McAfee M4050 Troubleshooting Guide - Page 23

CHAPTER 4 Troubleshooting Network Security Platform This section lists some troubleshooting tips for McAfee® Network Security Platform. Facilitating troubleshooting When an in-line device experiences problems, most people's instinct is to physically pull it out of the path; to disconnect the cables and let traffic flow unimpeded while the device can be examined elsewhere. McAfee recommends you first try the following techniques to troubleshoot a McAfee® Network Security Sensor (Sensor) issue:  All Sensors have a Layer2 Passthru feature. If you feel your Sensor is causing network disruption, before you remove it from the network, issue the following command: layer2 mode assert This pushes the Sensor into Layer2 Passthru (L2) mode, causing traffic to flow through the Sensor while bypassing the detection engine. Check to see whether your services are still affected; if they are, then you have eliminated certain Sensor hardware issues; the problem could instead be a network issue or a configuration issue. (The layer2 mode deassert command pushes the Sensor back to detection mode.)  McAfee recommends that you configure Layer2 Passthru Mode on each Sensor. This enables you to set a threshold on the Sensor that pushes the Sensor into L2 bypass mode if the Sensor experiences a specified number of errors within a specified timeframe. Traffic then continues to flow directly through the Sensor without passing to the detection engine.  Connect a fail-open kit, which consists of a bypass switch and a controller, to any GE monitoring port pairs on the Sensor. If a kit is attached to the Sensor, disabling the Sensor ports forces traffic to flow through the bypass switch, effectively pulling the Sensor out of the path. For FE monitoring ports, there is no need for the external kit. Sensors with FE ports contain an internal tap; disabling the ports will send traffic through the internal tap, providing fail-open functionality. Caution 1: Note that the Sensor will need to reboot to move out of L2 mode only if the Sensor entered L2 mode because of internal errors. (It does not need a reboot if the layer2 mode assert command was used to put the Sensor into L2 mode). Caution 2: A Sensor reboot breaks the link connecting the devices on either side of the Sensor and requires the renegotiation of the network link between the two devices surrounding the Sensor. Caution 3: Depending on the network equipment, this disruption should range from a couple of seconds to more than a minute with certain vendors' devices. A very brief link disruption might occur while the links are renegotiated to place the Sensor back in in-line mode. 14