Inline multi-proxy deployment requires two network port pairs. This can be accomplished using a Network Security appliance with two port pairs, or one port pair from each of two Network Security appliances.
Use the CLI commands in the following topics to configure inline blocking mode for an inline deployment with multiple proxies.
Note
Inline deployment has three operational modes. It is highly recommended that you set your appliance to inline blocking mode.
Note
If you set the operational mode to block traffic, input a fail-safe setting (block open or block close).
block—Blocks malicious traffic (recommended).
open—In case of failure, all traffic passes through (recommended).
close—In case of failure, all traffic is blocked. (Use this setting only if the device is actively monitored).
monitor—Monitors the traffic and generates alerts on malicious events.
bypass—Forced bypass wherein the Network Security appliance neither blocks nor analyzes traffic.
Note
Starting with version 7.1.0, Network Security appliances bypass packets larger than 1650 bytes rather than dropping them.
Note
The following policy types are supported:
mixed—Applies both local and global policies, and the local policy overrides the global policy (recommended).
global—Applies Trellix-defined global policy to the specified interface.
local—Applies user-defined local policy to the specified interface.
none—Does not apply any policy. No policy is used.
For details about inline deployment with multiple proxy servers, refer to the Hardware Administration Guide for your appliance model.
Operator or Admin access
Configuring inline multi-proxy mode with one Network Security appliance
Use the CLI commands in this topic to configure Network Security appliances with multiple network port pairs. Interface A connects the LAN-facing switch or router (A1) to the proxy server (A2). Interface B connects the LAN-facing switch or router (B1) to the Internet-facing switch or router (B2). Additional Network Security appliances connect to one or more additional proxy servers.
Enable the CLI configuration mode:
hostname1 > enable
hostname1 # configure terminal
hostname1 (config) # policymgr interface A re-configure
Configure pair A (interfaces A1 and A2) and pair B (B1 and B2) in inline block mode:
hostname1 (config) # policymgr interface A op-mode block fail-safe open policy-type mixed
hostname1 (config) # policymgr interface B op-mode block fail-safe open policy-type mixed
hostname1 (config) # policymgr interface B re-configure
Save your changes:
hostname1 (config) # write memory
Configure interface A2 to allow incoming traffic from the proxy server to pass through unblocked:
hostname1 (config) # policymgr network host <Proxy_IP_address> interface A2 allow where
Proxy_IP_addressis the IP address of the server.Save your changes:
hostname1 (config) # write memory
Enable the CLI configuration mode:
hostname > enablehostname # configure terminalConfigure pair A (interfaces A1 and A2) in inline blocking mode on each NX Appliance2–NX Appliancen:
hostname (config) # policymgr interface A op-mode block fail-safe open policy-type mixedhostname (config) # policymgr interface A re-configureSave your changes:
hostname (config) # write memoryConfigure interface A2 to allow incoming traffic from the proxy server to pass through unblocked on each appliance connected to a proxy server:
hostname (config) # policymgr network host <Proxy_IP_address> interface A2 allowwhere
Proxy_IP_addressis the IP address of the server.Save your changes:
hostname (config) # write memoryCheck your configuration:
hostname (config) # show policymgr interfaces
Policy enabled: yes
Interface A Active : yes op mode : block (blocking) fail-safe: open policy : mixed tolerance: 1 Ports : pether3 pether4 Interface B Active : yes op mode : block (blocking) fail-safe: open policy : mixed tolerance: 1 Ports : pether5 pether6
Configuring inline multi-proxy mode with two Network Security appliances
Use the CLI commands in this topic to configure deployment with two Network Security appliances with one network port pair each. NX Appliance1 is inline between a LAN-facing switch or router and an Internet-facing switch or router. NX Appliance2—NX Appliance n connect to multiple proxy servers offline.
Enable the CLI configuration mode:
hostname1 > enable
hostname1 # configure terminal
Configure pair A (interfaces A1 and A2) in inline block mode:
hostname1 (config) # policymgr interface A op-mode block fail-safe open policy-type mixed
hostname1 (config) # policymgr interface A re-configure
Save your changes:
hostname1 (config) # write memory
Check your configuration:
hostname1 (config) # show policymgr interfaces
Policy enabled: yes
Interface A Active : yes op mode : block (blocking) fail-safe: open policy : mixed tolerance: 1 Ports : pether3 pether4
Enable the CLI configuration mode:
hostname > enablehostname # configure terminalConfigure pair A (interfaces A1 and A2) in inline block mode on each NX Appliance2–NX Appliancen:
hostname (config) # policymgr interface A op-mode block fail-safe open policy-type mixedhostname (config) # policymgr interface A re-configureSave your changes:
hostname (config) # write memoryConfigure interface A2 to allow incoming traffic from the proxy server to pass through unblocked on each appliance connected to a proxy server:
hostname (config) # policymgr network host <Proxy_IP_address> interface A2 allowwhere
Proxy_IP_addressis the IP address of the server.Save your changes:
hostname (config) # write memoryCheck your configuration:
hostname (config) # show policymgr interfacesPolicy enabled: yes
Interface A Active : yes op mode : block (blocking) fail-safe: open policy : mixed tolerance: 1 Ports : pether3 pether4