When using the cognitix Threat Defender in your switched network, keep in mind that only traffic passing the Threat Defender can be analyzed.

Due to the network switch characteristics of the Threat Defender, only the sending and receiving ports can see the traffic.


Therefore, position the cognitix Threat Defender in front of the switch to protect the network behind.


If you just want to monitor the network traffic for the devices connected to a switch, you can setup the switch to send all the packages as a copy to the device the Threat Defender is connected to (mirroring or switch monitoring). Please check your switch documentation for this or contact the responsible support.

If you want to secure parts of your network, you have to be sure that all packages will be sent through the Threat Defender.

You can use a separate switch for the critical network part and connect the Threat Defender between.


For more details about layer 2 firewalling, see our cognitix homepage.