You should already be familiar with the terms Virtual IDS (VIDS), Virtual IPS (VIPS), and sub-interfaces.
These terms all refer to a concept more generally known as virtualization. The goal of virtualization is to provide scanning granularity. Virtualization enables an administrator to apply different policies to different groups of traffic flowing through a single Sensor port or port pair.
The terms VIDS and VIPS reinforce the idea that virtualization allows you to tailor a single Sensor solution as if it was a multiple-Sensor solution. Trellix IPS user interface uses the term sub-interface, however, and this term better describes the process by which virtualization is implemented. For this reason, we will use the term sub-interface here.
The easiest way to cover the implementation and benefits of virtualization is to start with a non-virtual Sensor implementation and work our way to multiple sub-interfaces.
All eight ports inherit and use the policy applied to the Sensor. You can apply a unique policy to each port, and many people do. This notion of hierarchy is important to remember at the outset of the discussion because, as you will soon see, sub-interfaces also take advantage of the power of the hierarchical Trellix IPS management design.
Note
This chapter discusses the concepts and procedures related to virtualization of Sensor monitoring ports. These virtualization concepts and procedures explained in this chapter apply to both physical and Virtual IPS Sensors. However, for information on how to deploy Virtual IPS Sensors, see Virtual IPS Sensor deployment .