Network TAPs 101

Aggregation TAPs

Maximizing ROI

Often, network engineers have to accommodate security and monitoring tools that only have one NIC card or input port. Other devices such as lawful intercept and advanced threat defense systems need to see patterns in traffic as it moves across multiple points in the network.

In these cases, aggregation TAPs provide the answer. When configured to operate in aggregation mode, the network TAP can merge eastbound and westbound traffic flows and send it all to the attached devices via a single port. Alternatively, aggregation TAPs can be reconfigured to operate in breakout ‘normal’ TAP mode if full utilization is a concern.

To send a full duplex link between a network router and a network switch to a single monitoring port, disconnect the cable that attaches the router to the switch from the switch end. Connect the switch end of the cable to port A on the aggregation TAP. Use a separate cable to connect port B to the connection on the switch that was previously disconnected. While the network TAP will reestablish the link and traffic will again flow between the two devices, only when powered will the traffic flow to the aggregation ports (C or D).

When configured in this mode, each monitoring port will receive all of the traffic on the link. As an added benefit, engineers can support twice as many tools from the same network TAP.

For tools that need to analyze packets as they travel throughout the network, use a network TAP with multiple input ports. These devices aggregate data from multiple points in complex environments and send it all to connected appliances without data loss, corruption, latency or timing issues.

NOTE: 1G COPPER Packet Injection?

The right answer is based on your needs. No packet Injection - ensures that your device is passive, listen-only for out-of-band monitoring devices. With Packet Injection - gives you the option of being passive listen-only -or- active, in-band for security devices.

Replication/Regeneration TAPs

Multi Appliance Data Distribution

Bypass TAPs

Sophisticated Management for Critical Links

The bypass TAP was developed to overcome these issues and prevent in-line appliances from becoming a point of failure within the network. To limit the risk of downtime due to an appliance failure, the bypass TAP sends heartbeat packets to the device along with the link traffic.

As long as the heartbeat packets continue to be returned to the TAP, administrators know that the device is functioning properly (the heartbeat packets are filtered out of the traffic before it continues along its intended path). If the heartbeat packets are not returned – indicating that the device has failed – the network TAP will automatically switch to an out-of-band/off-line mode which will keep the link traffic flowing freely.

While the network TAP is in bypass mode, it continues to send heartbeat packets out to the security appliance. Once the heartbeat packets are sent back to the TAP, it is a signal that the appliance is working again. The bypass TAP then moves the device back to in-line status and directs the network traffic back through it so it can act on the traffic flow in real-time.

Figure 8: Bypass TAPs were designed to prevent in-line appliances from becoming a point of failure while still providing them with a copy of network traffic for analysis.

The Bypass TAP also gives engineers a solution for simplifying appliance management and to rapidly troubleshoot issues in complex environments. Before its invention, administrators had to shut down the network to deploy, update or troubleshoot in-band devices such as firewalls or intrusion prevention systems. Now, administrators can easily take in-line devices on and off-line without impacting traffic flows.

One of the biggest challenges engineers face is ensuring performance as more and more security appliances are allowed to interfere directly in traffic streams to isolate malicious packets. Often this can have an unforeseen impact on other applications, especially when new software and firmware updates are uploaded. Rather than spend days trying to find root cause in complex environments, administrators can simply switch the appliance to an out-of-band mode and see if the issue resolves itself or requires further investigation.

With a Bypass TAP, network engineers not only maximize uptime and eliminate points of failure, they increase the efficiency of their corporate security and network management by ensuring that firmware and software updates are made as quickly as possible.

TAP TIP: When deploying new appliances or upgrading existing tools, set them up in bypass (offline) mode to work the kinks out before moving them on-line. This helps isolate issues from the start and minimizes downtime and disruption for network users. To ensure safety on critical links, it is wise to utilize a back up security appliance to take over while primary appliances are being updated.

NOTE: Suggested tools to use with Bypass TAPs

Media Changing TAPs

Normalizing Connectivity between Networks and Tools

Often times, network engineers need to find a way to accommodate security and monitoring appliances whose configurations don’t match that of the network. For example, lawful intercept devices originally purchased for copper environments cannot be automatically transferred to multi-mode fiber networks. The same is true for using single-mode fiber tools in multi-mode fiber networks.

With the right media changing TAP, you can normalize connectivity between the network and the appliance without losing packets, creating timing issues or introducing latency issues.

Figure 9: A media conversion TAP for converting a single-mode fiber link to copper

Figure 10: A media conversion TAP for converting copper over to multi-mode fiber

Environmental Considerations

Passive and Active Network TAPs

While network TAPs offer multiple functional modes (breakout, filtration, aggregation, etc.), there are also technical issues to consider when optimizing the network-tool connection.

As we discussed previously, TAPs can support copper or fiber networks and tools. You can also use taps to convert media.

Passive vs Active TAPs

In general, passive TAPs are used with monitoring tools and typically don’t require power. Passive TAPs are available in copper and fiber.

Active TAPs are always powered and were designed to support in-line security applications. Active TAPs are also available in both copper and fiber.

Passive Network TAPs

In general, passive network TAPs are defined as connectivity solutions that will not cause connected monitoring devices to lose their link in the event of a power failure. Used to support out-of-band tools, a passive TAP simply makes a copy of the network data and distributes it to appliances – they don’t take altered traffic back from the device and resend it through to the network. Only an active network TAP can support those functions.

Passive network TAPs offer a key advantage – they typically don’t require power to provide basic copy/send functions. This network design offers tremendous advantages for companies with crowded wiring closets and limited outlet availability. Additionally passive TAPs are not able to accidentally inject data into the network as the data only flows to the desired monitoring device(s).

Depending on the environment, there are variances in passive network TAPs that engineers need to understand.

TAP TIP: A standard passive network TAP operates in breakout ‘normal’ mode – sending eastbound traffic on one stream and westbound traffic via another stream.  If the connected device only has one available port or NIC card, select a network TAP able to operate in aggregation mode. The TAP will have to be powered to work in this mode.

Passive TAPs In Fiber-based Networks

Passive network TAPs can be used in fiber networks of all speeds, simply choose a model rated to copy/send data at the environment’s transmission rate (1 Gigabit, 10 Gigabit, 25 Gigabit, 40 Gigabit, 100 Gigabit, etc.). If that’s all that the network TAP has to do – and there is enough light available in the fiber to split it without degrading network conditions – there is no need to power a passive TAP at all.

What is Split Ratio? A split ratio is the amount of light that is redirected from the network to the monitor ports on a passive fiber optic network TAP. To determine the correct split ratio, a loss (power) budget should be calculated (more on that later). A 50/50 split ratio would indicate that 50% of the light budget coming into the TAP from the network is passed along to the end device, and 50% of the light budget is diverted to the monitoring device. To understand how this goes as you change the ratio, for a 70/30 split ratio, 70% of the light budget is passed along to the end device and only 30% of the light budget is passed along to the network monitoring device. [Click for more]

How to Calculate Loss Light Budget: A loss light budget is the amount of attenuation that can be tolerated on the network and monitor links before the end-to-end data is corrupted. To calculate this, you must know the following network link characteristics:

• Link distance

• Fiber type

• Launch power

• Receiver sensitivity

• Number of interconnects and splices

TAP TIP: When connecting an appliance with copper input ports to a fiber-based network, use a TAP with media conversion capabilities. These devices can also be used to reduce costs as they let engineers use a single mode fiber to carry traffic from a multi-mode fiber network to the device. Again, the passive TAP will have to be powered to work in this mode.

Passive TAPs In Copper-based Networks

While a passive network TAP can be used in any fiber-based network, it’s not that straightforward in copper environments. First, passive TAPs used in copper networks must always be powered. Additionally, they can only be deployed in 10/100 Base-T networks – they cannot function properly in copper gigabit environments.

TAP TIP: To enable connectivity in copper gigabit environments, use an active network TAP.

TAP TIP: When using powered passive network TAPs, choose one equipped with fail-safe relay circuitry that will not cause a network failure when power is disrupted. To ensure reliability deploy all your networks TAPs via a rack outfitted with dual Uninterruptible Power Supplies (UPS).

Active TAPs

TAP TIP: All connectivity solutions for Gigabit copper networks require an active network TAP to function properly. Because data is simultaneously transmitted over the copper pairs in these environments, the two endpoints on the device must link to the network TAP, regardless of the application.

Unlike best-effort connectivity solutions, a properly configured active network TAP guarantees that in-line appliances see every bit, byte and packet in the traffic stream. Active network TAPs can support breakout “normal,” filtration, aggregation, bypass and media conversion modes.

TAP TIP: Because all active network TAPs require power to function properly, choose a device with fail-safe circuitry to ensure that traffic continues to flow during a power outage or appliance failure.

TAP TIP: Use active network TAPs in bypass mode to migrate threat risks by ensuring that front-line security appliances remain active. More importantly, it gives administrators the ability to move appliances to out-of-band status to quickly and effectively make the updates that let security solutions immediately respond to new threats.

Figure 11: Supporting in-line devices using an active TAP in bypass mode simplifies administration and speeds security updates.

Managing Connectivity

Engineering End-to-End Visibility

Too often, network connectivity plans are limited to the company’s LAN/WAN connection point. Certainly, this provides key visibility into the performance issues and security problems that occur at the intersection of the public and private networks. But as IT becomes increasing complex, many engineers are inserting network TAPs throughout their environments to secure all of their digital assets, speed up troubleshooting and gain the insights needed to optimize performance across the organization. 

Today there are basically two types of architectures – one with native network access options capable of properly supporting any monitoring, troubleshooting or security device that the company needs and another that has to scramble to find connectivity whenever any new project starts or a performance issue crops up.

Instead of having to scramble to find connectivity for every new initiative, consider adding visibility points into the network design to analyze:

• eCommerce and web servers

• VoIP and real-time communication applications

• Data center server banks

• Dedicated connection to cloud service providers

TAP TIP: Typically, network TAPs represent less than 5% of the cost of the supported security appliances and network analyzers. Use them throughout the environment to maximize ROI on IT investments and ensure that they are able to operate optimally. 

FOOTER: To work effectively, network connectivity plans must be designed for the organization’s unique environment, security protocols and monitoring requirements. For a customized solution, contact the network designers at Garland Technology and start white boarding your design today.

Setting Yourself Up for Security Success

Want to learn how we can help you implement network security best practices? Book a free Design-IT consultation and one of our engineers will work directly with you on designing your network connectivity strategy!