Scenario:
we have 13 floors in our building. All the floors come down into the same switch via gig links. Each floor is an individual subnet vlan. That switch then communicates to other server farm switches via a gig uplink. The problem we want to remedy is how to keep workstations that are infected with Blaster or future variants from "blasting" each from floor-to-floor. By this I mean, if we have infected machines on the 5th floor then they will bombard clients on the other floors. What is the best way to contain this situation? Should I use the IDSM-2 to shun these attacks via dynamic VACLs or should I use NBAR for this situation or even just private vlans?? Of course private vlans will only help on each respective vlan subnet. Also, If I use NBAR (IDSM-2 too??) will it block all good traffic as well? I know with NBAR I Can have it drop traffic altogether which is the ultimate goal. I have read the following SAFE document and it is very good but it still leaves many questions unanswered. There is an NBAR sample config there as well.
we have 13 floors in our building. All the floors come down into the same switch via gig links. Each floor is an individual subnet vlan. That switch then communicates to other server farm switches via a gig uplink. The problem we want to remedy is how to keep workstations that are infected with Blaster or future variants from "blasting" each from floor-to-floor. By this I mean, if we have infected machines on the 5th floor then they will bombard clients on the other floors. What is the best way to contain this situation? Should I use the IDSM-2 to shun these attacks via dynamic VACLs or should I use NBAR for this situation or even just private vlans?? Of course private vlans will only help on each respective vlan subnet. Also, If I use NBAR (IDSM-2 too??) will it block all good traffic as well? I know with NBAR I Can have it drop traffic altogether which is the ultimate goal. I have read the following SAFE document and it is very good but it still leaves many questions unanswered. There is an NBAR sample config there as well.