Configure Network Interfaces for On-Premises Sensors

A USM Anywhere Sensor deployed on VMware or Hyper-V uses five network interfaces. These network interfaces have a predefined role that cannot be changed. The USM Anywhere management interface is required for many essential functions, including the following:

The management interface needs an IP address with permissions to access the following:

The other interfaces passively monitor network traffic in promiscuous mode Mode in which network IDS monitoring operates in passive listening mode, checking all IP packet traffic passing through it for threats.; the system does allow the configuration of an IP address on them. These interfaces should be plugged into a port in the switch where port mirroring is configured. The following table summarizes each interface's usage.

Network Interfaces Available in On-Premises Sensors
Interface Name Network Configuration Required
Management Interface

Internet connectivity and IP address routed to provide the access to USM Anywhere.

This IP address also allows connections to assets in a monitored network for log collection and asset scans.

Network Monitoring Interface 1

Interface connected to a mirrored port in the network switch 1.
Network Monitoring Interface 2 Interface connected to a mirrored port in the network switch 2.
Network Monitoring Interface 3 Interface connected to a mirrored port in the network switch 3.
Network Monitoring Interface 4 Interface connected to a mirrored port in the network switch 4.
The VMware Sensor and Hyper-V Sensor require all five network interface cards (NICs) to be enabled; otherwise, the USM Anywhere update will fail. The NICs can remain disconnected.

You should only connect the other NICs to any additional network you want to monitor. Don't connect the NICs to the same Switched Port Analyzer (SPAN) port because it'll produce duplicate events in USM Anywhere.

Use the functions provided by the sensor console to configure the management interface and your Domain Name System (DNS).