Enterprises are moving towards virtual IT infrastructures such as virtual data centers for servers and virtual machines for clients. Security requirements for a virtual network might vary vastly when compared to physical networks. For example, monitoring of peer-to-peer traffic and access control in a virtual network have their own challenges. Based on the network architecture and security requirements, virtual security products are required to protect virtual IT infrastructures. Even for physical networks, virtual security products can bring in savings in terms of cost and space.
A Virtual IPS Sensor (Virtual Sensor) is Trellix's virtual next-generation IPS product. It is a virtual instance of the NS-series Sensor software, which you can install as a virtual appliance on:
VMware ESX server
Kernel-based Virtual Machine (KVM)
You do not require the Sensor hardware to deploy a Virtual Sensor. Though primarily designed to protect virtual networks, you can deploy a Virtual Sensor to protect physical networks as well.
The Virtual IPS Sensor is available as an OVA image and a .qcow image.
Note
In this document, the terms Virtual IPS Sensor and Virtual Sensor are interchangeably used.
Similar to a physical Sensor, you use a Manager to configure and manage Virtual Sensors. This Manager can be installed on a physical server or on a virtual machine. Also, you can use the same Manager to manage both virtual and physical Sensors including heterogeneous Sensor environments.
A Virtual Sensor supports most of the features that are supported by a physical Sensor. Except for the fact that you deploy Virtual Sensors in a virtual environment, the process of configuring and managing them is similar to that of physical Sensors. Virtual Sensors also function similar to their physical counterparts when it comes to protecting your networks. With the added advantage of being a virtual instance, you can deploy a Virtual Sensor to protect various network architectures. Some of the common scenarios are covered in this document.
You install a Virtual Sensor in a virtualization environment. Then, you can deploy this Virtual Sensor to inspect traffic in the following:
Virtual machines (VMs) on the virtualization environments
VMs on different virtualization environments and the VMs on a specific host
Physical machines and the VMs on virtualization environments
Physical networks wherein the virtualization environment is inline
.png "GUID-2F7C51AA-5DA7-4B08-83C9-5C21FEBDA733-low.png")
To use the information in this document, familiarity with the following is required:
For VMware ESX Server: Administration of VMware ESXi hosts including virtual networks within VMware ESXi hosts.
For KVM: Administration of KVM hypervisor including virtual network configuration.
Management of guest virtual machines.
Installation, configuration, and management of the Sensor and Manager