For USM Anywhere to monitor traffic from your physical network, you need to allocate a spare network interface card (NIC) to pass the mirrored traffic, or in Cisco terms the Switched Port Analyzer (SPAN) traffic, to the virtual network. LevelBlue recommends that you implement SPAN on your internal firewall ports, connect the SPAN port to the spare NIC, and then associate the spare NIC with a virtual switch (vSwitch) on your VMware server, as illustrated in the following diagram:

In the following procedure, you will create a new standard vSwitch in VMware vSphere, configure it to allow promiscuous mode Mode in which network IDS monitoring operates in passive listening mode, checking all IP packet traffic passing through it for threats., and then assign it to one of the network adapters on the USM Anywhere VMware Sensor virtual machine (VM). It is important to create a new vSwitch dedicated to the mirrored traffic. Adding a promiscuous port group to an existing vSwitch may cause instability in the hypervisor A middleman that intercepts hardware calls and converts them into something appropriate. This technique means that you can run multiple OSs simultaneously on one set of hardware..

This procedure assumes that you have completed the following tasks:

• Enabled port mirroring on the network you want USM Anywhere to monitor.
• Allocated a spare NIC on the VMware ESXi server to receive the mirrored traffic.

To direct the mirrored traffic to the VMware Sensor

1. Configure a new standard vSwitch specifically for the mirrored traffic (see VMware Documentation for detailed instructions):

   1. For the connection type, select Virtual Machine Port Group for a Standard Switch.
   2. Add the spare NIC as the network adapter for the new switch.

   3. For the connection settings, enter a new network label for the port group, for example, SPAN Target.

   4. Enter a VLAN number or select All (4095), which enables the switch to capture traffic from all the VLANs connected to the spare NIC.

2. Configure the port group to allow promiscuous mode so that connected devices can view traffic on the entire switch:

   1. Next to the new vSwitch, click Properties.
   2. Select the vSwitch and click Edit.
   3. Set Promiscuous Mode to Accept, and click OK.

   4. Select the port group and make sure that the default security policy permits promiscuous mode there as well.

      

   5. Select the Network Adapters tab and make sure that your spare NIC is associated with the vSwitch.

      

   6. In the dialog box, click Close.

3. Connect the vSwitch to your VMware Sensor.

   1. Edit the VMware Sensor VM and select an available network adapter.

      Note: Network adapter 1 is reserved for the management interface. See Configure Network Interfaces for On-Premises Sensors for more information.

   2. Associate the adapter with the vSwitch and save your changes.
   3. Restart the VM if changes are not automatically applied.

4. Repeat the steps for every vSwitch you want to monitor, as shown in the video.