The Active Fail-Open (AFO) kits minimize the potential risks of in-line Sensor failure on critical network links. You need to purchase these kits separately. The AFO kits are available for 10 Gigabit and 1 Gigabit fiber ports as well as 1 Gigabit copper ports.
The Monitoring ports of the Sensors can be fail-close; thus, if the Sensor is deployed in-line fail-close, a hardware failure results in network downtime. Except the 6-port RJ45 10/1 Gigabit Ethernet interface module and 8-port 10/1 Gigabit fiber interface module which come with built-in fail-open functionality, you may use the external bypass switch provided in an AFO kit for the built-in G0 Monitoring ports to fail-open externally in NS7600 Sensor.
While the Sensor is operating, the AFO kit is in-line and routes all traffic directly through the Sensor. When the Sensor fails, the AFO kit automatically shifts to a bypass state; in-line traffic continues to flow through the network link but is no longer routed through the Sensor. After the Sensor resumes normal operation, the AFO kit returns to the "in-line" state, to resume in-line monitoring. The port pairs with AFO kits resume in-line mode after a Sensor resumes normal operation or is in good health.
In NS7600 Sensor:
Built-in G0 slot includes 4 SFP/SFP+ 1/10 Gigabit Ethernet ports, which supports active fail-open mode using a Copper 1 Gigabit and Fiber 1/10 Gigabit AFO kit.
G1, G2, and G3 slots support built-in fail-open and active fail-open mode for the following network interface modules:
8-port 10/1 Gigabit fiber SM 8.5 micron with internal fail-open
8-port 10/1 Gigabit fiber MM 50/62.5 micron with internal fail-open
6-port RJ45 10/1 Gigabit Ethernet with internal fail-open
Caution
Sensor outage breaks the link connecting the devices on either side of the Sensor for a brief moment and requires the renegotiation of the network link between the two peer devices connected to the Sensor. Depending on the network equipment, this disruption introduced by the renegotiation of the link layer between the two peer devices might range from a couple of seconds to more than a minute with certain vendors' devices.
Caution
A very brief link disruption might also occur while the links between the Sensor and each of the peer devices are renegotiated to place the Sensor back in in-line mode. This outage, again, varies depending on the device, and can range from a few seconds to more than a minute.
The performance of the switchover from in-line to bypass and vice versa varies depending on the vendor.
You can find the installation and troubleshooting instructions for the kit in the guide that accompanies the kit. For detailed information on the Modular AFO kits, refer to Trellix Intrusion Prevention System Fail-Open Kit Product Guide.