McAfee M-2850 - Introducing Network Security Sensors; About the M-2850;M-2950 Sensor

1
Introducing Network Security Sensors
This section describes the McAfee
®
Network Security Sensors at a high-level and also describes the McAfee
®
M-2850/M-2950 Network Security Sensor (Sensor) in detail.
Sensors are high-performance, scalable, and exible content processing appliances built for the accurate
detection and prevention of intrusions, misuse, distributed denial of service (DDoS) attacks, and network access
control(NAC) of hosts. When deployed at key access points, a Sensor provides real-time trac monitoring to
detect malicious activity, and respond to the malicious activity as congured by the administrator.
After the Sensor is deployed and communication established, Sensors are congured and managed using the
McAfee Network Security Manager (Manager) server.
The process of conguring a Sensor and establishing communication with the Manager is described in the later
chapters of this guide. The Manager server is described in detail in the McAfee Network Security Platform Manager
Administration Guide.
Contents
About the M-2850/M-2950 Sensor
M-2850/M-2950 key features
M-2850/M-2950 physical description
About the M-2850/M-2950 Sensor
The M-2850/M-2950 Sensor provides eective network access control (NAC) of hosts.
The M-2850/M-2950 Sensor provides eective network IPS functionality as well as network access control (NAC)
of hosts.
The IPS functionality involves providing real-time detection and prevention of threats and known, zero-day, or
encrypted attacks. The Sensor can perform many types of attack responses, including generating alerts and
packet logs, resetting TCP connections, "scrubbing" malicious packets, and blocking attack packets entirely
before they reach the intended target.
NAC hosts involves regulating access to network resources based on host Operational Status level (Standard/
DHCP NAC), identity of the user logged into the host (IBAC) or both, and OOB NAC (L2, L3 ). The Sensor also
provides the Hybrid NAC functionality where a host is rst subjected to DHCP-NAC and then Standard NAC at
dierent ports of the same Sensor. For more information on the NAC functionality and congurations of the
Manager, see McAfee
®
Network Security Platform NAC Administration Guide.
Throughout this guide, the terms 'Sensor' and 'M-2850/M-2950' refer to the M-2850 or the M-2950 Sensor in
general.
1
McAfee
®
Network Security Platform M-2850/M-2950 Sensor Product Guide
7