I'm trying to determine if you can have a 2-gig Layer-3 Port-channel going thru an IPS 4260 appliance. See attached diagram. Is this possible?
The client I'm working with would prefer not to break this Port-channel into equal-cost 1-gig links (I don't think there will be any performance difference...) However I'm thinking if they want the appliance inline like the diagram shows - they will need to break the port-channel. Is that a correct assumption?
Asymmetric traffic will prevent the sensor functioning the best it is capable. There is a configuration that can be made to allow the sensor to deployed in an asymmetric environment, BUT it can negatively affect the sensor ability to detect attacks, allows through evasions that would have otherwise been prevented, and will in general affect sensor performance.
So running in asymetric mode should be avoided if at all possible. Bt in those situations where it can't then the sensor can still be used with degraded functionality.
Traffic spikes above what the sensor can handle will cause dropped packets. There is no fail-open for too much traffic.
The fail-open you are referring to I am assuming is the bypass mode feature. The bypass feature does not affect over subscription of the sensor. The bypass feature will only kick in if the analysis engine crashes because of a bug.