This article explains how to configure and apply the IDS inspection rules selectively to segments and exclude specific VMs from IDS inspection. This approach ensures that only the desired VMs are inspected by the IDS rules, while others are excluded from inspection.
Procedure:
Assign Tags to Segments:
Suppose you have two segments, Segment A
and Segment B
. Apply the same tag (e.g., Tag: IDS, Scope: segment) to both segments. This ensures that these segments will be subject to IDS inspection by default.
Tag VMs/Segment Ports to Exclude from IDS:
Next, identify any VMs or segment ports that do not require IDS inspection. For example, if UPSA-B
does not need IDS inspection, tag it as Tag: IDS, Scope: Notneeded. This ensures that UPSA-B
is excluded from the IDS inspection.
Create a Group for IDS Inspection:
Create a group (e.g., GroupforIDS
) to include the VMs that should undergo IDS inspection. Configure the group with the following criteria:
Verify Exclusion of IP Address:
After configuring the group, ensure that the IP of UPSA-B
is excluded from the group. This ensures that this VM will not be subjected to IDS rules. You can check the membership and configuration by inspecting the group settings.
Verify DFW apply to and IDS Rules do NOT apply to UPSA-B
The DFW rules will apply to UPSA-B
, but the IDS rules will not. You can verify this by running the following command to check if the rules are applied to UPSA-B
:
Additionally, check the rules for the specific VM:
The output should indicate the DFW rules without showing IDS rules for UPSA-B
.