The Active Fail-Open (AFO) kits minimize the potential risks of in-line Sensor failure on critical network links. You need to purchase these kits separately. Copper versions of the kit are available for the 1Gbps ports. Fiber versions of the kit are available for 10Gbps and 1Gbps ports.
The Monitoring ports of the Sensors can be fail-close; thus, if the Sensor is deployed in-line fail-close, a hardware failure results in network downtime.
While the Sensor is operating, the AFO kit is in-line and routes all traffic directly through the Sensor. When the Sensor fails, the AFO kit automatically shifts to a bypass state; in-line traffic continues to flow through the network link but is no longer routed through the Sensor. After the Sensor resumes normal operation, the AFO kit returns to the "in-line" state, to resume in-line monitoring. The port pairs with AFO kits resume in-line mode after a Sensor resumes normal operation or is in good health.
The NS3600 Sensors have built-in RJ-45 and Fiber ports with fail-open and support active fail-open when connected to an active fail-open kit.
Caution
Sensor outage breaks the link connecting the devices on either side of the Sensor for a brief moment and requires the renegotiation of the network link between the two peer devices connected to the Sensor. Depending on the network equipment, this disruption introduced by renegotiating the link layer between the two peer devices might range from a couple of seconds to more than a minute with certain vendors' devices.
Caution
A very brief link disruption might also occur while the links between the Sensor and each of the peer devices are renegotiated to place the Sensor back in in-line mode. This outage, again, varies depending on the device and can range from a few seconds to more than a minute.
The performance of the switchover from in-line to bypass and vice versa varies depending on the vendor.
You can find the installation and troubleshooting instructions for the kit in the guide that accompanies the kit. For detailed information on the Modular AFO kits, refer to the Trellix Intrusion Prevention System Fail-Open Kit Product Guide.