Trellix NS Series - Connect the Cables for Tap Mode; Port Clustering for an NS9300 Sensor in Tap Mode

•
•
Steps:
1. Plug the cable appropriate for use with your transceiver module into one of the Monitoring ports, for example G1/1.
2. Plug the cable appropriate for use with your transceiver module into one of the Monitoring ports, for example G1/2.
3. Connect the other end of each cable to the network devices that you want to monitor.For example, if you plan to monitor
trac between a switch and a router, connect the cable connected to 1 to the switch and the one connected to 2 to the
router.
:
Connect the cables for tap mode
To deploy the Sensor in tap mode, you must use a Sensor's Gigabit Ethernet Monitoring port pair with a third-party external tap.
For a list of Trellix-approved third party vendors, see the KnowledgeBase at https://supportm.trellix.com. Enter the relevant
KnowledgeBase article in Search the Support Knowledge Center and click Search to locate the relevant KnowledgeBase
article.
Steps:
1. Plug the cable appropriate for use with your transceiver module into one of the Monitoring ports, for example, G1/1.
2. Plug the cable appropriate for use with your transceiver module into one of the Monitoring ports labeled G1/2.
3. Connect the other end of each cable to the tap.
4. Connect the network devices that you want to monitor to the tap.
:
Port Clustering for an NS9300 Sensor in tap mode
To improve the attack detection, the trac distribution between the monitoring ports is redesigned. The monitoring ports are
paired such that the trac from the odd port pairs (G1/1, G1/2) and (G1/5, G1/6) is directed to the local front end of the Sensor,
and the trac from the even port pairs (G1/3, G1/4) and (G1/7, G1/8) is directed to the remote front end of the Sensor. Port
cluster in tap mode is congured in a manner where the trac is being forwarded to the same front end of the Sensor. Port
clustering is applicable to ports G1, G2, G3, G5, G6, and G7. Ports G0 and G4 are used as interconnect ports for communication
between the primary and secondary Sensors.
The following modules are used for port clustering in an NS9300 Sensor:
Fixed Gigabit Ethernet-Copper Ports
Network I/O Modules
8 port (SFP+/SFP) 10/1 GigE
6 port RJ-45 10/100/1000 Mbps
Trellix Intrusion Prevention System NS-series Sensor Product Guide
| NS9x00 Sensors2
110
Note