The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Trellix IPS fail-over architecture

Prev Next

Trellix IPS was built with high availability in mind. In fact, those who initially become confused by the possibilities around Trellix IPS fail-over usually do so because the implementation is actually simpler than they assume initially.

Note the following points regarding Trellix IPS fail-over architecture:

  • Sensors are invisible at layer 2 and above; the monitoring ports do not even have MAC addresses.

  • Sensors configured for failover confirm a "heartbeat" once each second.

  • Sensors configured for fail-over share flow information in real time.

As a result, you do not have to worry about Layer 2 and 3 topology changes when you introduce Trellix IPS fail-over into the environment; and in the unlikely event of a Sensor failure, fail-over is instantaneous and connection state is maintained.