Deploying Tap Mode
In most cases, the security device is deployed within the network as a serial node. However, in some other scenarios, an IT administrator would just want the auditing and statistical functions like IPS, antivirus, and Internet behavior control. For these features, you just need to connect the device to a mirrored interface of a core network. The traffic is mirrored to the security device for auditing and monitoring.
The bypass mode is created by binding a physical interface to a tap zone. Then, the interface becomes a bypass interface.
Use an Ethernet cable to connect e0 of the Switch with e1 of the
Here provides an example of monitoring IPS in tap mode.
- Select Object > Intrusion Prevention System.
- Click New.
- Enter the rule name.
- Configure the signatures settings.
- Configure the protocol settings.
- Click OK to complete IPS rule configuration.
A bypass control interface is used to send control packets (TCP RST packet is supported in current version). After configuring IPS, AV, or network behavior control on the Hillstone device, if the device detects network intrusions, viruses, or illegal network behaviors, it will send a TCP RST packet from e2 to the switch to tell it to reset the connections.
By default, the bypass interface itself is the control interface. However, you may also change the control interface.
To change a bypass control interface, you can only use the command line interface:
tap control-interface interface-name
interface-name- Specifies which interface is used as the bypass control interface.