The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Layer 2 passthru mode

Prev Next

Fail-open operation provides a measure of network integrity when a Sensor fails. When a Sensor with ports operating in In-line Fail-Open Mode experiences a critical fault, the Sensor might restart; during the restart, the Sensor goes into fail-open mode until it restarts. If a critical fault occurs again, another restart cycle might be initiated. In some cases, this can continue until acted upon through human intervention.

You can enable a failure threshold to automatically initiate fail-open, or passthru, mode by configuring the Layer 2 Passthru feature from the Manager user interface. This feature enables you to set a threshold on the number of critical failures within a configured period of time that the Sensor can experience before being forced into Layer2 passthru mode.

For example, you configure Layer 2 Passthru mode to be enabled if there are three critical faults in any 10-minute period. At minutes 1, 3, and 7, faults occur; L2 mode is enabled. Here is another scenario: at minutes 1, 4, 11, and 13, faults occur. In this case, the last three faults occurred within 10 minutes of each other, thus the Sensor enters L2 mode.

Sensor restart may take a few minutes to complete. This downtime is not counted against the L2 duration; only Sensor uptime is counted.

The L2 feature is supported by all NS-series Sensor models.