Span Port And Hub Monitoring; High-Availability - McAfee M-1250 - Network Security Platform Deployment Manual

McAfee® Network Security Platform 6.0 Sensor Deployment Modes

SPAN port and hub monitoring

When monitoring a SPAN or hub port, Sensors with internal taps disabled.
Note: McAfee recommends cabling your Fast Ethernet ports with fail-closed dongles
if deploying in SPAN or Hub mode.
In Figure SPAN Port Monitoring which shows an I-4000 Sensor, Port 1A receives data from
the SPAN port of SwitchA. Port 1B gets data from the SPAN port of SwitchB. Two distinct
network links from two separate switches are monitored by the one active I-4000 Sensor
with a 1Gbps rate per link to the Sensor, allowing a total of 2Gbps traffic to the IPS engine.
Figure 10: SPAN Port Monitoring

High-Availability

Redundancy is a key element for any network requiring 24x7 uptime. Using an identical
pair of Sensors (same model, software image, signature set) deployed redundant in In-line
Mode, Network Security Platform can provide high availability with no administrator
intervention.
22