With a deployed on-premises USM Anywhere Sensor, you can implement Network Intrusion Detection (NIDS) Network Intrusion Dectection System (NIDS) monitors network traffic and events for suspicious or malicious activity using the sensors that provide management and network monitoring interfaces to networks and network devices. by monitoring the network traffic. You can implement this by enabling promiscuous mode on the port that the Sensor network interface(s) are connected to so they can see the traffic on the networks you wish to monitor, and through the use of port mirroring. This allows USM Anywhere to perform analysis on the network traffic, which aids in the detection of threats in your environment.

By configuring a mirror port on your virtual switch or physical network device, you can clone all traffic to a single port. After configuration, the switch sends a copy of all network packets seen on one port (or an entire VLAN Broadcast domain that is partitioned and isolated in a computer network at the data link layer (OSI layer 2). VLANs allow network administrators to group hosts together, even if the hosts are not on the same network switch.) to another port. The USM Anywhere Sensor immediately starts receiving events from the device through the port and begins its analysis.

Virtual Switches

• VMware: This is configured by attaching one of the Sensor network interfaces to a port configured in Promiscuous mode on a Virtual Switch. See Direct Traffic from Your Physical Network to the VMware Sensor for more information.

  In addition, the upstream physical switch that the ESXi host is connected to must have Port Mirroring enabled.

• Hyper-V: This is configured by attaching one of the Sensor network interfaces to a port configured in Promiscuous mode on the Virtual Network. See Direct Traffic from Your Physical Network to the Hyper-V Sensor for more information.

  In addition, the upstream physical switch that the Hyper-V Server is connected to must have Port Mirroring enabled.

Physical Devices

See the following for detailed information about port mirroring on a number of third-party network devices.

Configuring the ADTRAN (AOS) Switch for Port Mirroring

Configuring the Check Point Gateway for Port Mirroring

Configuring the Cisco ASA 5505 for Port Mirroring

Configuring the Cisco Nexus 5000 Series for Port Mirroring

Configuring the Cisco SGxxx Series for Port Mirroring

Configuring the Dell Networking Force10 Switch for Port Mirroring

Configuring Dell SonicWALL Port Mirroring

Configuring the Fortinet FortiGate Switch for Port Mirroring