Connecting Sensors To Your Network - Nortel 2050 Installation Manual

Connecting sensors to your network

N TPS 3D S
ORTEL ENSOR AND
Comparing inline and passive interface sets
An interface set is comprised of one or more sensing interfaces on the 3D Sensor.
Each detection engine is assigned to an interface set and uses those interfaces to
monitor the traffic on specific network segments. Interface sets can be one of the
following types:
• passive
• inline
• inline with fail open
If you create an IPS detection engine that uses either type of the inline interface
set, then you can deploy your detection engine inline. This allows you to create
take advantage of drop rules that prevent suspicious traffic from reaching
potentially vulnerable host. You can also use replace rules that substitute
malicious content with a benign alternative. You can also create RNA and RUA
detection engines for inline or inline with fail open interface sets.
A detection engine that uses an inline with fail open interface set has the same
properties as an inline interface set with one exception. You can only use an inline
with fail open interface set with fail-open network interface cards. If a 3D Sensor
with a fail-open card should fail for some reason (power failure, hard drive failure,
and so on), traffic is not blocked by the sensor and your network continues to
function.
There are several ways to connect 3D Sensors to your network. The following
sections outline the supported connection methods.
• "Using a Hub" on page 20
• "Using a span port" on page 21
• "Using a network tap" on page 21
Additionally, "Issues for Copper Cabling" on page 27 explains some of the
guidelines for using straight-through or crossover cables in your deployment.
Using a Hub
An Ethernet hub is an inexpensive way to ensure that the detection engine on a
3D Sensor can see all the traffic on a network segment. Most hubs of this type
take the IP traffic meant for any of the hosts on the segment and broadcast it to all
the devices connected to the hub. Connect the interface set to the hub to monitor
all incoming and outgoing traffic on the segment. Using a hub does not guarantee
D C I
EFENSE ENTER NSTALLATION
Chapter 1: Before you begin
G R 4.7.0
UIDE ELEASE
20
PAGE