Cisco Cisco IPS 4255 Sensor Installationsanleitung

Hardware bypass complements the existing software bypass feature in Cisco IPS. The following 
conditions apply to hardware bypass and software bypass:

When bypass is set to OFF, software bypass is not active.

For each inline interface for which hardware bypass is available, the component interfaces are set to 
disable the fail-open capability. If SensorApp fails, the sensor is powered off, reset, or if the NIC 
interface drivers fail or are unloaded, the paired interfaces enter the fail-closed state (no traffic flows 
through inline interface or inline VLAN subinterfaces).

When bypass is set to ON, software bypass is active.

Software bypass forwards packets between the paired physical interfaces in each inline interface and 
between the paired VLANs in each inline VLAN subinterface. For each inline interface on which 
hardware bypass is available, the component interfaces are set to standby mode. If the sensor is 
powered off, reset, or if the NIC interfaces fail or are unloaded, those paired interfaces enter 
fail-open state in hardware (traffic flows unimpeded through inline interface). Any other inline 
interfaces enter fail-closed state.

When bypass is set to AUTO (traffic flows without inspection), software bypass is activated if 
SensorApp fails. 

For each inline interface on which hardware bypass is available, the component interfaces are set to 
standby mode. If the sensor is powered off, reset, or if the NIC interfaces fail or are unloaded, those 
paired interfaces enter fail-open state in hardware. Any other inline interfaces enter the fail-closed 
state.

To test fail-over, set the bypass mode to ON or AUTO, create one or more inline interfaces and power 
down the sensor and verify that traffic still flows through the inline path. 

To use the hardware bypass feature on the 4GE bypass interface card, you must pair interfaces to support 
the hardware design of the card. If you create an inline interface that pairs a hardware-bypass-capable 
interface with an interface that violates one or more of the hardware-bypass configuration restrictions, 
hardware bypass is deactivated on the inline interface and you receive a warning message similar to the 
following:

Hardware bypass functionality is not available on Inline-interface pair0. 

Physical-interface GigabitEthernet2/0 is capable of performing hardware bypass only when 

paired with GigabitEthernet2/1, and both interfaces are enabled and configured with the 

same speed and duplex settings.

The following configuration restrictions apply to hardware bypass:

The 4-port bypass card is only supported on IPS-4260 and IPS 4270-20.

Fail-open hardware bypass only works on inline interfaces (interface pairs), not on inline VLAN 
pairs.

Fail-open hardware bypass is available on an inline interface if all of the following conditions are 
met:

Both of the physical interfaces support hardware bypass.

Both of the physical interfaces are on the same interface card.

The two physical interfaces are associated in hardware as a bypass pair.