Introduction

A summary of the physical network appliances and their specifications.  This article will also summarise Primary Vs Secondary  appliances, an overview of the cabling for port-mirrored & inline configurations, analytics and conclude with physical appliance specifications.

Table of contents

• Overview of Physical Appliances
• Primary Vs Secondary Appliances
• Deploying Appliances
  • Appliance Connections
  • Deployment Configurations (Port Mirrored or Inline)
• Appliance Analytics
  • Network Analytic Categories
• Physical Appliance Specifications

Overview of Physical Appliances

Our physical network appliances are installed within your infrastructure to power Field Effect MDR's network monitoring capabilities. Available in several form factors to accommodate different network and storage requirements, appliances can be used as either a primary or secondary appliance and deployed in either a port mirrored or inline configuration. 

Once deployed in the network, it captures, stores, and analyzes all packet traffic leaving or entering. Endpoint device telemetry is also relayed to the appropriate appliance, via endpoint agent, for analysis. 

As the primary appliance receives data from the network, endpoint devices, and any other secondary sensors sending telemetry, the sensor technology on the primary appliance analyzes it. Field Effect MDR will then either act to stop a threat (example: Active Response) or report on a risk via ARO, report, or dashboard.

This article outlines the two appliance types (primary and secondary), the form factors available for them, how they can be deployed (port mirrored or inline), and the analytic capabilities within the appliance’s sensor technology.

Primary Vs Secondary Appliances

Primary appliances have our sensor technology installed, which analyzes all of your organization’s data and telemetry. If your organization has a single Field Effect appliance, it is the primary appliance collecting and analyzing all data.

If your organization has several appliances deployed across several locations and networks, one appliance (usually deployed at the headquarters) will be assigned as the primary appliance. Secondary appliances may be installed in other network or branch locations and do not analyze data – they only relay collected data to the primary appliance for analysis.

Deploying Appliances

The following section outlines the different connections used for our appliances and the available deployment configurations.

Appliance Connections

There are several color-coded connection ports on each appliance, and they are used for the following:

Deployment Configurations (Port Mirrored or Inline)

Traffic monitoring via the MDR appliance is passive. During normal operations, the appliance will not interfere with traffic. If the appliance is reset or powered off, the network card has a feature that bypasses the ports, maintaining the network connection.

Our appliances can be deployed in either a port mirrored or an inline configuration. For more on deploying our appliance, visit our knowledge base for general deployment guides, or guides specific to your appliance.

• Port Mirrored Configuration:
  • In a port-mirrored configuration, the appliance is connected out-of-band to a single LAN interface. Your network equipment (firewall or switch) must be configured to enable port mirroring (also called spanning port), to copy and send traffic from tagged ports to a single destination port. . 
• Inline Configuration:
  • The appliance sits in between your network's primary switch and firewall. All network traffic is directly passed from the switch, through the appliance, and then out to the firewall.

Appliance Analytics

Primary appliances perform high-resolution deep packet inspection and protocol analysis on all IPv4 and IPv6 network traffic that passes through, or is mirrored to, the primary appliance. For additional analysis, Field Effect can collect syslog or NetFlow data from the network and retains raw data as packet captures (PCAPs) where possible.

Field Effect extracts information from network traffic that supports security monitoring. This includes passively identifying network services and fingerprinting devices, collecting DNS resolutions, monitoring connections, and identifying scans. The network sensor technology evaluates network signatures to alert on known malicious activity.

The appliance performs the following operations:

Network Analytic Categories

The following section outlines the threat surface and threat detection categories used by the appliance’s on-device sensor technology that are relevant to network monitoring.

Physical Appliance Specifications

If you would like to see images of each appliance, please visit the configuration guide for your appliance.

* Appliances are managed remotely by Field Effect.
 ** These ports are listed for information only and aren’t relevant for the management of the appliance or Field Effect.