Adding an IPS for protecting traffic between server vlans and workstation vlans
Posted on 2010-03-26
Here is our environment:
I have 2 x 3550 (48 ports, EMI) working as a pair of core switch. There are 3 x 2950 working as access layer switch. Each 2950 (24 ports) is connected to both 3550 with STP enabled.
The (host) names of the switches are C3550A, C3550B, C2950A, C2950B and C2950C.
C2950A FastEthernet0/23 is connected to C3550A
C2950A FastEthernet0/24 is connected to C3550B
C2950B FastEthernet0/23 is connected to C3550A
C2950B FastEthernet0/24 is connected to C3550B
C2950C FastEthernet0/23 is connected to C3550A
C2950C FastEthernet0/24 is connected to C3550B
Workstation farm has 3 VLANs, they are VLAN 110, 120 and 130. Basically, all remaining ports in C2950A are VLAN 110. Likewise all remaining ports in C2950B are VLAN 120 and all remaining ports in C2950C are VLAN 130.
Server farm has 2 VLANs, they are VLAN 210 and 220. Servers in server farm has 2 NICs each, one connecting to C3550A and the other connecting to C3550B.
My problem is, if I need to add an in-line mode IPS protecting all traffic from workstation farm to server farm (and from server farm to workstation farm), how should I config the switches to let the traffic between server vlans and workstation vlans are being inspected by an in-line mode IPS?