The Active Fail-Open (AFO) kits minimize the potential risks of in-line Sensor failure on critical network links. You need to purchase these kits separately. The AFO kits are available for 100 Gigabit, 40 Gigabit, 10 Gigabit, and 1 Gigabit fiber ports as well as 1 Gigabit copper ports.
The Monitoring ports of the Sensors can be fail-close; thus, if the Sensor is deployed in-line fail-close, a hardware failure results in network downtime. Except the 4-port 100/40 Gigabit fiber (with internal fail-open) interface modules (that is, 100/40 Gigabit SR MTP/MPO, 40 Gigabit LR4, 100 Gigabit LR4, and 100/40 Gigabit BiDi), 6-port RJ45 10/1 Gigabit Ethernet interface module, and 8-port 10/1 Gigabit fiber interface module which come with built-in fail-open functionality, you may use the external bypass switch provided in an AFO kit for the built-in G0 Monitoring ports and 4-port 100/40 Gigabit SR MTP/MPO interface module to fail-open externally in NS9600 Sensor.
While the Sensor is operating, the AFO kit is in-line and routes all traffic directly through the Sensor. When the Sensor fails, the AFO kit automatically shifts to a bypass state; in-line traffic continues to flow through the network link but is no longer routed through the Sensor. After the Sensor resumes normal operation, the AFO kit returns to the "in-line" state, to resume in-line monitoring. The port pairs with AFO kits resume in-line mode after a Sensor resumes normal operation or is in good health.
In NS9600 Sensor:
Built-in G0 slot includes 4 QSFP28 /QSFP+ 100/40 Gigabit Ethernet ports, which supports active fail-open mode using a 100 Gigabit or 40 Gigabit AFO kit.
G1, G2, and G3 slots support built-in fail-open and active fail-open mode for the following network interface modules:
G1 and G2 slots support:
4-port 100/40 Gigabit SR MTP/MPO, which supports active fail-open mode using a 100 Gigabit or 40 Gigabit AFO kit.
4-port 100/40 Gigabit SR MTP/MPO with internal fail-open
4-port 40 Gigabit LR4 with internal fail-open
4-port 100 Gigabit LR4 with internal fail-open
4-port 100/40 Gigabit BiDi with internal fail-open
G1, G2, and G3 slots support:
6-port RJ45 10/1 Gigabit Ethernet with internal fail-open
8-port 10/1 Gigabit fiber SM 8.5 micron with internal fail-open
8-port 10/1 Gigabit fiber MM 50/62.5 micron with internal fail-open
Important
The 4-port 100/40 Gigabit with internal fail open interface modules (that is, 100/40 Gigabit SR MTP/MPO, 40 Gigabit LR4, 100 Gigabit LR4, and 100/40 Gigabit BiDi) are supported in NS9600 Sensors running on 11.1 Update 8 version or later.
Caution
Sensor outage breaks the link connecting the devices on either side of the Sensor for a brief moment and requires the renegotiation of the network link between the two peer devices connected to the Sensor. Depending on the network equipment, this disruption introduced by the renegotiation of the link layer between the two peer devices might range from a couple of seconds to more than a minute with certain vendors' devices.
Caution
A very brief link disruption might also occur while the links between the Sensor and each of the peer devices are renegotiated to place the Sensor back in in-line mode. This outage, again, varies depending on the device, and can range from a few seconds to more than a minute.
The performance of the switchover from in-line to bypass and vice versa varies depending on the vendor.
You can find the installation and troubleshooting instructions for the kit in the guide that accompanies the kit. For detailed information on the Modular AFO kits, refer to Trellix Intrusion Prevention System Fail-Open Kit Product Guide.