Symantec 10268947 User Guide - Page 42

About deploying single 7100 Series appliance nodes, About interface grouping, About in-line mode

Get Symantec 10268947 - Network Security 7160 PDF manuals and user guides
UPC - 037648243766
View all Symantec 10268947 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 42 highlights

42 Getting Started About deploying single nodes simultaneously from the Network Security console. Also, failover groups do not function for single nodes. About deploying single 7100 Series appliance nodes You can deploy a Symantec Network Security 7100 Series node just as you would a Network Security software node. It can operate independently or as part of a cluster. A 7100 Series appliance also has several extra deployment options. You can configure it for interface grouping, in-line mode, and fail-open, in addition to passive monitoring mode. You can also deploy the appliance using a combination of these modes in a way that best suits your network. About interface grouping Interface grouping provides a solution when your network employs asymmetric routing. Asymmetric routing occurs when traffic arrives on one interface and departs on another. Because the request and reply sides of the client/server traffic are on different interfaces, a standard monitoring interface cannot see the full conversation to analyze it properly. With the Symantec Network Security 7100 Series, you can place up to four interfaces into a single group. One sensor is started for the interface group, allowing Symantec Network Security to analyze the different traffic flows as if they were combined on one interface. This is a very effective deployment mode for a network with asymmetric routing. About in-line mode In-line mode is another mode of deployment available only with the Symantec Network Security 7100 Series appliance. In-line mode uses an interface pair to place the appliance directly into the network path. Both interfaces connect to the monitored network segment, effectively separating it into two sides. Incoming packets are fully analyzed before being allowed to continue into the other side of the network. Because of the nature of the connection, it is necessary to interrupt network traffic briefly while you connect the cables to the appliance interfaces. You can configure a policy for an in-line pair that alerts on or blocks malicious traffic. When a malicious packet is detected in alerting mode, the appliance software executes the configured responses, which may be email, Network Security console displays, or other choices available on both appliances and Network Security software nodes. Blocking mode prevents malicious traffic of the designated event types from being transmitted into your protected network. When a blocked TCP/IP event is detected, the node sends TCP resets to both

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
42
Getting Started
About deploying single nodes
simultaneously from the Network Security console. Also, failover groups do not
function for single nodes.
About deploying single 7100 Series appliance nodes
You can deploy a Symantec Network Security 7100 Series node just as you would
a Network Security software node. It can operate independently or as part of a
cluster. A 7100 Series appliance also has several extra deployment options. You
can configure it for interface grouping, in-line mode, and fail-open, in addition
to passive monitoring mode. You can also deploy the appliance using a
combination of these modes in a way that best suits your network.
About interface grouping
Interface grouping provides a solution when your network employs asymmetric
routing. Asymmetric routing occurs when traffic arrives on one interface and
departs on another. Because the request and reply sides of the client/server
traffic are on different interfaces, a standard monitoring interface cannot see
the full conversation to analyze it properly. With the Symantec Network
Security 7100 Series, you can place up to four interfaces into a single group. One
sensor is started for the interface group, allowing Symantec Network Security to
analyze the different traffic flows as if they were combined on one interface.
This is a very effective deployment mode for a network with asymmetric
routing.
About in-line mode
In-line mode is another mode of deployment available only with the Symantec
Network Security 7100 Series appliance. In-line mode uses an interface pair to
place the appliance directly into the network path. Both interfaces connect to
the monitored network segment, effectively separating it into two sides.
Incoming packets are fully analyzed before being allowed to continue into the
other side of the network. Because of the nature of the connection, it is
necessary to interrupt network traffic briefly while you connect the cables to the
appliance interfaces.
You can configure a policy for an in-line pair that alerts on or blocks malicious
traffic. When a malicious packet is detected in alerting mode, the appliance
software executes the configured responses, which may be email, Network
Security console displays, or other choices available on both appliances and
Network Security software nodes. Blocking mode prevents malicious traffic of
the designated event types from being transmitted into your protected network.
When a blocked TCP/IP event is detected, the node sends TCP resets to both