This method requires a change on the LAN switch, but no downtime is required because network
traffic is not disrupted.
With this configuration, some packets might be dropped under heavy loads. As a result, the number of
packets seen by McAfee DLP Monitor might not match the number seen by the ports being monitored.
Integrate the appliance using a SPAN port
Task
1
Connect McAfee DLP Monitor to a network switch using a console cable or network connection
(such as Telnet or SSH).
Note the port used to connect the appliance to the LAN switch, and the port used by the WAN
router.
2
Apply the appropriate SPAN port configuration.
3
Using interface
show
commands on the switch, verify that traffic is being received on the switch
port to which McAfee DLP Monitor is connected.
4
Save the configuration on the switch.
Common configuration
If a SPAN port is configured on a Cisco switch, the WAN router would be connected to
interface "GigabitEthernet1/0/1". The DLP appliance would be connected to interface
"GigabitEthernet1/0/2".
Switch: configure terminal
Switch(config)# interface GigabitEthernet1/0/2
Switch(config
‑
if)# port monitor GigabitEthernet1/0/1
Switch(config
‑
if)# end
Switch# show port monitor
Monitor Port Port being monitored
‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑
GigabitEthernet1/0/2 GigabitEthernet1/0/1
Switch# write memory
1
Setting up the hardware
Select an integration mode for McAfee DLP Monitor
12
McAfee Data Loss Prevention 9.2.1
Installation Guide
Summary of Contents for Data Loss Prevention 9.2.1
Page 78: ...TP000030C00...
