Configuring SPAN mode using the CLI

Use the CLI commands in this topic to configure the Network Security appliance to receive network traffic from the SPAN ports of a device with port mirroring capabilities.

Setting	Description
Operational Mode	Select TAP mode to configure for TAP or SPAN deployments. tap—Monitors malicious traffic.
Policy Type	The following policy types are supported: mixed—Applies both local and global policies, and the local policy overrides the global policy (recommended). global—Applies Trellix-defined global policy to the specified interface. local—Applies user-defined local policy to the specified interface. none—Does not apply any policy. No policy is used.

For details about the SPAN deployment, refer to the User Guide for your appliance model.

Prerequisites

Operator or Admin access

To configure SPAN mode:

Enable the CLI configuration mode:

hostname > enable

hostname # configure terminal

Configure pair A (interfaces A1 and A2) in inline block mode:

hostname (config) # policymgr interface A op-mode tap policy-type mixed

hostname (config) # policymgr interface A re-configure

Save your changes:
```
hostname (config) # write memory
```

Check your configuration:

hostname (config) # show policymgr interfaces

Policy enabled: yes

Interface A
  Active   : yes
  op mode  : tap (tapping)
  fail-safe: open
  policy   : mixed
  tolerance: 1
  Ports    : pether3  pether4