Version 5.2
Sourcefire 3D System Installation Guide
99
Setting Up a Sourcefire 3D System Appliance
Initial Setup Page: Devices
Chapter 4
In an inline deployment, you can also perform network-based advanced
malware protection (AMP), file control, Security Intelligence filtering, and
network discovery.
Although you can select the inline mode for any device, keep in mind that
inline sets using the following interfaces lack bypass capability:
•
non-bypass NetMods on 8000 Series devices
•
SFP transceivers on 71xx Family devices
IMPORTANT!
Reimaging resets devices in inline deployments to a non-bypass
configuration; this disrupts traffic on your network until you reconfigure bypass
mode. For more information, see
Traffic Flow During the Restore Process
Access Control
Choose this mode if your device is deployed inline as part of an access
control deployment, that is, if you want to perform application, user, and URL
control. A device configured to perform access control usually fails
closed
and
blocks
non-matching traffic. Rules explicitly specify the traffic to pass.
You should also choose this mode if you want to take advantage of your
device’s specific hardware-based capabilities, which include (depending on
model): clustering, strict TCP enforcement, fast-path rules, switching,
routing, DHCP, NAT, and VPN.
In an access control deployment, you can also perform malware protection,
file control, Security Intelligence filtering, and network discovery.
Network Discovery
Choose this mode if your device is deployed passively, to perform host,
application, and user discovery only.
The following table lists the interfaces, inline sets, and zones that the system
creates depending on the detection mode you choose.
Initial Configurations Based on Detection Mode
D
ETECTION
M
ODE
S
ECURITY
Z
ONES
I
NLINE
S
ETS
I
NTERFACES
Inline
Internal and
External
Default
Inline Set
first pair added to Default
Inline Set—one to the
Internal and one to the
External zone
Passive
Passive
none
first pair assigned to
Passive zone
