3 Replies Latest reply on Nov 25, 2009 9:27 AM by Sweep

    Intrushield sensor behavior

      Does anybody knows what will be the behavior of a sensor when it is in fail open and INLINE and I try to reboot it?  the traffic still flows?

        • 1. Re: IntruShield Sensor behavior
          Jdyton

          I've done a KB search (it's good to test the KB using others requests)

           

          KB Search Search term: Sensor Behavior. (to begin with)

           

          Results: 37.

           

          Standout article - KB56085 Expected packet loss when using the Sensor Fail Open mode.

           

          KB Search Search term: Sensor Reboot Behavior.

           

          Results: 37.

           

          Conclusion and tasks: Article contains word Reboots, search fails to recognise this. Will edit article to reflect question and improve search results, I will report search findings to the rest of the KB with a view to improving the search.

           

          Let me know if the article answers your questions.

           

          regards Jonathan Dyton

          • 2. Re: Intrushield sensor behavior

            You may loss a couple of packets as the relay kicks in to switch to fail open - most traffic won't even notice it, things like web traffic will just continue as if anything was dropped it just retries. Same when the box comes back up.

            • 3. Re: Intrushield sensor behavior

              I would say that the dropped traffic depends on the size of the sensor...

               

              In my experience if it is a large sensor with an external fail-open kit then the drop tends to not be seen at all as the external FOK takes over

              If it is a smaller device with an inbuilt FOK then there will be a loss of 2-3 pings (depending on network performance)