SonicOS 7 System

Download PDF

Technical Documentation > SonicOS 7 System > Interfaces > About Interfaces > IPS Sniffer Mode > Sample IPS Sniffer Mode Topology

Sample IPS Sniffer Mode Topology

This example topology uses SonicWall IPS Sniffer Mode in a Hewlett Packard ProCurve switching environment. This scenario relies on the ability of HP’s ProCurve Manager Plus (PCM+) and HP Network Immunity Manager (NIM) server software packages to throttle or close ports from which threats are emanating.

This method is useful in networks where there is an existing appliance that remains in place, but you wish to use the appliance’s security services as a sensor.

IPS Sniffer Mode: Sample Topology

In this deployment the WAN interface and zone are configured for the internal network’s addressing scheme and attached to the internal network. The X2 port is Layer 2 bridged to the LAN port, but it is not attached to anything. The X0 LAN port is configured to a second, specially programmed port on the HP ProCurve switch. This special port is set for mirror mode: it forwards all the internal user and server ports to the “sniff” port on the firewall. This allows the firewall to analyze the entire internal network’s traffic, and if any traffic triggers the security signatures it immediately traps out to the PCM+/NIM server through the X1 WAN interface, which then can take action on the specific port from which the threat is emanating.

< Previous Section Next Section >

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

SonicOS 7 System

Sample IPS Sniffer Mode Topology

Was This Article Helpful?

Techdocs Article Helpful form

Techdocs Article NOT Helpful form

Stay In Touch