Version 5.2
Sourcefire 3D System Installation Guide
30
Understanding Deployment
Understanding Interfaces
Chapter 2
network segment, you cannot permit uninspected traffic. Using configurable
bypass inline sets, you can manage the traffic flow of your network traffic in one
of the following ways:
•
Bypass
: an interface pair configured for bypass allows all traffic to flow if the
device fails. The traffic bypasses the device and any inspection or other
processing by the device. Bypass allows uninspected traffic across the
network segment, but ensures that the network connectivity is maintained.
•
Non-bypass
: an interface pair configured for non-bypass stops all traffic if
the device fails. Traffic that reaches the failed device does not enter the
device. Non-bypass does not permit traffic to pass uninspected, but the
network segment loses connectivity if the device fails. Use non-bypass
interfaces in deployment situations where network security is more
important than loss of traffic.
Configure the inline set as bypass to ensure that traffic continues to flow if your
device fails. Configure the inline set as non-bypass to stop traffic if the device
fails. Note that reimaging resets appliances in bypass mode to a non-bypass
configuration and disrupts traffic on your network until you reconfigure bypass
mode. For more information, see
Traffic Flow During the Restore Process
page 199.
All appliances can contain configurable bypass interfaces. The 8000 Series
appliances can also contain NetMods with interfaces that cannot be configured
for bypass. For more information on NetMods, see
page 185.
Advanced options vary by appliance and can include tap mode, propagate link
state, transparent inline mode, and strict TCP mode. For information on how to
configure your inline interface sets, see Configuring Inline Sets in the
Sourcefire
3D System User Guide
. For more information on using inline interfaces, see
Connecting Devices to Your Network
Switched Interfaces
L
ICENSE
:
Control
S
UPPORTED
D
EVICES
:
Series 3
You can configure switched interfaces on a managed device in a Layer 2
deployment to provide packet switching between two or more networks. You can
also configure virtual switches on managed devices to operate as standalone
broadcast domains, dividing your network into logical segments. A virtual switch
uses the media access control (MAC) address from a host to determine where to
send packets.
