Question for anyone who's tried the RSP Snort package:
As per the documentation, it is monitoring traffic to/from the LAN/WAN, and is installed on the WAN-side of the RiOS. Can the package be used to sniff the LAN via a SPAN/monitor port on a switch connected to the AUX on the Steelhead?
What I'm thinking is we have Cascade Sensor-VE RSPs on most of our sites, and I'd like to leverage the Snort RSP for IDS/IPS on the local LAN. Since the Sensor-VE is reading the core switch SPAN port, if I can make the Snort package use that port for the LAN interface, I should be able to monitor all LAN traffic (not just traffic destined for the WAN), correct?
Thanks for any advice/info anyone can give me.
LouisP
