McAfee IIP-S03K-NA-100I - IntruShield 3000 Sensor Appliance Product Manual page 11

McAfee® IntruShield® IPS 4.1
IntruShield Sensor 3000 Product Guide
1
2
3
4
5
6
7
8
9
The I-3000 does not have internal taps; it must be used with a 3rd party external tap
to run in tapped mode.
Front panel LEDs on the I-3000
The front panel LEDs provide status information for the health of the sensor and the
activity on its ports. The following table describes the I-3000 front panel LEDs.
One 10/100 Management port,
which is used for communication with ISM server. This
port has an assigned IP address.
One RS-232C Console port
, which is used to set up and configure the sensor.
One RS-232C Auxiliary port
, which may be used to dial in remotely to set up and
configure the sensor.
Twelve small form-factor pluggable (SFP) Gigabit Monitoring ports
monitor twelve SPAN ports, six full-duplex tapped segments, six segments in-
line, or a combination (that is, three full-duplex segment, six SPAN ports).
The Monitoring interfaces of the I-3000 work in stealth mode, meaning they
have no IP address and are not visible on the monitored segment.
If you choose to run in failover mode, ports 6A and 6B are used to interconnect
with a standby sensor.
Note: The gigabit ports of the I-3000 running in In-line Mode fail closed,
meaning that if the sensor fails, it will interrupt/block data flow. Fail-open
functionality requires either the Layer 2 Passthru feature, described in detail in
Enabling Layer 2 settings for sensor failure,
or the hardware Fail-Open Bypass kit for Gigabit ports, described in Cabling the
failover interconnection ports section.
Four RJ45 Response ports
, which, when you are operating in SPAN mode, enable
you to inject response packets back through a switch or router.
Four RJ-11 Fail-Open Control ports,
The ports are marked X1, X2, X3, and X4 and are used in conjunction with ports
1A/1B, 2A/2B, 3A/3B, and 4A/4B, respectively. (Fail-open control for ports 5A/5B
and 6A/6B is managed via the Compact Flash port).
One External Compact Flash port.
control optional fail-open hardware as described in the
Bypass Kit Guide
. It is also used in troubleshooting situations where the sensor's
internal flash is corrupted and you must reboot the sensor via the external
compact flash. For more information, see the on-line KnowledgeBase at Mcafee
Support Site. https://mysupport.mcafee.com
Power Supply A
(included). Power supply A is included with each sensor. The
supply uses a standard IEC port (IEC320-C13). The supply uses a standard IEC
port (IEC320-C13). McAfee provides a standard, 2m NEMA 5-15P (US) power
cable (3 wire). International customers must procure a country-appropriate
power cable.
Power Supply B
(optional, purchased separately). Power supply B is a hot-
swappable, redundant power supply. This power supply also uses a standard
IEC320-C13 port, and you can use the McAfee-provided cable or acquire one
that meets your specific needs.
An introduction to IntruShield sensors
Sensor Configuration Guide-using ISM
designed for use the Optical Fail-Open Bypass kit.
This port is used for two purposes. It is used to
3
What is an IntruShield sensor?
, which enable you to
,
Gigabit Optical Fail-Open