To accurately detect attacks, a Sensor must be aware of which traffic is outside the network and which traffic is inside. Identifying traffic direction is accomplished through the proper cabling of the fail-open switch as well as the appropriate port configuration of the Sensor monitoring ports in the Trellix Intrusion Prevention System Manager.
The passive fail-open switch consists of the ports mentioned in the picture below.
Field | Description | |
|---|---|---|
1 | To Sensor Fail-Open Control port | |
2 | To network device (inside) | |
3 | To network device (outside) | |
4 | (inside) Plugs into Sensor port Gy/a (NS-Series) | |
5 | (outside) Plugs into Sensor port Gy/b (NS-Series) | |