0

So we are wanting to deploy an IDS device to capture EAST-WEST traffic in a LAN.

The actual topology is more complicated but our issue boils down to this: enter image description here

We are attempting to configure SPAN sessions from the many VLANS to the ports connected to the IDS.

However, to prevent the IDS from receiving multiple packets for the same traffic, we attempted to configure the two links in vPC (virtual port channel), which, I think, would ensure the traffic isn't being duplicated twice from the two switches.

However, the IDS solution does not support link aggregation of any kind, so teaming the NICs to allow for vPC does not work.

Is there any other solution to configuring redundant SPAN sessions?

These are Cisco Switches and a FireEye NX (IDS/IPS).

Improve this question
3
  • 2
    You could configure RSPAN with two different RSPAN VLANs, then SPAN some VLANs to one RSPAN VLAN and the others to the other RSPAN VLAN, then simply have the IDS connect to the first RSPAN VLAN on Switch 1, and the second RSPAN VLAN on Switch 2.
    – Ron Maupin ♦
    Nov 16, 2020 at 23:15
  • 1
    Depends on the exact switch (and fw version). I don't see how vPC will make any difference if you have vlan 100 being dumped into the span from two switches. All you could hope to do is exclude the interfaces linking the switches.
    – Ricky
    Nov 17, 2020 at 1:37
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 16, 2020 at 23:37

2 Answers 2

Reset to default
2

You can configure a vPC EtherChannel facing the IDS in on mode (channel-group 1 mode on) as opposed to active mode. This mode doesn't require participation of the IDS to form a LAG; it doesn't need to support LACP to receive mirrored traffic.

For more information, see the Nexus 5000 vPC design guide https://www.cisco.com/c/en/us/products/collateral/switches/nexus-5000-series-switches/design_guide_c07-625857.html

Improve this answer
-1

vPC or LAG (between the switches) doesn't solve your problem.

If you want to exclude all traffic between the switches, simply exclude the cross ports (or LAG) from monitoring. The traffic they carry has already been mirrored from another port.

If you mirror all ports on a switch you'll capture each frame twice - on ingress and on egress. So, you can safely exclude the ports that carry transit traffic only (between monitored switches). Also, you should mirror traffic ingress-only or egress-only. For IDS, I'd go for ingress-only so it'd include attacks on the switches themselves.

Towards the IDS appliance, you shouldn't use vPC or LAG since that might distort detection - frames from the "wrong" interface could be ignored.

In any case, vPC doesn't help one bit with removing duplicate frames - they'd need to be detected first which simply doesn't happen. Matching duplicate frames would require significant work (at least compute n frame hashes and compare n² hashes for n frames), so avoiding duplicates in the first place should be your aim.

Improve this answer
2
  • There are different ways to do this, but vPC does solve the OP's problem. I suggest you read the vPC design guide linked in my answer. The key feature here is a frame received from the vPC peer won't be forwarded out a vPC port. That property causes the de-duplication the OP requires. The term you use, detection, isn't really applicable, and the description of that you include in your answer is AFAIK not what any real-world device does; yet traffic de-dup for analysis/monitoring is a common design feature of many devices.
    – Jeff Wheeler
    Nov 17, 2020 at 15:17
  • @JeffWheeler That guide lists "(vPC) member ports must [...] not be SPAN ports" which I was talking about. However, mirroring frames on all edge ports does duplicate everything in spite of vPC - for ingress and egress each. Please re-read and re-think. ;-)
    – Zac67 ♦
    Nov 17, 2020 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.