Let me explain that there are 3 types of ByPass: Software ByPass, Hardware ByPass, and Parent Chassis ByPass.
Software ByPass:
Is available on sensors (both modules and appliances).
So long as the Operating System and Driver are still functioning the underlying IPS applications can fail, and the driver itself can "ByPass" the traffic. The driver will read in the packet and turn it right back around. Either sending it out the other interface of the interface pair, or out the same interface on the other VLAN of the vlan pair. Or in the case of modules, read in the packet and send it right back to the parent chassis.
The analysis engine is "bypassed" so the packets are not analyzed.
This can be triggered to happen in 3 ways:
1) When the analysis engine IPS application crashes
2) When the analysis engine is processing new configuration and/or an upgrade
3) The customer specifically turns on the ByPass feature
Hardware ByPass:
The IPS-4260 and IPS-4270 have a Copper ByPass Gigabit Ethernet card. There are 4 ports on the card that can be made into 2 interface pairs. If the box is powered off, then the 2 port of the interface pair will mechanically connect together to have that pair now act as a wire. The 2 other devices that were connected to the interface pair are now connected together.
Software ByPass takes care of the ByPass functionality most of the time, and HW ByPass kicks in when the OS and driver go down (generally because of power loss).
The fiber gigabit ethernet, and fiber 10 gigabit ethernet cards in the 4260 and 4270 do not support HW ByPass.
For these cards, as well as interfaces from all Other IPS Appliances you can use an external HW ByPass Switch. Try checking NetOptics if you are interested in a HW ByPass Switch.
NOTE: HW ByPass only works for inline interface pairing. It does not work with inline vlan pairing.
Software ByPass works with both inline interface pairing and inline vlan pairing.
Parent Chassis ByPass:
This differs depending on the module type.
All modules support Software ByPass, so the parent chassis only needs to do something in cases where Software ByPass doesn't work (reboots, major OS crash)
The SSC-5, SSM-10, SSM-20, and SSM-40 are all modules for ASA firewalls.
If the ASA is configured in failover mode, then the failure of an SSM will cause the ASA to failover to the other ASA.
If only one ASA is being used, then the configuration line in the ASA config for sending traffic to the SSM can be configured for "fail-open" or "fail-close". In "fail-open" the ASA bypasses the SSM and sends the packets through without analysis if the SSM fails (this would be the euivalent of HW ByPass).
In "fail-close" the ASA will drop traffic when the SSM fails. This is generally only used in high security environments where traffic MUST be analyzed before being allowed in the network.
The AIM-IPS, and NME-IPS are router moduls. And the router has similar fail-open and fail-close configuration to allow or drop packets on AIM-IPS or NME-IPS failure.
The IDSM-2 is a switch module. The switch, however, does not have any type of built-in bypass method. Instead you would need to design a second network path that could be used if the IDSM-2 failed. The common method is using a wire for the second path (the wire connects the same 2 vlans being paired by the IDSM-2). Spanning tree is then configured to prefer the IDSM-2, and only fall back to the wire if the IDSM-2 fails.
NOTE: The same wire and spanning-tree method can be used for the Appliances as well.
Hope this information helps.
