You just bought a brand new inline security appliance—a next-gen firewall, intrusion prevention system (IPS), data leakage prevention (DLP) system or web application firewall—and you’re ready to deploy it in your network. But then it sits in a box for months because you look at the network design and can’t decide where the new appliance will fit in.
The whole point of an inline security appliance is to actively analyze every bit, byte and packet® you send to it—let’s go over the keys to connecting your new inline security appliance for optimal network access.
One Big Mistake to Avoid: Connecting The Appliance to the Live Network
If you want your security appliance to actively analyze network traffic, your first thought might be to place it right between the two network elements you want to monitor traffic for (for example, a router and switch). Resist this thought. The design would look like this:
Under ideal conditions, this design might seem effective—but it will cause major issues in your network, including:
- Introducing a point of failure in the event of a power outage or if a link goes down
- Traffic manipulation that causes frame misalignment
- Performance delays throughout the network
- Dropped packets that make the security appliance ineffective
A Common Misconception: Connecting with a SPAN/Mirror Port
We often discuss why SPAN ports are no longer an effective means of ensuring network visibility, but many customers still use them extensively. SPAN ports may have been effective enough when we were only analyzing 10Mbps links, but now they introduce a number of issues, including:
- Oversubscribed ports
- Dropped packets
- Limited scalability as network speeds increase
- Negative effect on packet timing
- SPAN ports become a point of failure when links go down
These are only a few of the problems that SPAN ports introduce when they are used as network TAP replacements. That’s why network TAPs are the best practice for in-band security appliance connectivity.
Network TAPs – A Best Practice by Industry Leaders
What do Palo Alto Networks and Cisco all have in common? They partner with Garland Technology as their network TAP vendor.
When you need to ensure 100% uptime and visibility for inline security appliances, a bypass network TAP is the only option.
With a bypass TAP you can configure and validate your inline security appliance off line. Once fully validated, you can be deploy them inline for active analysis. Another key feature is the ability to take the security appliance back off-line without interrupting network traffic for updates, maintenance or troubleshooting.
Network bypass TAPs have a variety of features—the key is to find the solution that meets your needs today and is scalable for tomorrow.
Key Considerations when Choosing a Bypass Network TAP
Bypass TAPs are not a one-size-fits-all solution. When purchasing a bypass TAP for your network, consider the following:
- Cable and media conversion: Copper or fiber network and monitoring ports? Do you need to convert TX to LX? Or LR to ER?
- Scalability: How many security appliances do you need to TAP today…and tomorrow?
- Network Speed: 1G/10G/40G/100G
Deploying a Bypass Network TAP
Bypass network TAPs are placed between the inline appliance and the router/switch links that they are taking traffic from. The router and the switch are plugged into Network Ports A and B and the inline appliance is plugged into Monitor Ports C and D, giving total visibility without introducing a point of failure. See the following graphic for an example:
Quick Connection Requires Pre-Planning
Network TAPs aren’t one-size-fits-all solutions. If you want to ensure optimal network access for your new inline security appliance, you must understand your network specifications and purchase the appropriate bypass TAP.
Want to learn more about the many network tools that help you manage your network? Download What Your Network Is Missing: 7 Tools To TAP
