Okay, a bypass switch works at L1, and when an inline appliance like an IPS or firewall is connected to the bypass switch, the bypass switch simply grabs all traffic coming in an either side and redirects it through the inline appliance. There is no encap / decap of packets passing through the bypass switch, since it's L1 and does not recognize those high level headers.

However, what happens when the inline appliance fails and the bypass switch engages Bypass Mode? Do the packets passing through it have their destination IP or MAC changed to reflect the bypassing of the inline appliance? Or could it be that no changes to the destination MAC and IP takes place because the IPS and firewall ACT as L1 devices even though they actively analyze and process the higher level headers?

  • 1
    When an IPS, FW or any other device that has "L1 bypass" goes into bypass mode, it acts as a wire. No changing of headers, no buffering, no nothing. I'm not sure if that answers the question?
    – hertitu
    Oct 18 '16 at 10:11
  • Somewhat. I take it that no headers changed if the device is operating in transparent mode since it's just a bump in the wire but what if the device was operating as a route hop?
    – Johnny
    Oct 18 '16 at 11:13
  • 1
    I don't know of any L3 devices (route hops) that have a L1 bypass, I don't see how this could work since a route hop requires headers to be changed.
    – hertitu
    Oct 18 '16 at 11:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15 '17 at 4:36

If you have an appliance that works with the help of a bypass switch, then it MUST be operating in transparent mode - e.g.: it won't care what IP or even MAC traffic is destined for.

Traffic will be destined for a device past it (destination MAC will be an upstream router), and the bypass switch is merely used as a way of providing fail-over.

To prove this point - you should be able to remove the bypass switch and have traffic simply pass through your (IPS or whatever) device on it's way to whatever destination it was originally sent to, with MAC and IP address preserved.

  • Thanks for the explanation. I was not sure initially because i was asked once if the bypass switch will still work as a suitable failover if the attached appliance was operating as a route hop. I take it that such appliances are not meant to be attached to bypass switches?
    – Johnny
    Oct 19 '16 at 11:13
  • correct - if the appliance was a "router", then a bypass switch would not be appropriate - consider IP addressing for example.. nightmare ; ) Oct 19 '16 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.