Configuring inline proxy mode using the CLI

Inline proxy deployment requires two network port pairs. This can be accomplished using a Network Security appliance with two port pairs, or one port pair from each of two Network Security appliances.

Use the CLI commands in this topic to set the following options to configure inline blocking mode for a proxy deployment.

Setting	Description
Operational Mode	The inline deployment has three operational modes. It is highly recommended that you set your appliance to inline blocking mode. Note If you set the operational mode to block traffic, input a fail-safe setting (block open or block close). block—Blocks malicious traffic (recommended). open—In case of failure, all traffic passes through (recommended). close—In case of failure, all traffic is blocked. (Use this setting only if the device is actively monitored). monitor—Monitors the traffic and generates alerts on malicious events. bypass—Forced bypass wherein the Network Security appliance neither blocks nor analyzes traffic. Note Starting with version 7.1.0, Network Security appliances bypass packets larger than 1650 bytes rather than dropping them.
Policy Type	The following policy types are supported: mixed—Applies both local and global policies, and the local policy overrides the global policy (recommended). global—Applies Trellix-defined global policy to the specified interface. local—Applies user-defined local policy to the specified interface. none—Does not apply any policy. No policy is used.

Setting

Description

Operational Mode

The inline deployment has three operational modes. It is highly recommended that you set your appliance to inline blocking mode.

Note
If you set the operational mode to block traffic, input a fail-safe setting (block open or block close).

block—Blocks malicious traffic (recommended).
- open—In case of failure, all traffic passes through (recommended).
- close—In case of failure, all traffic is blocked. (Use this setting only if the device is actively monitored).
monitor—Monitors the traffic and generates alerts on malicious events.
bypass—Forced bypass wherein the Network Security appliance neither blocks nor analyzes traffic.

Note
Starting with version 7.1.0, Network Security appliances bypass packets larger than 1650 bytes rather than dropping them.

Policy Type

The following policy types are supported:

mixed—Applies both local and global policies, and the local policy overrides the global policy (recommended).
global—Applies Trellix-defined global policy to the specified interface.
local—Applies user-defined local policy to the specified interface.
none—Does not apply any policy. No policy is used.

For details about inline proxy deployment, refer to the Hardware Administration Guide for your appliance model.

Prerequisites

Operator or admin access

Configuring inline proxy mode with one Network Security appliance

Use the CLI commands in this topic to configure deployment with one Network Security appliance with two network port pairs. Interface A connects the LAN-facing switch or router (A1) to the proxy server (A2). Interface B connects the LAN-facing switch or router (B1) to the Internet-facing switch or router (B2).

To configure interface A and interface B:

Enable the CLI configuration mode:

hostname > enable

hostname # configure terminal

Configure pair A (interfaces A1 and A2) and pair B (B1 and B2) in inline block mode:

hostname (config) # policymgr interface A op-mode block fail-safe open policy-type mixed

hostname (config) # policymgr interface A re-configure

hostname (config) # policymgr interface B op-mode block fail-safe open policy-type mixed

hostname (config) # policymgr interface B re-configure

Save your changes:
```
hostname (config) # write memory
```
Configure interface A2 to allow incoming traffic from the proxy server to pass through unblocked:
hostname (config) # policymgr network host <Proxy_IP_address> interface A2 allow
where Proxy_IP_address is the IP address of the server.
Save your changes:
```
hostname (config) # write memory
```

Check your configuration:

hostname (config) # show policymgr interfaces

Policy enabled: yes

Interface A
  Active   : yes
  op mode  : block (blocking)
  fail-safe: open
  policy   : mixed
  tolerance: 1
  Ports    : pether3  pether4

Interface B
  Active   : yes
  op mode  : block (blocking)
  fail-safe: open
  policy   : mixed
  tolerance: 1
  Ports    : pether5  pether6

Configuring inline proxy mode with two Network Security appliances

Use the CLI commands in this topic to configure a deployment with two Network Security appliances, each with one network port pair. NX Appliance1 connects to the proxy offline, and NX Appliance2 is between a LAN-facing switch or router and an Internet-facing switch or router.

To configure NX Appliance1:

Enable the CLI configuration mode:

hostname1 > enable

hostname1 # configure terminal

Configure pair A (interfaces A1 and A2) in inline block mode on the NX Appliance1:

hostname1 (config) # policymgr interface A op-mode block fail-safe open policy-type mixed

hostname1 (config) # policymgr interface A re-configure

Save your changes:
```
hostname1 (config) # write memory
```
Configure interface A2 to allow incoming traffic from the proxy server to pass through unblocked:
hostname1 (config) # policymgr network host <Proxy_IP_address> interface A2 allow
where Proxy_IP_address is the IP address of the server.
Save your changes:
```
hostname1 (config) # write memory
```

Check your configuration:

hostname1 (config) # show policymgr interfaces

Policy enabled: yes

Interface A
  Active   : yes
  op mode  : block (blocking)
  fail-safe: open
  policy   : mixed
  tolerance: 1
  Ports    : pether3  pether4

To configure NX Appliance2:

Enable the CLI configuration mode:

hostname2 > enable

hostname2 # configure terminal

Configure pair A (interfaces A1 and A2) in inline block mode:

hostname2 (config) # policymgr interface A op-mode block fail-safe open policy-type mixed

hostname2 (config) # policymgr interface A re-configure

Save your changes:
```
hostname2 (config) # write memory
```

Check your configuration:

hostname2 (config) # show policymgr interfaces

Policy enabled: yes

Interface A
  Active   : yes
  op mode  : block (blocking)
  fail-safe: open
  policy   : mixed
  tolerance: 1
  Ports    : pether3  pether4