Inserting a dumb hub between the firewall and switch? 1

[achilleus]

Hi all...Thanks in advance for any help you can offer...

I am using CheckPoint FW NG and I also want to start using SurfControl for website monitoring...My question is that I need to place the SurfControl machine in such a position that it can listen to all the packets passing out of the network; as we use NAT, I need to place it between the firewall and the office switch; if I stick a dumb hub between the firewall and office switch, will I loose much performance?...

I thought of putting it between the firewall and router, but as the office hides behind a static NAT address, I couldnt tell who was going where...

Thanks again! AJ
SA
HS

 

[jimbopalmer]

Ok, well configured you should not be limiting your bandwidth up to T1 speeds, the slowest ethernet is 10 meg.

the firewall and the router should expect half duplex, the hub can be 100 meg if all 3 devices can go 100 meg, otherwise 10 meg is fine for up to T1 (1.5 meg)

the Surf control box should mostly be watching packets not adding them.

another option is a protocol my switch vendor (nortel) calls Port Mirroring, where all I/O to and /or from one port of the switch is mirrored to a second port, there would be no downside to port mirroring at all. I tried to remain child-like, all I acheived was childish.

 

[achilleus]

Thanks for the info jimbopalmer! It sounds like the port mirroring option would be perfect. I have to find out if my hp procurve switch 4000m supports this feature. Would be perfect for this.

I'll let you know what I find. AJ
SA
HS

 

[jimbopalmer]

I went on the HP site and got a manual in pdf, it describes "Network Monitoring Port " as being what Notel calls Port Mirroring and says the 4000M has one!


ftp://ftp.hp.com/pub/networking/software/59692320.pdf

Chapter 6 page 34 in the manual, page 110 in the PDF I tried to remain child-like, all I acheived was childish.

 

[achilleus]

You are my hero. Really. Thank you so much! AJ
SA
HS

 

[johnny99]

Just a short comment about using 10 Mbit hubs.

Running anything other then Full-Duplex can give you a lot of "funny" problems that sometimes can be very difficult to find.

Using a mirror port is the right way to go. That is also what we do in our installation.

We have ISS on a port on the outside switch on a mirror port on an Extreme Summit24 switch and another mirror port on the inside on an Extreme BlackDiamond switch.

/johnny

 

[achilleus]

It seems to work very well (the mirroring)...The only issue I am seeing is that it only seems to see the traffic from the one switch and not all three (I have three HP ProCurve switches; with one setup as master)...The mirroring is set up on the master, but only sees the traffic from the one switch...

AJ
SA
HS