H3C Technologies H3C SecBlade IPS Cards - Manual (Page 46)

3-18
z Bypass connection means that the device is not on the link where data is forwarded. Therefore, the
device captures data packets by receiving traffic mirroring and detecting duplicate packets, and it
cannot take security actions directly and can only take security actions through response packets,
as shown in Figure 3-16 .
Figure 3-16 Network diagram for bypass connection
IPS
Response port
General port Monitor port
General device
Mirroring port
Configuring Operating Mode
Select System Management > Device Management > Operating Mode from the navigation tree to
enter the operating mode page, as shown in Figure 3-17 .
Figure 3-17 Operating mode page
Table 3-12 describes operating mode configuration items.
Table 3-12 Operating mode configuration items
Item Description
Connecting Mode
Select the connecting mode: directly connected or bypassed.
For network diagram for direct connection, see Figure 3-15 ; for network diagram for
bypass connection, see Figure 3-16 .
Application Mode
Set the application mode: report logs only or integrated function set.
z Report logs only: Only sends log packets to the specified device or host, and no
blocking or interfering actions are taken.
z Integrated function set: Sends log packets to the specified device or host, and
blocking or interfering actions are taken.