Manage Selective Inspection

Selective inspection uses the Risk-Oriented Traffic Inspection (ROTI) method to aid the Intrusion Detection and Prevention System (IDPS Intrusion Detection and Prevention System (IDPS) monitors, detects, and prevents threats in the inbound and outbound traffic. Aruba IDPS provides an extra layer of protection that actively analyzes the network and takes actions on the traffic flows based on the defined rules. It inspects data packets, and if any threat is identified, acts real-time to prevent it.). HPE Aruba Networking Central provides threat vectors for defining how you want to do selective inspection on your traffic.

The following threat vectors are available:

1. Client Roles—Client roles are a combination of device or user roles.

2. Network Aliases—Network aliases are the aliases provided by you for easier identification and user-friendly management of the networking IP addresses.

Selective Inspection feature allows you to define a Traffic Treatment Type (T3) based on an identity. The T3 Bucket is the implementation of ROTI concept. T3 allows you to define a traffic treatment type for the threat vector.

By default, security inspection policy is assigned to the Risky T3 bucket, which implies that all system assigned (default) and administrator assigned traffic flows are evaluated for inspection. For more information, see Understanding Policy Evaluation.

If traffic inspection is already enabled, the existing configurations of IDS Intrusion Detection System. IDS monitors a network or systems for malicious activity or policy violations and reports its findings to the management system deployed in the network., IPS Intrusion Prevention System. The IPS monitors a network for malicious activities such as security threats or policy violations. The main function of an IPS is to identify suspicious activity, log the information, attempt to block the activity, and report it. , and the selected policy is inherited and displayed on the Selective Inspection page. The administrator can either use the inherited configuration or modify it.

Administrator can customize the following based on the security inspection requirements:

• T3 bucket names

• Policy association to T3 buckets

• Default policy assignment

• Default behavior

• Associating threat vectors to T3 bucket

• Prioritization between threat vectors

• Treatment for the trusted traffic

• The following are a few scenarios that serve as examples for customizing the selective inspection for Client Roles threat vector:

• If you want to retain the current behavior along with selective inspection, then keep the default as Risky. All traffic flows are inspected. For example, if IoT Internet of Things. IoT refers to the internetworking of devices that are embedded with electronics, software, sensors, and network connectivity features allowing data exchange over the Internet. devices are considered high risk, it must go through inspection. Critical users who may be target for attacks are also strong candidates for inspection.

• If you want to skip the inspection, change the default behavior and choose a T3 bucket that does not have a policy assigned or associate appropriate client roles and/or network aliases to the Safe T3 bucket. Vulnerability assessment tools are also security tools, which are typically not inspected. These devices may be assigned to a vulnerability assessment client role and then assigned to Safe bucket or its IP addresses may be added to a network alias and that may be assigned to Safe bucket.

  The source client role or network address is considered for the association and not the destination.

• If you do not want the default behavior, then assign client roles to a T3 bucket that does not have a policy assigned to it. For example, guests in the lobby may connect to the network only to browse Internet. Then, consider associating guest role to Safe T3 bucket that does not have a policy assigned.