When inline IPS's are powercycled...

Question

using the CLI (or gui) reset command, will network traffic continue to pass through if the IPS is configured for inline mode?
I know i could find out in a matter of minutes, but i'd rather not mess with our live network ;)

Answer 1

The HW ByPass Switches generally have both Electronic and Mechanical mechanisms for controlling the ByPass functionality.
The Electronic Mechanisms are what the HW ByPass Switch will use while it is receiving power. It will electronically be monitoring the link between the itself and the 2 sensor ports (the 2 sensor ports being used for inline monitoring).
If the link goes down, then the HW ByPass Switch can electronically detect the link down, and will ByPass the sensor.
If, however, the HW ByPass Switch itself loses power, then this is when the Mechanical mechanism kicks in.
On power loss the HW ByPass Switch will immediately loose any link to the sensor (ByPasssing the sensor regardless of whether or not the sensor is up ).
And mechanically the other 2 interfaces of the HW ByPass Switch (the 2 connected to the other devices, aka the switches and/or routers and/or firewalls) will connect to each other and act like a simple wire. The HW ByPass Switch turns into just an expensive wire when it looses power.
So the HW ByPass Switch is capable of passing traffic when it looses power. It will not send traffic to the sensor when it has lost power, but will allow the other 2 devices to send traffic to each other (hence the ByPass).
Now I see there has been confusion between a Tap and and a HW ByPass Switch.
These are 2 separate pieces of hardware.
A TAP is used only for promiscuous monitoring. It only Copies packets to the sensor, and can not be used with an InLine sensor for InLine monitoring.
A HW ByPass Switch is only used for InLine monitoring. It sends the real packet through the sensor, and so can not be used with a promiscuous sensor because all packets would go to the sensor and never come back to the HW ByPass Switch.
Some of the confusion is that some vendors like NetOptics produces both Taps and HW ByPass Switches. So when you go to make your purchase you will need to be very clear on whether you want a Tap for promisucous monitoring or a HW ByPass Switch for InLine monitoring.
What you will also find out is that the technology for Taps and for HW ByPass Switches are complimentary. And it would not surprise me that in a year or 2 you woudl start seeing hybrid boxes that can be configured to work as a Tap OR a HW ByPass Switch (similar to how Cisco IPS Sensors can be configured for promiscuous IDS or inline IPS)