1. Introduction, Setting

1-35

[Koban Sensor] We are operating multiple IP networks on a single Ethernet segment. After connecting a single 1‑I/F sensor to this network, it was able to detect devices from all IP subnets. Are there any operational issues with this setup?

Since there are considerations such as those listed in (1) through (4), we recommend preparing sensors for each IP subnet if any of these points pose operational issues for you.

For more information on this matter, please also refer to the following Q&A.

"1-33. [Koban Sensor] We are operating multiple IP networks on a single Ethernet segment. In such an environment, is it possible to monitor each IP network independently?"

(1) In the network map, devices from multiple subnets are being displayed together under a single network location.

(2) In policies that use the "Detected Source Network" as part of the rule definition, such as the "Unregistered IP Address Range" rule, it is not possible to configure separate policy settings for each individual IP network.

(3) A 1‑I/F sensor cannot detect the default gateway's IP address and MAC address for IP subnets other than the one to which it is directly connected. As a result, devices in those other IP subnets that should be subject to communication blocking may still be able to communicate through their gateway.

(4) The manager issues communication‑blocking instructions to the sensor based on the network information specified when the sensor's monitoring interface is registered with the manager. If the Koban Sensor's setting under "Communication Blocking Settings" → "Restrict Transmission of Blocking Packets" is configured to "Use all IP addresses in the monitored IP subnet for blocking", communication blocking may not function correctly for devices that belong to subnets other than the one configured on the monitoring interface. Therefore, please use the default setting, "Use only the detected IP address for communication blocking".