Where redundancy is an essential requirement, it is best practice to implement Trellix IPS 'high-availability' configuration. When running Sensors inline, this option is available to an identical pair of Sensors (same model, software image, signature set) deployed redundantly in inline mode. Both Sensors in the pair are active and share full state, so that the information on both Sensors is always current. Latency is very minimal compared to other devices providing failover, such as, firewalls.
The keys to the Trellix IPS failover architecture are as follows:
Sensors configured for failover confirm a heartbeat once each second.
Sensors configured for failover share flow information in real time.
Sensors are invisible at Layer 2 and above; the monitoring ports do not have MAC addresses.
As a result, you do not have to worry about Layer 2 and 3 topology changes when you introduce Trellix IPS failover into the environment, and in the unlikely event of a Sensor failure, failover is instantaneous and connection state is maintained.
All NS-series Sensor models except NS3500 support failover.