tiempo real
(tambin conocido como normalizacin) para eliminar las caractersticas del trfico
malicioso y las anomalas
Amplias respuestas preventivas disponibles con el sensor en el modo de reenvo
de trfico (descarte de paquetes sospechosos o maliciosos, bloqueo de una fuente o
destino de trfico y restablecimientos TCP confiables)
Sobreescripcin del sensor que no da lugar a falsos negativos (el rendimiento de
la red puede verse afectado)
Las limitaciones incluyen lo siguiente:
Impacto en el rendimiento de la red (especialmente si no est correctamente
dimensionado)
Impacto en la confiabilidad de la red al fallar el sensor (si no se proporciona
redundancia de ruta o dispositivo
Connecting two physically separate networks or infrastructures

Connecting two vlans

Deploying Sensors in Inline VLAN Pair

Mode
Another inline deployment mode commonly used by administrators, enterprises,
and operators is known as inline VLAN pair mode. In this mode, the sensor acts as
an 802.11q trunk port and also acts as a wire, performing VLAN translation
between pairs of VLANs on this trunk interface/port. All traffic is inspected as it is
received on each VLAN in each pair, and then can either forward the packets on the
other VLAN in the pair or drop the packet if an intrusion attempt is detected. The
sensor replaces the VLAN ID in the 802.1q header of each received packet with the
ID of the egress VLAN on which the sensor forwards the packet. All packets are
dropped if they are received on any VLANs that arent assigned to the inline pair(s).
Traffic can only use up to half the bandwidth made available by the trunk interface
fundamentally because all packets cross the trunk interface twice (inbound and
outbound over the same physical sensor interface).

Inline VLAN pair mode has the following features:

Support for up to 255 different VLAN pairs: The Cisco IPS sensor can be
configured to simultaneously bridge up to 255 VLAN pairs on each sensing interface
and the Cisco IDSM-2 Catalyst switch blade to bridge up to 255 VLAN pairs total.
Interface shutdown on software failure: The Cisco IPS sensor has the ability to
shut down network interfaces on Cisco IPS Software failure and reroute traffic over
redundant links or paths.

Deploying Sensors in Inline VLAN Group

Mode
A commonly deployed inline mode, where a pair of sensing interfaces can be
selectively divided or virtualized into multiple logical wires, is known as inline
VLAN group mode. In this mode, each logical wire or instance can be analyzed
separately. Each physical interface in this mode can be divided into VLAN group
subinterfaces, which consist of a group of VLANs on that physical interface or port.
Cisco IPS sensors and modules support multiple virtual sensors on their analysis
engines (the exact number supported varies by model and licenses purchased; see
the datasheets available on Cisco.com). These virtual sensors can monitor traffic on
one or more of these VLAN groups or subinterfaces simultaneously or separately.
This gives an administrator the flexibility to apply multiple policies to the same
sensor. This mode of inline deployment is often advantageous for enterprises or
providers, because it allows them to use a sensor with a fewinterfaces as if it
hadmany interfaces and gives them the ability to apply granular policies on
trunked interfaces.

Inline VLAN group mode has the following features:

Support for up to 255 VLAN groups per interface pair: The Cisco IPS sensor can
be configured to identify each VLAN group subinterface by using a number between
1 and 255. Subinterface 0 is a reserved subinterface number used to represent the
entire unvirtualized physical or logical interface. Subinterface 0 cannot be created,
deleted, or modified, and no statistics are reported for it.
Support for unassigned VLAN groups: The Cisco IPS sensor supports an
unassigned VLAN group that contains all VLANs that are not specifically assigned to
another VLAN group. These VLANs cant be specified directly, but when VLANs are
added or deleted from another VLAN group subinterface, the unassigned group is
updated accordingly.
Support for native VLANs: The Cisco IPS sensor supports packets of the native
VLAN being associated with a particular VLAN group if interesting traffic is
forwarded from this VLAN. Typically packets in the native VLAN of an 802.1q trunk
do not have 802.1q encapsulation headers to identify the VLAN number to which
the packets belong. Default VLAN variables are associated with each physical
interface. Cisco recommends setting these variables to the VLAN number of the
native VLAN or to 0.
Interfaces can either be part of inline VLAN groups or pairs, but not both: The
Cisco IPS sensor with an interface part of inline VLAN pairs cannot be used for VLAN
groups.