You just bought a brand new inline security appliance—a next-gen firewall, intrusion prevention system (IPS), data leakage prevention (DLP) system or web application firewall—and you’re ready to deploy it in your network. But then it sits in a box for months because you look at the network design and can’t decide where the new appliance will fit in.
The whole point of an inline security appliance is to actively analyze every bit, byte and packet® you send to it—let’s go over the keys to connecting your new inline security appliance for optimal network access.
If you want your security appliance to actively analyze network traffic, your first thought might be to place it right between the two network elements you want to monitor traffic for (for example, a router and switch). Resist this thought. The design would look like this:
We often discuss why SPAN ports are no longer an effective means of ensuring network visibility, but many customers still use them extensively. SPAN ports may have been effective enough when we were only analyzing 10Mbps links, but now they introduce a number of issues, including:
These are only a few of the problems that SPAN ports introduce when they are used as network TAP replacements. That’s why network TAPs are the best practice for in-band security appliance connectivity.
When you need to ensure 100% uptime and visibility for inline security appliances, a bypass network TAP is the only option.
With a bypass TAP you can configure and validate your inline security appliance off line. Once fully validated, you can be deploy them inline for active analysis. Another key feature is the ability to take the security appliance back off-line without interrupting network traffic for updates, maintenance or troubleshooting.
Network bypass TAPs have a variety of features—the key is to find the solution that meets your needs today and is scalable for tomorrow.
Bypass TAPs are not a one-size-fits-all solution. When purchasing a bypass TAP for your network, consider the following:
Bypass network TAPs are placed between the inline appliance and the router/switch links that they are taking traffic from. The router and the switch are plugged into Network Ports A and B and the inline appliance is plugged into Monitor Ports C and D, giving total visibility without introducing a point of failure. See the following graphic for an example:
Network TAPs aren’t one-size-fits-all solutions. If you want to ensure optimal network access for your new inline security appliance, you must understand your network specifications and purchase the appropriate bypass TAP.
Looking to add IT Security solution to your security deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!