Span ports are changed to inline ports when the Sensor enters Layer 2 mode

Technical Articles ID: KB60703
Last Modified: 5/31/2022

Environment

Network Security Platform (NSP) M-series Sensor Appliance

Problem

For certain Sensor models, if you configure ports in Span mode, they receive traffic only. If you configure the Sensor for the Layer 2 mode, any internal error on the internal processors causes the Sensor to drop to the Layer 2 mode (instead of rebooting).

If you configure both ports of a port pair in Span mode and the Sensors go into the Layer 2 mode, the port configuration changes to inline. These ports then start transmitting packets received on one port to another port showing inline behavior.

NOTES:

On M-series platforms, the port pair is kept in Span mode until it's disabled and re-enabled.
The configuration for the Layer 2 mode is enabled by default on all M-series platforms: M-1250, M-1450, M-2750, M-2850, M-2950 M-3050, M-4050, M-6050 and M-8000. By disabling Layer 2, the Sensor reboots in situations that warrants the Sensor to recover from a critical error.

Solution

Disable the Layer 2 mode on the Sensor.

The NSP administrator can turn off the Layer 2 mode by issuing off the command Layer2 mode at the Sensor command-line interface prompt.

You can also disable the Layer 2 mode on the Manager:

Open the Network Security Manager.
Select the Sensor you want to disable Layer 2 on.
Select Troubleshooting, Layer 2 Settings.
Select Enable: NO on the Layer 2 Settings screen.
Click Refresh.

By disabling Layer 2, the Sensor reboots in situations that warrant the Sensor to recover from a critical error.

Workaround

Don't use port pairs for multiple Span ports.

If you use two Span ports, we recommend that you use non-pair ports (for example, 1A/2A, 1B/2B, or 10A/11A).

Related Information

There are no issues with switches configured with unidirectional Span ports, even if the Sensor drops to the Layer 2 mode and ports that are configured as Span start to transmit packets.

This condition might create a bridging loop in specific network configurations where VACLs are used to mirror traffic. You then might see duplicate MAC addresses in the local environment.

Affected Products

Hardware
Network Security Sensor Appliance 9.1.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Span ports are changed to inline ports when the Sensor enters Layer 2 mode

Environment

Problem

Solution

Workaround

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Span ports are changed to inline ports when the Sensor enters Layer 2 mode

Environment

Problem

Solution

Workaround

Related Information

Affected Products

Languages:

Choose your region

Title

Title