Broadcom Symantec S550, Installation Manual

Page: 15 / 49

Symantec
™
Endpoint Detection and Response 4.5 Installation Guide for the S550
appliance
Network configuration Description
Connect
Management to
Connect WAN to Connect LAN to
Inline with two firewalls,
two proxies, and two
appliances
You can connect two
appliances to two
firewalls as part of a high-
availability environment.
You can configure the
firewalls in active/active
failover or active/standby
failover. Configure the
appliances identically
except for the network
settings. Both appliances
should be connected to
the same management
platform.
Port on your LAN switch Internet firewall LAN port Port on your LAN switch
Management platform In a management
platform configuration, an
appliance is configured
to manage other
appliances. This
appliance does not scan,
so it requires only a
management connection.
Port on your LAN switch Not used Not used
Where to place the appliance in your network for best results
Where to place the appliance in your network for best results
The placement of your appliance depends upon whether the appliance is a management platform, network scanner,
or all-in-one device. The Symantec Endpoint Detection and Response appliance must be able to perform the following
depending upon its role:
•
Scan all network traffic coming into and out of the organization
•
Determine the source and destination of all traffic
•
Detect internal connection endpoints
•
Act as a network proxy for endpoints (if integrating with Symantec Endpoint Protection Manager)
•
Have a minimal affect on network performance
If your architecture includes a demilitarized zone (DMZ) and you integrate Symantec EDR with Symantec Endpoint
Protection, don't place the following in the DMZ:
•
Management platform appliance
•
All-in-one appliance
•
SEP
Deploying the appliance between a proxy and firewall prevents Symantec EDR from detecting the IP address of the
source endpoint. So in this scenario, you must enable the
X-Forwarded-For:
header field. You might also need to
configure your firewall to strip the
X-Forwarded-For:
header field.
Symantec EDR does not scan traffic between internal computers. The exception is when one of the computers is a proxy
server. The internal traffic that is routed to a proxy server is scanned because it is outbound network traffic.
If you want Symantec EDR to reach the Internet through a proxy server, you must treat the appliance as a trusted device
and disable authentication. Symantec EDR does not support passing Basic Authentication credentials to the proxy.
Symantec EDR supports Basic or Simple Password Authentication to the proxy.
15