Trellix IPS is engineered to seamlessly slip onto networks within existing networks and between redundant paths. This simplifies implementing a Sensor HA pair in complicated environments. However, introducing a Sensor HA pair in a network with a single path requires additional effort.
A pair of Sensors can run in parallel on a network as shown in the following figure.
.png)
Here, a pair of Sensors are "sandwiched" between a pair of switches and STP is used to control the failover process. However, this causes one Sensor to be redundant, unless a fail-over occurs. This in turn complicates the Layer 2 infrastructure and causes a latency of 12 to 50 seconds due to the STP convergence.
Instead, consider the configuration in the below figure for a single path:
.png "GUID-C3D8E0FB-EDA7-4DB8-B570-4E48846A2286-low.png")
Note
To view the list of failover ports used for each Sensor model refer to HA pair cable connections. If you are using stacked Sensors, the failover port is G1/1.
These Sensors are configured to run inline, failopen, and function as a HA pair.
The advantages of this redundant configuration over others on a network with a single path are as follows:
There is no dependency on Layer 2 or Layer 3 topologies for Sensor redundancy.
If one Sensor fails, it fails open, and the other Sensor continues to scan with no interruption.
Because they are configured as a HA pair, state will be maintained.
The disadvantages of this redundant configuration are as follows:
Duplicate alerts are generated for UDP and ICMP attacks.
Latency is induced as the packets traverse across two Sensors instead of one.