Introduction

The Forum Sentry API Security Gateways (hardware and virtual) support multiple network topology modes. Before physical installation, Sentry Administrators must decide which network topology mode best matches your network structure.

 Network configuration options for Sentry include:

• One port mode (recommended)
• In-line 2 IP Addresses mode

In-Line 2 IP mode is rarely used, and One-Port mode is recommended.   Please contact Forum Support if you believe you may need In-Line 2 IP mode as this mode can create issues with routing if your network is not properly configured.

Topology Modes

One Port Mode

This is the Forum Systems recommended mode to use.

In the 1-port mode configuration, Sentry processes all runtime traffic using only the WAN interface.  Management traffic for the devices (WebAdmin and SSH) is done via the MGMT port, usually in a different subnet. With this configuration 2 interfaces would be physically connected to the network. 

Notes:  

• It is possible to move the MGMT interface for management traffic to either the WAN or LAN.  For instance, in One Port mode you could have all management and runtime traffic use a single physical interface (WAN). This is common with POCs.
• if the MGMT and WAN interfaces are in the same subnet the Management Filter needs to be disabled, see: https://helpdesk.forumsys.com/entries/98406903-FAQ-Can-the-MGMT-and-WAN-Interfaces-both-be-on-the-same-Network-

 In-line 2 IP Addresses Mode

Please contact Forum Support before configuring this mode to determine if you actually need it.  This mode is rarely used and requires specific aspects of your network and routing are configured properly.

With in-line configuration with 2 IP addresses, Sentry uses 2 network interfaces for bi-directional network traffic via distinct IPs. In-line configuration means that traffic traverses between LAN and WAN interfaces and requires routing to be configured to allow this type of configuration.  This does not add any additional security over 1-port mode, so 1-port mode is recommended as it greatly simplifies routing settings and issues that may occur in your network routes.  Management traffic for the devices (WebAdmin and SSH) is done via the MGMT port, usually in a different subnet. With this configuration 3 interfaces would be physically connected to the network.

Physical Interfaces on the Sentry 656X and 656X Rev C Models

WAN Port: The WAN port, the right most of the two upper NIC ports next to each other on the right half of the rear of the gateway, is used in both in-line and 1-port modes for data traffic. With in-line mode, the WAN port should be the external-facing (Internet) port, connected to whichever upstream device (router, firewall, etc.) is applicable. In 1-port mode, only the WAN port is used for data traffic. When in in-line or 1-port mode, traffic is directed to the security system based on the defined IP(s) on the system.

MGMT Port: Sentry management traffic is handled out-of-band using the lower left most NIC port on the rear of the gateway. This means that management connectivity and associated network traffic are provided from an interface that is separate from the interface(s) used for regular traffic. Access to the Command Line Interface (CLI) and the WebAdmin is provided on this interface. The MGMT interface can be moved to the WAN port after initial setup if you want to simplify the configuration to use only a single NIC interface.

LAN Port (unused):  The LAN port, the right most of the two upper NIC ports next to each other on the right half of the rear of the gateway, is only used in in-line mode. This is the internal-facing port, connected to the internal network or a network device that provides connectivity to the internal network.

There is a single MANAGEMENT IP address on the device that applies to the Management Ethernet interface only. The IP address used for the MANAGEMENT port is completely independent of whether the device is configured to run in in-line or 1-port mode. The MANAGEMENT port must have an IP associated, even if you intend to manage the product via the WAN or LAN interface. If you do not have a physical network connection to the MANAGEMENT interface, set the IP to the non-routable IP, 169.254.0.1, per RFC 3330.

Console Port: The DB9 (serial) port at the left rear of the gateway next to the power supplies is used for connecting the product console for direct CLI access.

Smart Card Reader Serial Connector: The smart card reader (HSM models only) is the small round connector on the bottom left hand side of the gateway which is used for HSM configuration.

System Schematics: The diagram below displays the back of the Forum Sentry 656X and 656X Rev C gateways.

For more information on topology modes and the initial setup of the Sentry gateway please see the attached Hardware Installation Guide and/or the VirtualOS Installation guide.