Re: How does Internal Bypass mode work on Juniper IDP range

Hi,

Although not an expert let me share my experiences. Even in a transparent mo=
de the IDP works the packets through different buffers and memory spaces to s=
ubject the traffic to whatever you configured in NSM. In a rare occasion my c=
ustomer managed to trigger a bug that caused a buffer to fill up but not rel=
ease any traffic causing the IDP to crash. Which in its turn did not trigger=
 the fail open ( act like a wire if broken or out of power ). Then you will n=
otice something similar to what you are experiencing.=20

The challenge is to reproduce the crash and have juniper's TAC assess what's=
 wrong.=20

Only if you are also a customer running a very rare bug of course.=20

Good luck.=20

Barry Hofland

Op 26 okt. 2010 om 18:29 heeft Maqbool Hashim <[email protected]> het volg=
ende geschreven:

> Hi,
>=20
> I recently saw an outage in a network that had a Juniper IPS device deploy=
ed.  The outage consisted of tcp sessions timing out for users, ping connect=
ivity was not confirmed.  The IPS is deployed in transparent mode and Intern=
al Bypass is enabled on the ingress and egress interface pair that make up t=
he virtual router.   My understanding of the internal bypass feature is as f=
ollows as per the Juniper documentation:
>=20
> In bypass mode, traffic enters the IDP ingress port and is forwarded out o=
f the egress interface without being passed to the IDP engine.  The ingress a=
nd egress interface join mechanically to form a circuit in order to continue=
 passing traffic through the IPS device.  Effectively the interfaces become a=
 piece of wire.  Bypass mode is triggered by a timing mechanism during syste=
m failure or shutdown.  This feature has been enabled to optimise availabili=
ty and ensure that network outages do not occur because the IDS crashes/fail=
s/ or cannot process packets fast enough.
>=20
> I'm trying to determine the cause of the outage we suffered, which is why I=
 wanted a deeper understanding of internal bypass and the effects it may or m=
ay not have on the surrounding network architecture.  The outage I saw occur=
red at around the same time the IPS box rebooted and consequently entered by=
pass mode.  Bypass mode was only activated for a minute from the syslog entr=
ies, however the outage we saw lasted for approximately half an hour.=20
>=20
> So my questions regarding bypass mode are:
>=20
> 1) During bypass mode the link status on the IPS interfaces will be down. =
 Will the switch interfaces connected to the IPS device remain up as they ar=
e now connected to each other through the IPS (piece of wire) rather than to=
 the IPS interfaces?
>=20
> 2)  If the switch interfaces are now connected to each other rather than t=
he IPS what about mac forwarding tables?  Is it possible that the forwarding=
 tables on the switches get confused?
>=20
> 3) Any specific session based issues that could be caused by the IPS devic=
e engaging and disengaging internal bypass mode?
>=20
> My feeling is that the issues might be caused by how the network environme=
nt responds to the IPS engaging/disengaging internal bypass mode rather than=
 an issue with the IPS device.  I'm just looking for some guidance on any go=
tchas that I should be aware of with regards to the network environment when=
 the IPS device triggers bypass mode.
>=20
> Thanks
>=20
> Maq=20
>=20
>=20
>=20
> ----------------------------------------------------------------------
> This e-mail and any files transmitted with it are confidential and intende=
d solely for the use of the individual or entity to whom they are addressed.=
 If you are not an intended recipient, please delete this e-mail immediately=
 and notify NTS(UK) Ltd on 0844 815 5925
> This e-mail does not necessarily reflect the Company's opinion and should n=
ot be interpreted as such.
> This message was scanned by Proofpoint Protection Server - please contact N=
TS for further information.
>=20
> -----------------------------------------------------------------
> Securing Your Online Data Transfer with SSL.
> A guide to understanding SSL certificates, how they operate and their appl=
ication. By making use of an SSL certificate on your web server, you can sec=
urely collect sensitive information online, and increase business by giving y=
our customers confidence that their transactions are safe.
> http://www.dinclinx.com/Redirect.aspx?36;5001;25;1371;0;1;946;9a80e04e1a17=
f194
>=20
>=20

-----------------------------------------------------------------
Securing Your Online Data Transfer with SSL.
A guide to understanding SSL certificates, how they operate and their application. By making use of an SSL certificate on your web server, you can securely collect sensitive information online, and increase business by giving your customers confidence that their transactions are safe.
http://www.dinclinx.com/Redirect.aspx?36;5001;25;1371;0;1;946;9a80e04e1a17f194