Symantec
™
Endpoint Detection and Response 4.5 Installation Guide for the S550
appliance
About selecting a network scanner
The following factors determine the number of recommended network scanners.
Hardware versus virtual Make this decision based on your current infrastructure. Users with extensive VMware investment
might want to use virtual appliances. Users with little or no VMware investment should use
hardware.
Hardware solutions have bypass NICs, so on failure Symantec EDR continues to pass traffic
when deployed inline. Therefore, real hardware is preferred for inline deployments.
For more information, see the Installation Guide for your respective platform (physical or virtual
appliance).
Available bandwidth The hardware solutions have higher throughput than virtual solutions.
10 GB per port.
See the Symantec Endpoint Detection and Response Sizing Guide for more information.
Total endpoints in the organization While each deployment varies, the physical appliance has a capacity of approximately 25K
simultaneous connections. These numbers are for inline mode. In Tap mode, hardware can
support approximately twice the number of connections as inline.
Symantec EDR features If the deployment is to use mostly network scanning, then a separate scanner and management
platform deployment provides room to increase scanning capacity. In this case, the physical
appliance has more storage capacity and is suitable for the management platform. The number
of scanners would depend on the number of ingress and egress points in the network and the
amount of traffic at those points.
An all-in-one deployment needs to be able to handle all the traffic for the projected growth of the
organization for the lifetime of the appliance. If the deployment functions primarily as Symantec
EDR: Endpoint, then select an all-in-one deployment.
About network configurations and port connections
The following table describes the ways to connect Symantec Endpoint Detection and Response to your network.
13
To Next Page
Loading...
General