Symantec 10521146 - Network Security 7120, Administration Manual

Page: 62 / 392

62 Getting started
Deploying single nodes
Managing a single node is simpler than managing a cluster. For example, you
can partition your network to make each security administrator responsible for
only one segment, without the need to communicate with other segments or
with other software or appliance nodes. In this scenario, the nodes have no
method of communication with each other. Using a single Network Security
console, you can log in to any single node in your network, and view it
individually. With single-node deployment, you cannot view all nodes
simultaneously from the Network Security console. Also, failover groups do not
function for single nodes.
Deploying a single 7100 Series appliance node
You can deploy a Symantec Network Security 7100 Series node just as you would
a Network Security software node. It can operate independently or as part of a
cluster. A 7100 Series appliance also has several extra deployment options. You
can configure it for interface grouping, in-line mode, and fail-open, in addition
to passive monitoring mode. You can also deploy the appliance using a
combination of these modes in a way that best suits your network.
About interface grouping
Interface grouping provides a solution when your network employs asymmetric
routing. Asymmetric routing occurs when traffic arrives on one interface and
departs on another. Because the request and reply sides of the client/server
traffic are on different interfaces, a standard monitoring interface cannot see
the full conversation to analyze it properly. With the Symantec Network
Security 7100 Series, you can place up to four interfaces into a single group. One
sensor is started for the interface group, allowing Symantec Network Security to
analyze the different traffic flows as if they were combined on one interface.
This is a very effective deployment mode for a network with asymmetric
routing.
About in-line mode
In-line mode is another mode of deployment available only with the Symantec
Network Security 7100 Series appliance. In-line mode uses an interface pair to
place the appliance directly into the network path. Both interfaces connect to
the monitored network segment, effectively separating it into two sides.
Incoming packets are fully analyzed before being allowed to continue into the
other side of the network. Because of the nature of the connection, it is
necessary to interrupt network traffic briefly while you connect the cables to the
appliance interfaces.