Source fire Sourcefire 3D System, Installation Manual

Page: 40 / 280

Version 5.2 Sourcefire 3D System Installation Guide 40
Understanding Deployment
Deployment Options
Chapter 2
on the virtual router allows traffic from each network to pass to the firewall and
back (indicated by the red and orange lines).
For more information, see Setting Up Virtual Routers in the
Sourcefire 3D System
User Guide .
Deploying with Hybrid Interfaces
L
ICENSE
: Control
S
UPPORTED
D
EVICES
: Series 3
You can create a hybrid interface on a managed device to route traffic between
Layer 2 and Layer 3 networks using a virtual switch and a virtual router. This
provides one interface that can both route local traffic on the switch and route
traffic to and from an external network. For best results, configure policy-based
NAT on the interface to provide network address translation on the hybrid
interface. See Deploying with Policy-Based NAT on page 42.
A hybrid interface must contain one or more switched interfaces and one or more
routed interfaces. A common deployment consists of two switched interfaces
configured as a virtual switch to pass traffic on a local network and virtual routers
to route traffic to networks, either private or public.
To create a hybrid interface, you first configure a virtual switch and virtual router,
then add the virtual switch and virtual router to the hybrid interface. A hybrid
interface that is not associated with both a virtual switch and a virtual router is not
available for routing, and does not generate or respond to traffic.
Hybrid interfaces have the advantage of compactness and scalability. Using a
single hybrid interface combines both Layer 2 and Layer 3 traffic routing functions
in a single interface, reducing the number of physical appliances in the
deployment and providing a single management interface for the traffic.
Use a hybrid interface where you need both Layer 2 and Layer 3 routing
functions. This deployment can be ideal for small segments of your deployment
where you have limited space and resources.
When you deploy a hybrid interface, you can allow traffic to pass from your local
network to an external or public network, such as the Internet, while addressing
separate security considerations for the virtual switch and virtual router in the
hybrid interface.