Stonesoft stonegate 5.2, Руководство по установке

Страница: 16 / 109

16
Chapter 2 Planning the IPS Installation
Capture Interfaces
Sensors can be connected to a switch SPAN port or a network TAP to capture network traffic.
Hubs can be used, but are not recommended. The considerations for these connection methods
are explained below. Additionally, the IPS Sensor can be installed in-line, so that the network
traffic is routed through the Sensor, allowing active blocking of any connection.
For more specific information on compatibility of different network devices and StoneGate IPS,
refer to the Stonesoft website at
http://www.stonesoft.com/support/ .
Switch SPAN Ports
A Switched Port Analyzer (SPAN) port is used for capturing network traffic to a defined port on a
switch. This is also known as port mirroring . The capturing is done passively, so it does not
interfere with the traffic.
A Sensor’s capture interface can be connected directly to a SPAN port of a switch. All the traffic
to be monitored must be copied to this SPAN port.
Network TAPs
A Test Access Port (TAP) is a passive device located at the network wire between network
devices. The capturing is done passively, so it does not interfere with the traffic. With a network
TAP, the two directions of the network traffic is divided to separate wires. For this reason, the
Sensor needs two Capture interfaces for a network TAP; one capture interface for each direction
of the traffic. The two related Capture interfaces must have the same
Logical interface that
combines the traffic of these two interfaces for inspection. You could also use the pair of
Capture interfaces to monitor traffic in two separate network devices.
Cabling Guidelines
Follow standard cabling with inline IPS: use straight cables to connect the sensor to switches/
hubs and crossover cables to connect the sensor to hosts. Both crossover and straight cables
may work when the sensors are operating normally due to software-level correction, but only the
correct type of cable allows traffic to flow when fail-open network cards must pass traffic without
the help of higher-level features.
Also, make sure the cables are correctly rated (CAT 5e or CAT 6 in gigabit networks).
Illustration 2.1 Correct Cable Types
Switch/firewall
Host
Switch/firewall
Switch
Straight cable
Crossover cable
Straight cable
Straight cable