Cisco IPS-4260-K9 - IPS Sensor 4260 Manuel utilisateur

CHAPTER

6-1

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Installing IPS-4260

This chapter describes IPS-4260 and how to install it. It also describes the accessories and how to install

them. This chapter contains the following sections:

•Introducing IPS-4260, page 6-1

•Supported PCI Cards, page 6-2

•Hardware Bypass, page 6-3

•Front and Back Panel Features, page 6-5

•Specifications, page 6-8

•Accessories, page 6-8

•Rack Mounting, page 6-9

•Installing IPS-4260, page 6-14

•Removing and Replacing the Chassis Cover, page 6-17

•Installing and Removing PCI Cards, page 6-19

•Installing and Removing the Power Supply, page 6-21

Caution The BIOS on IPS-4260 is specific to IPS-4260 and must only be upgraded under instructions from Cisco

with BIOS files obtained from the Cisco website. Installing a non-Cisco or third-party BIOS on

IPS-4260 voids the warranty. For more information on how to obtain instructions and BIOS files from

the Cisco website, see Obtaining Cisco IPS Software, page 11-1.

Introducing IPS-4260

IPS-4260 delivers 1 Gigabit of intrusion prevention performance. You can use IPS-4260 to protect both

Gigabit subnets and aggregated traffic traversing switches from multiple subnets. IPS-4260 is a

purpose-built device that provides support for both copper and fiber NIC environments providing

flexibility of deployment in any environment.

6-2

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Supported PCI Cards

IPS-4260 has two built-in Gigabit Ethernet network ports and six expansion slots. The network port

numbers increase from right to left and the expansion slot numbers increase from bottom to top and from

right to left as shown in Figure 6-4 on page 6-6. Slots 2 and 3 are PCI-Express connectors and the other

expansion slots are PCI-X slots. Slots 1 through 3 are full-height slots and slots 4 though 6 are

half-height slots. The built-in management port is called Management0/0 and the built-in sensing

interface is Gigabit-Ethernet0/1. For more information on sensor interfaces, see Sensor Interfaces,

page 1-3.

Note Only expansion slots 2 and 3 are supported at this time.

For improved reliability, IPS-4260 uses a flash device for storage rather than a hard-disk drive. IPS-4260

supports two optional network interface cards, the 2SX Fiber card, and the 4GE bypass interface card

that contains the hardware-bypass feature. Initially IPS-4260 supports only the built-in interfaces and

these two interface cards. For more information on the 4GE bypass interface card, see Hardware Bypass,

page 6-3.

IPS-4260 monitors greater than 1 Gbps of aggregate network traffic on multiple sensing interfaces and

is also inline ready. It replaces IDS-4250-XL. It supports both copper and fiber interfaces.

Note The 1-Gbps performance for IPS-4260 is based on the following conditions: 10,000 new TCP

connections per second, 100,000 HTTP transactions per second, average packet size of 450 bytes, and

the system running Cisco IPS 5.1 software. The 1-Gbps performance is traffic combined from all sensing

interfaces.

IPS-4260 ships with one power supply, but it supports redundant power supplies. For more information,

see Installing and Removing the Power Supply, page 6-21.

Note IPS-4260 operates in load-sharing mode when the optional redundant power supply is installed.

Supported PCI Cards

IPS-4260 supports the following PCI cards:

•4GE bypass interface card (part number IPS-4GE-BP-INT=)

Provides four 10/100/1000BASE-T (4GE) monitoring interfaces (allowing up to 9 total monitoring

interfaces). The 4GE bypass interface card support hardware bypass.

6-3

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Hardware Bypass

Figure 6-1 shows the 4GE bypass interface card.

Figure 6-1 4GE Bypass Interface Card

•2SX Card (part number IPS-2SX-INT=)

Provides two 1000BASE-SX (fiber) monitoring interfaces (allowing up to 4 total fiber monitoring

interfaces). The 2SX interface cards does not support hardware bypass.

Figure 6-2 shows the 2SX card.

Figure 6-2 2SX Interface Card

Hardware Bypass

This section describes the 4GE bypass interface card and its configuration restrictions. For the procedure

for installing and removing the 4GE bypass interface card, see Installing and Removing PCI Cards,

page 6-19.

This section contains the following topics:

•4GE Bypass Interface card, page 6-4

•Hardware Bypass Configuration Restrictions, page 6-4

153325

190474

6-4

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Hardware Bypass

4GE Bypass Interface card

IPS-4260 supports the 4-port GigabitEthernet card (part number IPS-4GE-BP-INT=) with hardware

bypass. This 4GE bypass interface card supports hardware bypass only between ports 0 and 1 and

between ports 2 and 3. Figure 6-1 on page 6-3 shows the 4GE bypass interface card.

Hardware bypass complements the existing software bypass feature in IPS 5.1. For more information on

software bypass mode, refer to Configuring Bypass Mode. The following conditions apply to hardware

bypass and software bypass on IPS-4260:

•When bypass is set to OFF, software bypass is not active.

For each inline interface for which hardware bypass is available, the component interfaces are set to

disable the fail-open capability. If SensorApp fails, the sensor is powered off, reset, or if the NIC

interface drivers fail or are unloaded, the paired interfaces enter the fail-closed state (no traffic flows

through inline interface or inline VLAN subinterfaces).

•When bypass is set to ON, software bypass is active.

Software bypass forwards packets between the paired physical interfaces in each inline interface and

between the paired VLANs in each inline VLAN subinterface. For each inline interface on which

hardware bypass is available, the component interfaces are set to standby mode. If the sensor is

powered off, reset, or if the NIC interfaces fail or are unloaded, those paired interfaces enter

fail-open state in hardware (traffic flows unimpeded through inline interface). Any other inline

interfaces enter fail-closed state.

•When bypass is set to AUTO (traffic flows without inspection), software bypass is activated if

sensorApp fails.

For each inline interface on which hardware bypass is available, the component interfaces are set to

standby mode. If the sensor is powered off, reset, or if the NIC interfaces fail or are unloaded, those

paired interfaces enter fail-open state in hardware. Any other inline interfaces enter the fail-closed

state.

Note To test fail-over, set the bypass mode to ON or AUTO, create one or more inline interfaces and power

down the sensor and verify that traffic still flows through the inline path.

Hardware Bypass Configuration Restrictions

To use the hardware bypass feature on the 4GE bypass interface card, you must pair interfaces to support

the hardware design of the card. If you create an inline interface that pairs a hardware-bypass-capable

interface with an interface that violates one or more of the hardware-bypass configuration restrictions,

hardware bypass is deactivated on the inline interface and you receive a warning message similar to the

following:

Hardware bypass functionality is not available on Inline-interface pair0.

Physical-interface GigabitEthernet2/0 is capable of performing hardware bypass only when

paired with GigabitEthernet2/1, and both interfaces are enabled and configured with the

same speed and duplex settings.

6-5

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Front and Back Panel Features

The following configuration restrictions apply to hardware bypass:

•The 4-port bypass card is only supported on IPS-4260.

•Fail-open hardware bypass only works on inline interfaces (interface pairs), not on inline VLAN

pairs.

•Fail-open hardware bypass is available on an inline interface if all of the following conditions are

met:

–

Both of the physical interfaces support hardware bypass.

–

Both of the physical interfaces are on the same interface card.

–

The two physical interfaces are associated in hardware as a bypass pair.

–

The speed and duplex settings are identical on the physical interfaces.

–

Both of the interfaces are administratively enabled.

•Autonegotiation must be set on MDI/X switch ports connected to IPS-4260.

You must configure both the sensor ports and the switch ports for autonegotiation for hardware

bypass to work. The switch ports must support MDI/X, which automatically reverses the transmit

and receive lines if necessary to correct any cabling problems. The sensor is only guaranteed to

operate correctly with the switch if both of them are configured for identical speed and duplex,

which means that the sensor must be set for autonegotiation too.

Front and Back Panel Features

This section describes the IPS-4260 front and back panel features and indicators.

Figure 6-3 shows the front view of IPS-4260.

Figure 6-3 IPS-4260 Front Panel Features

There are three switches on the front panel of IPS-4260:

•Power—Toggles the system power.

•Reset—Resets the system.

•ID—Toggles the system ID indicator.

Cisco IPS 4260 series

Intrusion Prevention Sensor

POWER STATUSFLASH

ID NIC

Power

Flash

Status

NIC

RESET

153095

POWER

RESET

6-6

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Front and Back Panel Features

Table 6-1 describes the front panel indicators on IPS-4260.

Figure 6-4 shows the back view of the IPS-4260.

Figure 6-4 IPS-4260 Back Panel Features

Table 6-1 Front Panel Indicators

Indicator Description

ID (blue) Continuously lit when activated by the front panel ID switch.

NIC (green) Indicates activity on either the GigabitEthernetO/1 or MGMT interfaces.

Power (green) When continuously lit, indicates DC power. The indicator is off when power is

turned off or the power source is disrupted.

Flash (green/amber) Off when the compact flash device is not being accessed. Blinks green when the

compact flash device is being accessed. Solid amber when a device has failed.

Status (green/amber) Blinks green while the power-up diagnostics are running or the system is

booting. Solid green when the system has passed power-up diagnostics. Solid

amber when the power-up diagnostics have failed.

153094

USB ports

(not used)

Mouse

connector

(not supported)

Keyboard

connector

(not supported)

Sensing interface

expansion slots

Video

connector

(

not su

orted

)

Power

connector

Indicator

light

Power

supply 2

Power

supply 1

GE 0/1CONSOLE MGMT

Console

port

Management

0/0

Gigabit

Ethernet 0/1

6-7

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Front and Back Panel Features

Figure 6-5 shows the two built-in Ethernet ports, which have two indicators per port.

Figure 6-5 Ethernet Port Indicators

Table 6-2 lists the back panel indicators.

Table 6-3 lists the power supply indicator.

153308

SPD indicator Link/ACT indicator

GE 0/1CONSOLE MGMT

SPD LNK SPD LNK

SPD indicator

"SPD" Link/ACT indicator

"LINK"

Diagnostic

indicators

(for TAC use)

System ID

indicator

Status

indicator

Table 6-2 Back Panel Indicators

Indicator Color Description

Left side Green solid

Green blinking

Physical link

Network activity

Right side Not lit

Green

Amber

10 Mbps

100 Mbps

1000 Mbps

Table 6-3 Power Supply Indicators

Color Description

Off No AC power to all power supplies.

Green solid Output on and ok.

Green blinking AC present, only 5Vsb on (power supply off).

Amber No AC power to this power supply (for 1+1 configuration)

power supply critical event causing a shutdown: failure, fuse blown (1+1

only), OCP 12 V, OVP 12 V, or fan failed.

Amber blinking Power supply warning events where the power supply continues to operate:

high temperature, high power/high current, or slow fan.

6-8

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Specifications

Table 6-4 lists the specifications for IPS-4260.

Accessories

Warning

IMPORTANT SAFETY INSTRUCTIONS

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you

work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar

with standard practices for preventing accidents. Use the statement number provided at the end of

each warning to locate its translation in the translated safety warnings that accompanied this device.

Statement 1071

SAVE THESE INSTRUCTIONS

Table 6-4 IPS-4260 Specifications

Dimensions and Weight

Height 3.45 in. (87.6 cm)

Width 17.14 in. (435.3 cm)

Depth 20 in. (508 cm)

Weight 40.0 lb (18.14 kg)

Form factor 2 RU, standard 19-inch rack-mountable

Power

Autoswitching 100V to 240V AC

Frequency 47 to 63 Hz, single phase

Operating current 8.9 A

Steady state 588 W max continuous

Maximum peak 657 W

Maximum heat dissipation 648 BTU/hr

Environment

Temperature Operating +32°F to +104°F (+0°C to +40°C)

Nonoperating -104°F to +158°F (-40°C to +70°C)

Relative humidity Operating 10% to 85% (noncondensing)

Nonoperating 5% to 95% (noncondensing)

Altitude Operating 0 to 9843 ft (3000 m)

Nonoperating 0 to 15,000 ft (4750 m)

Shock Operating Half-sine 2 G, 11 ms pulse, 100 pulses

Nonoperating 25 G, 170 inches/sec delta V

Vibration 2.2 Grms, 10 minutes per axis on all three axes

6-9

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Rack Mounting

Warning

Only trained and qualified personnel should be allowed to install, replace, or service this equipment.

Statement 1030

IPS-4260 accessories kit contains the following:

•DB25 connector

•DB9 connector

•Rack mounting kit—screws, washers, and metal bracket

•RJ45 console cable

•Two 6-ft Ethernet cables

Rack Mounting

You can rack mount IPS-4260 in a 2- or 4-post rack. This section describes how to rack mount IPS-4260

and contains the following topics:

•Installing IPS-4260 in a 4-Post Rack, page 6-9

•Installing IPS-4260 in a 2-Post Rack, page 6-12

Installing IPS-4260 in a 4-Post Rack

To rack mount IPS-4260 in a 4-post rack, follow these steps:

Step 1 Attach each inner rail to each side of the chassis with three 8-32x1/4” SEMS screws.

153314

Cisco IPS 4260 series

IntrusionPreventionSensor

POWER STATUS

FLASH

ID NIC

RESET

6-10

Installing Cisco Intrusion Prevention System Appliances and Modules 5.1

OL-8677-01

Chapter 6 Installing IPS-4260

Rack Mounting

Step 2 Attach the front-tab mounting bracket to the chassis with two 8-32x1/4’ SEMS screws. You can flip the

bracket to push the system forward in the rack.

Step 3 Using the four inner studs, install the mounting brackets to the outer rail with four 8-32 KEPS nuts. Insert

four thread covers over the four outer studs on each side.

153315

Cisco IPS 4260 series

IntrusionPreventionSensor

POWER STATUS

FLASH

ID NIC

RESET

153316

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Matériel réseau

Cisco

Cisco FPR1150-ASA-K9 Manuel

Cisco

Cisco Catalyst 2960-XR Manuel utilisateur

Cisco

Cisco NCS 6008 LCC Mode d’emploi

Cisco

Cisco ESR-PRE2 Manuel utilisateur

Cisco

Cisco GS7000 Mode d'emploi

Cisco

Cisco 3600 Series Instructions d'utilisation et de sécurité

Cisco

Cisco Firepower 1010 Manuel utilisateur

Cisco

Cisco ISE - Line Card ISE Manuel utilisateur

Cisco

Cisco CE 2000 Platform SCE 2000 4xGBE Manuel de l'opérateur

Cisco

Cisco Versatile Interface Processor (VIP6-80)... Manuel de l'opérateur

Cisco

Cisco MultiRIP Ethernet Card Manuel utilisateur

Cisco

Cisco MERAKI MR57 Manuel utilisateur

Cisco

Cisco ONS 15327 Manuel de l'opérateur

Cisco

Cisco Aironet 340 Series Manuel utilisateur

Cisco

Cisco MXE 3000 Manuel

Cisco

Cisco Firepower 1010 FPR1010-NGFW-K9 Manuel

Cisco

Cisco TelePresence Manuel de service

Cisco

Cisco GS7000 Manuel utilisateur

Cisco

Cisco 8540 - Catalyst Campus Switch Router Modular Expansion... Manuel utilisateur

Cisco

Cisco AIM-VPN - DES/3DES VPN Data Encryption AIM... Manuel utilisateur

Cisco

Cisco ONS 15454 SDH E1-75 Manuel utilisateur

Cisco

Cisco CVPN3015-NR - VPN Concentrator 3015 Manuel utilisateur

Cisco

Cisco ASR 9000 Series Manuel utilisateur

Cisco

Cisco ONS 15454 DWDM Manuel utilisateur

Manuels Matériel réseau populaires d'autres marques

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuel utilisateur

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuel utilisateur

Yudor

Yudor YDS-16 Manuel utilisateur

D-Link

D-Link ShareCenter DNS-320L Manuel utilisateur

Samsung

Samsung ES1642dc Instructions d'utilisation

Honeywell Home

Honeywell Home LTEM-PV Instructions de montage

evertz

evertz 7700 Series Manuel utilisateur

D-Link

D-Link ShareCenter DNS-343 Manuel utilisateur

Asante

Asante AsanteBridge 1012 Manuel utilisateur

FireBrick

FireBrick FB2700 Manuel utilisateur

Audiovox Electronics

Audiovox Electronics ARWH2T Manuel utilisateur

ADC

ADC DSX-1 Manuel

NetComm

NetComm NF2 Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 5620 Manuel utilisateur

Dell EMC

Dell EMC XC6420 Series Manuel utilisateur

Lanner

Lanner NCA-1020A Manuel utilisateur

Allied Telesis

Allied Telesis AT-TN121-A Manuel utilisateur

Arista

Arista CCA-ETM-Q12 Manuel utilisateur