TMS zl Management and Configuration Guide ST.1.1.100430

1-33
Overview
Deployment Models for Monitor Mode—Threat Detection
2. Create a mirror session for which the TMS zl Module’s data port (port 1)
is the destination exit port. For the session source, specify ports, trunks,
or VLANs on the module’s switch. If you are using remote mirroring,
configure a mirror session on each remote switch. The TMS zl Module’s
host switch should be the destination.
For instructions, see the Management and Configuration Guide for the
ProCurve Series 3500yl, 6200yl, and 5400zl Switches and the 8212zl
Switch.
3. Access the TMS zl Module’s CLI through the host switch’s CLI.
4. Install the HP ProCurve TMS zl Module Product License and the HP
ProCurve IPS-subscription License.
For more detailed instructions on this step, see “Activate the TMS zl
Module” in Chapter 3: “Initial Setup in Monitor Mode.”
5. Set the TMS zl Module’s operating mode to monitor mode.
See “Monitor Mode” on page 1-10 for an overview and “Access the TMS zl
Module’s CLI” in Chapter 3: “Initial Setup in Monitor Mode” for detailed
instructions.
6. Configure the management VLAN and assign the module an IP address in
this VLAN.
The management VLAN is automatically untagged on the module’s inter-
nal port 2. For more detailed instructions on this step, see “To configure
these settings, follow these steps:” on page 3-25 in Chapter 3: “Initial Setup
in Monitor Mode.”
7. Create a default route to a router in the management VLAN.
For more detailed instructions on this step, see “Access the TMS zl
Module’s CLI” in Chapter 3: “Initial Setup in Monitor Mode.”
If you prefer, you can now access the TMS zl Module’s Web browser interface
and complete the remaining tasks.
8. Configure the TMS zl Module’s IDS.
See “IDS/IPS” on page 1-36 for an overview and Chapter 6: “Intrusion
Detection and Prevention” for detailed instructions.
9. Configure log forwarding. (See “Configuring Event Logging” in Chapter 3:
“Initial Setup in Monitor Mode.”)