This scenario involves inspecting the traffic going to and coming out of virtual servers installed on an ESX. In this deployment, the Sensor monitoring port acts as a gateway to the protected servers.
Scenario description before Virtual Sensor deployment
The servers are installed on guest VMs on the ESX.
These servers are connected to a standard vSwitch — vSwitch0.
vSwitch0 has a physical adapter, which is connected to networks outside the ESX.
.png "GUID-4DE66EB2-FAB9-4C53-8ADE-37D1527D6E3C-low.png")
Scenario description after Virtual Sensor deployment
Two more standard vSwitches (vSwitch1 and vSwitch2) are now added.
The Virtual Sensor is deployed on the ESX.
The Manager is installed on a VM connected to vSwitch2.
The management port of the Virtual Sensor is connected to vSwitch2. This virtual switch has a physical adapter. So, you can access the Manager and the Sensor from outside the ESX.
The monitoring port pair 1-2 of the Virtual Sensor is inline between external network through vmnic0 and the server farm on the ESX.
The servers and the monitoring port 1 are connected to two different port groups in vSwitch0. The port group to which the monitoring port is connected is set to promiscuous mode.
Monitoring port 2 is connected to vSwitch1, which is in turn connected to external network through vmnic0. Therefore, any traffic to the servers from the outside network is inspected by the port pair 1-2.
Note
Note that the monitoring port 1 is connected to a promiscuous switch port group on vSwitch0. Therefore, the Sensor will inspect traffic between Server 1 and Server 2 as well though it is not inline. Effectively, this acts as if monitoring port 1 is in SPAN mode. To avoid the Sensor from inspecting the traffic between the servers, define ACLs on the Sensor accordingly.
.png "GUID-21211FB4-F8B7-4E6E-9FBD-E5CEA64D340A-low.png")