4-34
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter4 Configuring Interfaces
Configuring Inline Bypass Mode
Caution
There are security consequences when you put the sensor in bypass mode. When bypass mode is on, the
traffic bypasses the sensor and is not inspected; therefore, the sensor cannot prevent malicious attacks.
Caution
As with signature updates, when the sensor applies a global correlation update, it may trigger bypass.
Whether or not bypass is triggered depends on the traffic load of the sensor and the size of the
signature/global correlation update. If bypass mode is turned off, an inline sensor stops passing traffic
while the update is being applied.
You can use inline bypass as a diagnostic tool and a failover protection mechanism. Normally, the sensor
Analysis Engine performs packet analysis. When inline bypass is activated, the Analysis Engine is
bypassed, allowing traffic to flow through the inline interfaces and inline VLAN pairs without
inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor
processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. There are
three modes: on, off, and automatic. By default, bypass mode is set to autom atic.
The inline bypass functionality is implemented in software, so it only functions when the operating
system is running. If the sensor is powered off or shut down, inline bypass does not work—traffic does
not flow through the sensor.
For IPS 4510 and IPS 4520, when the SensorApp is not ru nning or if bypass mode is on, the following
occurs:
•
The output from the packet capture/disp lay command does not show any packets.
•
The show interface and show interface interface_name commands do not show VLAN statistics.
Configuring Inline Bypass Mode
Use the bypass-mode command in the service interface submode to configure bypass mode. The
following options apply:
•
off—Turns off inline bypassing. Packet inspection is performed on inline data traffic. However,
inline traffic is interrupted if the Analysis Engine is stopped.
•
on—Turns on inline bypassing. No packet inspection is performed on the traffic. Inline traffic
continues to flow even if the Analysis Engine is stopped.
•
auto—Turns on automatic bypassing. The sensor automatically begins bypassing inline packet
inspection if the Analysis Engine stops processing packets. This prevents data interruption on inline
interfaces. This is the default.
Configuring Bypass Mode
To configure bypass mode, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter interface submode.
sensor# configure terminal
sensor(config)# service interface
Step 3
Configure bypass mode.
sensor(config-int)# bypass-mode off