Configuring inline mode using the CLI

Use the CLI commands in this topic to set the following options to configure inline blocking mode.

Setting	Description
Operational Mode	The inline deployment has three operational modes. It is highly recommended that you set your appliance to inline blocking mode. Note If you set the operational mode to block traffic, input a fail-safe setting (block open or block close). block—Blocks malicious traffic (recommended). open—In case of failure, all traffic passes through (recommended). close—In case of failure, all traffic is blocked. (Use this setting only if the device is actively monitored). monitor—Monitors the traffic and generates alerts on malicious events. bypass—Forced bypass wherein the Network Security appliance neither blocks nor analyzes traffic. Note Starting with version 7.1.0, Network Security appliances bypass packets larger than 1650 bytes rather than dropping them.
Policy Type	The following policy types are supported: mixed—Applies both local and global policies, and the local policy overrides the global policy (recommended). global—Applies Trellix-defined global policy to the specified interface. local—Applies user-defined local policy to the specified interface. none—Does not apply any policy. No policy is used.

Setting

Description

Operational Mode

The inline deployment has three operational modes. It is highly recommended that you set your appliance to inline blocking mode.

Note
If you set the operational mode to block traffic, input a fail-safe setting (block open or block close).

block—Blocks malicious traffic (recommended).
- open—In case of failure, all traffic passes through (recommended).
- close—In case of failure, all traffic is blocked. (Use this setting only if the device is actively monitored).
monitor—Monitors the traffic and generates alerts on malicious events.
bypass—Forced bypass wherein the Network Security appliance neither blocks nor analyzes traffic.

Note
Starting with version 7.1.0, Network Security appliances bypass packets larger than 1650 bytes rather than dropping them.

Policy Type

The following policy types are supported:

mixed—Applies both local and global policies, and the local policy overrides the global policy (recommended).
global—Applies Trellix-defined global policy to the specified interface.
local—Applies user-defined local policy to the specified interface.
none—Does not apply any policy. No policy is used.

For details about inline deployment, refer to the Hardware Administration Guide for your appliance model.

Prerequisites

To configure inline mode:

Enable the CLI configuration mode:

hostname > enable hostname # configure terminal

Configure pair A (interfaces A1 and A2) in inline block mode:

hostname (config) # policymgr interface A op-mode block fail-safe open policy-type mixed

hostname (config) # policymgr interface A re-configure

(Optional) Configure pair B (interfaces B1 and B2) in inline block mode:

hostname (config) # policymgr interface B op-mode block fail-safe open policy-type mixed

hostname (config) # policymgr interface B re-configure

Check your configuration:

hostname (config) # show policymgr interfaces

Policy enabled: yes

Interface A

  Active   : yes
  op mode  : block (blocking)
  fail-safe: open
  policy   : mixed
  tolerance: 1
  ports    : pether3 pether4

Interface B

  Active   : yes
  op mode  : block (blocking)
  fail-safe: open
  policy   : mixed
  tolerance: 1
  ports    : pether5  pether6