Ips Sensor Sub-Interface Node - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1 The IPS Sensor_Name node
Note 2: If you are revoking an interface from child domain (that has been delegated
from the parent domain), with ACL configured, then an error message is displayed.
You will have to delete the ACL first and then revoke the interface.

IPS Sensor sub-interface node

Sub-interface-x
A resource is a node that represents the segmentation of an interface for a
finer grade of monitoring and protection. Sub-interfaces are typically created because you
want to specify a host or network for protection using a policy that best secures that unique
traffic. Policy is applied during sub-interface creation, and this policy can be different from
the policy of the interface. This allows you flexibility in enforcing multiple policies within a
single interface.
Network Security Sensors, placed at network aggregation points, are intelligent enough to
see into the traffic and separate the specified VLAN or CIDR IDs within your uplinks. Each
of these traffic types are commonly used in enterprises to segment data for individual
hosts or groups within the organization.
Figure 229: Sub-Interface Example
Figure Sub-Interface Example illustrates a scenario where sub-interfaces can be deployed to
protect traffic subflows. In the example, a Network Security Sensor tap-monitors the uplink
between a router and a switch. Beyond the switch is a network of three Solaris servers and
five Windows workstations. The three servers (A, B, or C) require a policy separate from
the rest of the traffic on the uplink. The network address is 192.168.0.0/24 and the server
addresses are as follows: A is 192.168.0.1/32, B is 192.168.0.2/32, and C is
192.168.0.3/32. With your interface traffic type set to CIDR, you add the addresses for
servers A, B, and C. You can now create a sub-interface made up of the three CIDR
Solaris Server
addresses and apply a policy specific to Solaris server traffic, such as the
policy. The rest of the traffic is protected by the policy of the interface monitoring the
uplink. Since the rest of the machines beyond the switch are Windows based, its probably
Windows Server
best to use the policy.
Note: For more on policies, see Configuring and managing policies (on page 7).
234