Symantec 10268947 - Network Security 7160, User Manual

Page: 42 / 134

42 Getting Started
About deploying single nodes
simultaneously from the Network Security console. Also, failover groups do not
function for single nodes.
About deploying single 7100 Series appliance nodes
You can deploy a Symantec Network Security 7100 Series node just as you would
a Network Security software node. It can operate independently or as part of a
cluster. A 7100 Series appliance also has several extra deployment options. You
can configure it for interface grouping, in-line mode, and fail-open, in addition
to passive monitoring mode. You can also deploy the appliance using a
combination of these modes in a way that best suits your network.
About interface grouping
Interface grouping provides a solution when your network employs asymmetric
routing. Asymmetric routing occurs when traffic arrives on one interface and
departs on another. Because the request and reply sides of the client/server
traffic are on different interfaces, a standard monitoring interface cannot see
the full conversation to analyze it properly. With the Symantec Network
Security 7100 Series, you can place up to four interfaces into a single group. One
sensor is started for the interface group, allowing Symantec Network Security to
analyze the different traffic flows as if they were combined on one interface.
This is a very effective deployment mode for a network with asymmetric
routing.
About in-line mode
In-line mode is another mode of deployment available only with the Symantec
Network Security 7100 Series appliance. In-line mode uses an interface pair to
place the appliance directly into the network path. Both interfaces connect to
the monitored network segment, effectively separating it into two sides.
Incoming packets are fully analyzed before being allowed to continue into the
other side of the network. Because of the nature of the connection, it is
necessary to interrupt network traffic briefly while you connect the cables to the
appliance interfaces.
You can configure a policy for an in-line pair that alerts on or blocks malicious
traffic. When a malicious packet is detected in alerting mode, the appliance
software executes the configured responses, which may be email, Network
Security console displays, or other choices available on both appliances and
Network Security software nodes. Blocking mode prevents malicious traffic of
the designated event types from being transmitted into your protected network.
When a blocked TCP/IP event is detected, the node sends TCP resets to both