Layer 2 Firewall deployment in Passive Firewall mode

In Passive Firewall mode, a Layer 2 Firewall inspects but does not actively filter traffic.

Layer 2 Firewalls can be deployed in Passive Firewall mode in two ways:

In capture mode to inspect packets that have been duplicated for inspection through SPAN or mirror ports.
In passive inline mode by setting the engine to only log connections by default.

In a capture mode installation, packets are duplicated for inspection through a SPAN or mirror port on a switch/router. In a Layer 2 Firewall Cluster, each node must be connected to a SPAN or mirror port of its own.

When you select Only Log Connection mode for the global Default Connection Termination, you can deploy Layer 2 Firewalls in Passive Firewall mode in an inline configuration.