Broadcom Symantec S550, Руководство по установке, Страница: 12 / 49

Symantec
™
Endpoint Detection and Response 4.5 Installation Guide for the S550
appliance
Symantec EDR operating modes and network connections describes the Symantec EDR modes that are available for
the appliances and the network connections that are required for each role. You must assign a static IP address to each
Symantec EDR network connection.
Table 6: Symantec EDR operating modes and network connections
Mode Description Network connections required
Inline Block In Inline Block mode, network traffic passes through the
appliance between the endpoints and the Internet. Any file
downloads, accessed websites, and traffic that are considered
malicious are blocked. Only Inline Block mode provides real-
time protection against threats.
1 Management
2 WAN
2 LAN
Inline Monitor In Inline Monitor mode, network traffic passes through the
appliance between the endpoints and the Internet. Malicious
files, websites, and traffic are logged for visibility but are not
blocked. Any threats that are found in Inline Monitor mode must
be mitigated manually.
Inline Monitor mode is often used as a test for system
performance and to analyze potential behavior for blocking
(from reports) before blocking is implemented. The physical
connections for Inline Block and Inline Monitor modes are
identical, so no re-cabling is necessary when you switch
between these modes.
The physical appliance has two Inline interfaces in Inline
Monitor mode.
1 Management
2 WAN
2 LAN
Bypass (Inline
mode failsafe)
•
Installed out of the box:
Standard NIC mode
•
Configured for Inline deployment:
Bypass mode
•
Configured for Tap deployment:
Standard NIC mode
•
Reimaged (factory reset) after any previous deployment:
Standard NIC mode
Same as Inline Block or Inline Monitor
Tap In Tap mode, the appliance connects to a Tap or Span port on
a switch. The appliance monitors a copy of the traffic between
the endpoints and the Internet so monitoring incidents and
logging incidents do not affect network performance. Because
the monitoring and logging engines work at different intervals,
there may be a slight delay in detecting incidents. All threats
must be mitigated manually.
The appliance can monitor up to four monitor ports on separate
networks in Tap mode.
1 Management
1 Monitor connection for each network
monitored
Management
platform
In management platform mode, all communications and
management go through the management port. Since a
management platform appliance does not scan, only the
management connection is required.
1 Management
You choose the operating mode for an all-in-one device or network scanner from the EDR appliance console. A
management platform operates in management platform mode automatically.
About network configurations and port connections
Where to place the appliance in your network for best results
12