Version 5.2
Sourcefire 3D System Installation Guide
98
Setting Up a Sourcefire 3D System Appliance
Initial Setup Page: Devices
Chapter 4
Time Settings
You can set the time for a device either manually or via network time protocol
(NTP) from an NTP server, including the Defense Center. Sourcefire recommends
that you use the Defense Center as the NTP server for its managed devices.
You can also specify the time zone used on the local web interface for the
admin
account. Click the current time zone to change it using a pop-up window.
Detection Mode
The detection mode you choose for a device determines how the system initially
configures the device’s interfaces, and whether those interfaces belong to an
inline set or security zone.
The detection mode is not a setting you can change later; it is simply an option
you choose during setup that helps the system tailor the device’s initial
configurations. In general, you should choose a detection mode based on how
your device is deployed:
Passive
Choose this mode if your device is deployed passively, as an intrusion
detection system (IDS). In a passive deployment, you can perform file and
malware detection, Security Intelligence monitoring, as well as network
discovery.
Inline
Choose this mode if your device is deployed inline, as an intrusion prevention
system (IPS). An IPS usually fails
open
and
allows
non-matching traffic.
