When an in-line device experiences problems, most people's instinct is to physically pull it out of the path — to disconnect the cables and let traffic flow unimpeded while the device can be examined elsewhere. Trellix recommends you first try the following techniques to troubleshoot a Sensor issue:
All Sensors have a Layer2 Passthru feature. If you feel your Sensor is causing network disruption, before you remove it from the network, issue the following command:
layer2 mode assertThis pushes the Sensor into Layer2 Passthru (L2) mode, causing traffic to flow through the Sensor while bypassing the detection engine. Check to see whether your services are still affected. If they are, you have eliminated certain Sensor hardware issues and the problem could instead be a network issue or a configuration issue.
Note
The
layer2 mode deassertcommand pushes the Sensor back to detection mode.Trellix recommends that you configure Layer2 Passthru Mode on each Sensor. This enables you to set a threshold on the Sensor that pushes the Sensor into L2 bypass mode if the Sensor experiences a specified number of errors within a specified time frame. Traffic then continues to flow directly through the Sensor without passing to the detection engine.
Connect a fail-open kit, which consists of a bypass switch and a controller, to any GE monitoring port pairs on the Sensor. If a kit is attached to the Sensor, disabling the Sensor ports forces traffic to flow through the bypass switch, effectively pulling the Sensor out of the path.
Caution
Note that the Sensor will need to reboot to move out of L2 mode only if the Sensor entered L2 mode because of internal errors. (It does not need a reboot if the
layer2 mode assertcommand was used to put the Sensor into L2 mode).Caution
A Sensor reboot breaks the link connecting the devices on either side of the Sensor and requires the renegotiation of the network link between the two devices surrounding the Sensor.
Caution
Depending on the network equipment, this disruption may last from a couple of seconds to more than a minute with certain vendors' devices. A very brief link disruption might occur while the links are renegotiated to place the Sensor back in in-line mode.