topic Re: VLAN PAIRS Bypass or failover?? in Network Security

VLAN PAIRS Bypass or failover??

Diego Armando Cambronero Arias — Sun, 10 Mar 2019 12:01:12 GMT

Hello Experts,

I´m implementing INLINE VLAN PAIRS in two 4260 and a 4270.

I know that the BYPASS is a software failover. But what is going to happen if the hardware fails????

Who is going to do the VLAN re-tagging???

What is going to happen with that traffic?

Is there are way to configure the switch to re-direct the traffic if the IPS is DOWN. of a way to do the re-tag in the switch?

I would really appreciate your comments and suggestions.

Re: VLAN PAIRS Bypass or failover??

rhermes — Mon, 07 Jun 2010 17:00:28 GMT

You need to perform the failopen function outside the IPS sensor.

Use an external (to the sensor) switch, create two VLANS, connect them together via the sensor (each VALN to sensor connection is a Trunk with one one VLAN in it). Then create a second connection via a patch cable betwen the two VLANS, give it a higher STP metric, enable Spanning tree on these 4 ports. The bypass cable will only run traffic if the sensor stops passing BPDUs.

- Bob

Re: VLAN PAIRS Bypass or failover??

Diego Armando Cambronero Arias — Mon, 07 Jun 2010 17:28:36 GMT

Hi rhermes,

I understood the STP part but not the connections part. I´m using only 1 interface to do the VLAN PAIR, the retag is being done in an interface.(and 1 interface in the switch). where should I connect the 4 ports.

Thank you for your time.

Re: VLAN PAIRS Bypass or failover??

rhermes — Mon, 07 Jun 2010 18:31:16 GMT

If you're only using one interface on the sensor, then you only need three switch ports; one trunking both VLANS to the sensor and one port in each VLAN as a regular (non-trunked) access port connected together via a patch cable.

- Bob

Re: VLAN PAIRS Bypass or failover??

Diego Armando Cambronero Arias — Tue, 08 Jun 2010 17:57:11 GMT

Hello,

last question. Who is going to make the vlan re-tagging? will VLAN 1 be able to talk to VLAN2 ?

Re: VLAN PAIRS Bypass or failover??

Panos Kampanakis — Tue, 08 Jun 2010 23:58:07 GMT

The sensor knows the vlan tags, so he will change the vlan tags when bridging the vlans.

I hope it makes sense.

Re: VLAN PAIRS Bypass or failover??

rhermes — Wed, 09 Jun 2010 05:17:28 GMT

When traffic flow through the IPS Sensor, the VLAN pair in the sensor will re-tag the traffic on the trunk port..

When the sensor stops passing layer 2 frames, Spanning trree Protocol will unblock the failover cable port and allow traffic to pass between VLAN 1 and VLAN2 untaged (these poerts are not trunks).

- Bob