To improve the attack detection, the traffic distribution between the monitoring ports is redesigned. The monitoring ports are paired such that the traffic from the odd port pairs (G1/1, G1/2) and (G1/5, G1/6) is directed to the local front end of the Sensor, and the traffic from the even port pairs (G1/3, G1/4) and (G1/7, G1/8) is directed to the remote front end of the Sensor. Port cluster in tap mode is configured in a manner where the traffic is being forwarded to the same front end of the Sensor. Port clustering is applicable to ports G1, G2, G3, G5, G6, and G7. Ports G0 and G4 are used as interconnect ports for communication between the primary and secondary Sensors.
The following modules are used for port clustering in an NS9300 Sensor:
Fixed Gigabit Ethernet-Copper Ports
Network I/O Modules
8 port (SFP+/SFP) 10/1 GigE
6 port RJ-45 10/100/1000 Mbps
4 port (QSFP+) 40 GigE
4 port (QSFP+) 10 GigE
Examples
An 8 ‑Port 10GigE network interface module consists of 2 odd port pairs and 2 even port pairs:
Ports 1 and 2 are considered as an odd port pair 1
Ports 3 and 4 are considered as an even port pair 2
Ports 5 and 6 are considered as an odd port pair 3
Ports 7 and 8 are considered as an even port pair 4
Scenario 1: If the P-Unit (Primary Sensor) of NS9300 Sensor has an 8 port (SFP+/SFP) 10/1 GigE (G1) network interface module and the S-Unit (Secondary Sensor) of NS9300 Sensor has an 8 port (SFP+/SFP) 10/1 GigE (G5) network interface module, the distribution of traffic from a single source (client/ server) should be either sent to the local front end or the remote front-end of the Sensor, such as:
The traffic from ports (G1/1, G1/2) and (G1/5, G1/6) is directed to the local front end of the primary Sensor.
The traffic from ports (G1/3, G1/4) and (G1/7, G1/8) is directed to the remote front end of the secondary Sensor.
The traffic from ports (G5/1, G5/2) and (G5/5, G5/6) is directed to the local front end of the secondary Sensor.
The traffic from ports (G5/3, G5/4) and (G5/7, G5/8) is directed to the remote front end of the primary Sensor.
Scenario 2: If the existing port cluster setup is for two port pairs (G1/1, G1/2) and (G1/3, G1/4), re-configure to use port pairs (G1/1, G1/2) and (G1/5, G1/6) to accommodate the new design.
Scenario 3: If the existing port cluster setup is for three port pairs — (G1/1, G1/2), (G1/3, G1/4) from the P-Unit (Primary Sensor) and (G5/1, G5/2) from the S-Unit (Secondary Sensor) — of NS9300 Sensor, reconfigure to use either of the following port pairs to accommodate the new design.
(G1/1, G1/2) port pair from the current configuration and add two new port pairs (G1/5, G1/6) and (G5/3, G5/4) to ensure traffic distribution happens at the P-Unit (Primary Sensor) of NS9300 Sensor.
(G1/1, G1/2) port pair from the current configuration and add two new port pairs (G5/3, G5/4) and (G5/7, G5/8) to ensure traffic distribution happens at the P-Unit (Primary Sensor) of NS9300 Sensor.
(G1/3, G1/4) and (G5/1, G5/2) port pairs from the current configuration and add one new port pair (G1/7, G1/8) to ensure traffic distribution happens at the S-Unit (Secondary Sensor) of NS9300 Sensor.
(G1/3, G1/4) and (G5/1, G5/2) port pairs from the current configuration and add one new port pair (G5/5, G5/6) to ensure traffic distribution happens at the S-Unit (Secondary Sensor) of NS9300 Sensor.
Scenario 4: If the existing port cluster setup is of four port pairs — (G1/1, G1/2) and (G1/3, G1/4) from the P-Unit (Primary Sensor) and port pairs (G5/1, G5/2) and (G5/3, G5/4) from the S-Unit (Secondary Sensor) — of NS9300 Sensor, reconfigure to use either of the following port pairs to accommodate the new design.
(G1/1, G1/2) and (G5/3, G5/4) port pairs of the current configuration and add two new port pairs (G1/5, G1/6) and (G5/7, G5/8) to ensure traffic distribution happens at the P-Unit (Primary Sensor) of NS9300 Sensor.
(G1/3, G1/4) and (G5/1, G5/2) port pairs of the current configuration and add two new port pairs (G1/7, G1/8) and (G5/5, G5/6) to ensure traffic distribution happens at the S-Unit (Secondary Sensor) of NS9300 Sensor.
Refer to the following table to accommodate the design change for port clustering in various interface modules in an NS9300 Sensor:
Modules | Odd and Even Port Pairs |
|---|---|
8 port (SFP+/SFP) 10/1 GigE | Odd port pairs: G1: (G1/1, G1/2) and (G1/5, G1/6) G2: (G2/1, G2/2) and (G2/5, G2/6) G5: (G5/1, G5/2) and (G5/5, G5/6) G6: (G6/1, G6/2) and (G6/5, G6/6) Even port pairs: G1: (G1/3, G1/4) and (G1/7, G1/8) G2: (G2/3, G2/4) and (G2/7, G2/8) G5: (G5/3, G5/4) and (G5/7, G5/8) G6: (G6/3, G6/4) and (G6/7, G6/8) |
6 port RJ-45 10/100/1000 Mbps | Odd port pairs: G1: (G1/1, G1/2) and (G1/5, G1/6) G2: (G2/1, G2/2) and (G2/5, G2/6) G5: (G5/1, G5/2) and (G5/5, G5/6) G6: (G6/1, G6/2) and (G6/5, G6/6) Even port pairs: G1: (G1/3, G1/4) G2: (G2/3, G2/4) G5: (G5/3, G5/4) G6: (G6/3, G6/4) |
4 port (QSFP+) 40 GigE | Odd port pairs: G1: (G1/1, G1/2) G2: (G2/1, G2/2) G5: (G5/1, G5/2) G6: (G6/1, G6/2) Even port pairs: G1: (G1/3, G1/4) G2: (G2/3, G2/4) G5: (G5/3, G5/4) G6: (G6/3, G6/4) |
Fixed Gigabit Ethernet-Copper Ports | Odd port pairs: G3: (G3/1, G3/2) and (G3/5, G3/6) G7: (G7/1, G7/2) and (G7/5, G7/6) Even port pairs: G3: (G3/3, G3/4) and (G3/7, G3/8) G7: (G7/3, G7/4) and (G7/7, G7/8) |