Configuring port mirroring for Kaspersky Industrial CyberSecurity for Networks

Expand all | Collapse all

For correct operation, Kaspersky Industrial CyberSecurity for Networks must receive a copy of network traffic sent from the industrial network switch configured to transmit mirrored network packets to the assigned network port. This technology of network traffic mirroring is called Switched Port Analyzer (SPAN) or Port Mirroring.

Below are port mirroring configuration examples for some Ethernet switch models, which can be used in the industrial network infrastructure:

• Cisco Access and Distribution Switches

  You can configure a SPAN session for Cisco Access and Distribution switches (for example, Cisco Catalyst 2960 and Cisco Catalyst 3850) using the switch command line interface. To do this, access the target switch via Ethernet or console port and open the switch management functions. In configuration mode, create a new monitoring session, select a range of source interfaces to mirror and analyze traffic, set the destination interface and save the configuration.

  For more information about configuring port mirroring for Cisco Access and Distribution switches, refer to Cisco hardware documentation.

  To configure port mirroring for Cisco Access and Distribution switches:

  1. From the privileged EXEC mode, enter the global configuration mode using the following command:

     conf t /

  2. To view the existing monitor sessions, enter the following command:

     show monitor session all /

  3. If necessary, delete the existing monitor session:

     no monitor session <session number> /

     where <session number> is the number of the monitor session to be deleted. You can specify a value from 1 to 66. You can use the following keywords instead of the session number:

     • all – to delete all monitor sessions
     • local – to delete local monitor sessions
     • remote – to delete remote monitoring sessions
  4. Specify the source port numbers:

     monitor session <session number> source interface <source port>/<VLAN ID> - <source port>/<VLAN ID> /

     where:

     • <session number> – monitor session number
     • <source port> – source port number
     • <VLAN ID> – VLAN identifier
  5. Specify the destination port numbers:

     monitor session <session number> destination interface <destination port> / <destination port> encapsulation replicate /

     where:

     • <session number> – monitoring session number
     • < destination port> – number of the destination port
  6. Return to the privileged EXEC mode using the following command:

     end /

  7. To check the monitor session configuration, enter the following command:

     show monitor /

  8. To activate SPAN settings after rebooting the switch, save the monitor session configuration to a configuration file:

     copy running-config startup-config /

• Cisco Small Business switches

  For more information on configuring Cisco Small Business switches, refer to Cisco documentation.

  To configure port mirroring for Cisco Small Business switches:

  1. Connect to the switch and open port mirroring settings in the switch web interface.
  2. Select Administration → Diagnostics → Port and VLAN mirroring section.
  3. Add source interfaces and select the destination interface.
  4. Save the changes.
• Hirschmann Industrial Ethernet Switches

  For more information about configuring port mirroring for Hirschmann Industrial Ethernet switches, refer to Hirschmann hardware documentation.

  To configure port mirroring for Hirschmann Industrial Ethernet switches:

  1. Connect to the switch.
  2. In the switch web interface , select Diagnostics → Port Mirroring.
  3. As a source, select all the necessary RX and TX ports for ingress and egress monitoring.
  4. Select the destination port to be connected to Kaspersky Industrial CyberSecurity for Networks device.
  5. To enable mirroring, select On in the Operation section, and then select Set.

     Changes will be applied to the volatile memory (RAM) of the device.

  6. To save the changes permanently, open the dialog window and click Save.
• Siemens SCALANCE Switches

  For more information about configuring port mirroring for Siemens SCALANCE switches, refer to Siemens hardware documentation.

  To configure port mirroring for Siemens SCALANCE switches:

  1. Connect to the switch web interface and select Layer 2 → Mirroring.
  2. To create a mirroring session:
     1. Select the General tab.
     2. Enable Mirroring.
     3. To create a record in the table, click the Create button.

        The session ID is assigned automatically.

     4. In the Session Type drop-down list, select the Port Based value.
     5. Click the Set Values button.
     6. In the Destination Port column, select the destination port.

        For example, P0.8.

     7. Click the Set Values button.
  3. Select the Port tab.
  4. In the Port tab follow these steps:
     1. In the Session ID drop-down list, select the ID of the session you created earlier in the General tab.
     2. To monitor all data traffic of a port, select all the ports in the table in the Ingress and Egress columns.
     3. Click the Set Values button.
• Siemens RUGGEDCOM i800, i801, i802, i803 Switches

  For more information about configuring port mirroring for Siemens RUGGEDCOM switches, refer to Siemens hardware documentation.

  To configure port mirroring for Siemens RUGGEDCOM i800, i801, i802, i803 switches:

  1. Connect to the switch web interface.

     Default connection to the device is established via IP address 192.168.0.1/24.

  2. Select Ethernet Ports → Configure Port Mirroring.
  3. For the Port Mirroring setting, select Enabled.
  4. Specify the source port number in the Source Port setting.
  5. For the Source Direction setting, select Egress and Ingress.
  6. Specify the destination port number in the Target Port setting.
  7. Click the Apply button.

You can get similar information about configuring other models of switches in the documentation for your network equipment.