Consider a typical network where many access switches connect to a few distribution switches as shown partly in the figure below. To monitor inter-VLAN traffic, you can place a Sensor inline for every trunk link between the access switches and the distribution switch. However, this would mean deploying a large number of Sensor port pairs (one for every trunk link between the access and distribution switches) and hence, may require a large number of Sensors.
.png "GUID-E2D28DE8-DA77-4C42-AB28-F70B1358E272-low.png")
An alternative and cost-effective solution for this scenario would be to monitor the aggregated traffic at the distribution switch as shown in the figure below.
.png "GUID-F48AE648-AC5E-4451-BD2A-BF575D8AAEDE-low.png")
With this method, the same volume of traffic can be monitored with less number of Sensors, provided that the aggregate traffic at the Distribution switch monitored by the Sensor does not exceed the Sensor throughput. This solution requires the following: the VLANs on the access switches and the distribution switch must be configured in such a way that all traffic that is to be subjected to IPS is forwarded to the Sensor before being switched or routed. Then the Sensor inspects and bridges the traffic using VLAN Bridging. Effectively, traffic from the access switches is switched or routed only after VLAN bridging by the Sensor.
Additionally, if you have multiple Sensors (or Sensor interfaces) connected to the distribution switch, then you can configure Ether Channel Load Balancing (ECLB) on the switch so that the traffic is split across the Sensors or Sensor ports for optimal utilization of your IPS infrastructure. This section does not have information on how to configure your switches for ECLB. Refer to the documentation provided with your switch.