topic Re: IPS 4240 fail open in Network Security

IPS 4240 fail open

pratik_193 — Sun, 10 Mar 2019 12:16:06 GMT

Hi All,

I have a single unit of IPS 4240. I want to know if my sensor or the unit itself fails/shutdowns, is there any option where in my traffic will be passed so that there is no downtime.

Thanks

Pratik

Re: IPS 4240 fail open

Jennifer Halim — Mon, 14 Feb 2011 07:55:58 GMT

You can configure the sensor when it's inline mode with inline-bypass mode "auto" so when the unit fails, it will just pass through the traffic without inspecting it, however, if the sensor is completely shutdown, then no, traffic will be dropped when it's in inline mode.

Here is more information on inline bypass mode:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_interfaces.html#wp1047079

However, if it's in promiscious mode, then you don't have to worry about it as the packet is not inline and will not cause interruption.

Hope that helps.

Re: IPS 4240 fail open

pratik_193 — Mon, 14 Feb 2011 08:33:26 GMT

Hi Jeniffer,

Thanks for your prompt response. Do you mean to say that if i put the IPS in inline mode & having a single unit, i do have a option of passing traffic if the unit itself goes down?

Thanks

Pratik

Re: IPS 4240 fail open

Jennifer Halim — Mon, 14 Feb 2011 08:39:43 GMT

If the unit is dead, the answer is NO, you can't pass traffic. However, if the unit fails due to its inspection engine not working, then yes, you can pass traffic

like passing traffic through wire (via the IPS).

Re: IPS 4240 fail open

rhermes — Mon, 14 Feb 2011 19:51:25 GMT

The sensor has to partially fail in order for it's failopen to work (it has to be sane enough to realize the sensor app has crashed then inact the failopen routine). To protect yourself form the inevitable sensor crash, hardware failure, reboot after update I would suggest you obtain an external FailOpen switch, or make one from an existing switch you have.
STP can be use to fail around a downed sensor nicely.

- Bob