McAfee M-1250 Network Protection - Page 12

Determine your high availability strategy, Failover, or High-Availability

Get McAfee M-1250 - Network Security Platform PDF manuals and user guides View all McAfee M-1250 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 12 highlights

CHAPTER 3 Determine your high availability strategy Before you move your McAfee® Network Security Sensor (Sensor) inline, consider the impact of a Sensor outage and its effect on your network. In inline mode, the Sensor does become a single point of failure. McAfee® Network Security Platform provides a variety of options to minimize network downtime in the event of Sensor failure. For example, Sensors support complete stateful failover, delivering the industry's first true highavailability IPS deployment, similar to what you'd find with firewalls. If you're running the Sensor in inline mode, McAfee recommends that you deploy two Sensors redundantly for failover protection. The following deployment options are available: • Failover, or High-Availability. • Fail-open or fail-closed functionality. Fail-open with external hardware. Fail-open with the Layer 2 Passthru (L2) feature Failover, or High-Availability Where redundancy is an essential requirement, it is best practice to implement Network Security Platform 'high-availability' configuration. When running Sensors inline, this option is available to an identical pair of Sensors (same model, software image, signature set) deployed redundantly in inline mode. Both Sensors in the pair are active and share full state, so that the information on both Sensors is always current. Latency is very minimal; than other devices providing failover, such as, firewalls. The keys to the Network Security Platform failover architecture are as follows: Sensors configured for failover confirm a "heartbeat" once each second. Sensors configured for failover share flow information in real time. Sensors are invisible at Layer 2 and above; the monitoring ports do not have MAC addresses. As a result, you do not have to worry about Layer 2 and 3 topology changes when you introduce Network Security Platform failover into the environment, and in the unlikely event of a Sensor failure, failover is instantaneous and connection state is maintained. All Sensor models support failover. This subject is discussed in detail in the document Special Topics Guide-Sensor High Availability. 4

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
C
HAPTER
3
Determine your high availability strategy
Before you move your McAfee
®
Network Security Sensor (Sensor) inline, consider the
impact of a Sensor outage and its effect on your network. In inline mode, the Sensor does
become a single point of failure. McAfee
®
Network Security Platform provides a variety of
options to minimize network downtime in the event of Sensor failure. For example,
Sensors support complete stateful failover, delivering the industry's first true high-
availability IPS deployment, similar to what you’d find with firewalls. If you’re running the
Sensor in inline mode, McAfee recommends that you deploy two Sensors redundantly for
failover protection.
The following deployment options are available:
•
Failover, or High-Availability.
•
Fail-open or fail-closed functionality.
±
Fail-open with external hardware.
±
Fail-open with the Layer 2 Passthru (L2) feature
Failover, or High-Availability
Where redundancy is an essential requirement, it is best practice to implement Network
Security Platform 'high-availability' configuration. When running Sensors inline, this option
is available to an identical pair of Sensors (same model, software image, signature set)
deployed redundantly in inline mode. Both Sensors in the pair are active and share full
state, so that the information on both Sensors is always current. Latency is very minimal;
than other devices providing failover, such as, firewalls.
The keys to the Network Security Platform failover architecture are as follows:
±
Sensors configured for failover confirm a “heartbeat” once each second.
±
Sensors configured for failover share flow information in real time.
±
Sensors are invisible at Layer 2 and above; the monitoring ports do not have MAC
addresses.
As a result, you do not have to worry about Layer 2 and 3 topology changes when you
introduce Network Security Platform failover into the environment, and in the unlikely event
of a Sensor failure, failover is instantaneous and connection state is maintained.
All Sensor models support failover.
This subject is discussed in detail in the document
Special Topics Guide—Sensor High
Availability
.
4