Trellix IPS is engineered to seamlessly slip onto networks within existing networks and between redundant paths. This simplifies implementing a Sensor HA pair in complicated environments. However, introducing a Sensor HA pair in a network with a single path requires additional effort.
A pair of Sensors can run in parallel on a network as shown in the following figure.
.png)
Here, a pair of Sensors are "sandwiched" between a pair of switches and STP is used to control the failover process. However, this causes one Sensor to be redundant, unless a fail-over occurs. This in turn complicates the Layer 2 infrastructure and causes a latency of 12 to 50 seconds due to the STP convergence.
Instead, consider the configuration in the below figure for a single path:
.png)
Note
A crossover cable is required to make the connection between the Sensor monitoring ports.
These Sensors are configured to run inline, failopen, and function as a HA pair.
The advantages of this redundant configuration over others on a network with a single path are as follows:
- There is no dependency on Layer 2 or Layer 3 topologies for Sensor redundancy.
- If one Sensor fails, it fails open, and the other Sensor continues to scan with no interruption.
- Because they are configured as a HA pair, state will be maintained.
The disadvantages of this redundant configuration are as follows:
- Duplicate alerts are generated for UDP and ICMP attacks.
- Latency is induced as the packets traverse across two Sensors instead of one.