A company is deploying a Cisco Secure IPS device configured in inline mode with a single Interface set that contains four interface pairs. Which two configurations must be implemented to allow the IPS

Question

Options

• ASet the source SPAN ports to tx only on the switches connected to the IPS interfaces
• BModify the security zones used by the Cisco Secure IPS device
• CChange the MTU for the inline set to at least 1518
• DReconfigure access rules to drop all but the first occurrence of the packet
• EReassign the interface pairs to separate inline sets

• A
  2% (1)
• B
  74% (31)
• C
  7% (3)
• D
  17% (7)

Explanation

When multiple interface pairs are grouped into a single inline set, the Cisco Secure IPS may see the same traffic flow on more than one interface pair (e.g., due to asymmetric routing or mirroring), causing duplicate event reporting and false positives. Reassigning interface pairs to separate inline sets (E) allows the IPS to treat each pair as an independent traffic stream, correctly identifying unique flows per set. Modifying the security zones (B) used by the IPS device ensures that traffic from different network segments is correctly differentiated by zone, enabling accurate policy matching and flow identification. Setting SPAN ports to tx only (A) is a switch-side workaround that does not solve the IPS configuration issue. Changing the MTU (C) and dropping duplicate packets via access rules (D) do not address the root cause of flow identification across multiple interface pairs.

No community discussion yet for this question.