Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

VLAN PAIRS Bypass or failover??

Hello Experts,

I´m implementing INLINE VLAN PAIRS in two 4260 and a 4270.

I know that the BYPASS is a software failover. But what is going to happen if the hardware fails????

Who is going to do the VLAN re-tagging???

What is going to happen with that traffic?

Is there are way to configure the switch to re-direct the traffic if the IPS is DOWN. of a way to do the re-tag in the switch?

I would really appreciate your comments and suggestions.


Re: VLAN PAIRS Bypass or failover??

You need to perform the failopen function outside the IPS sensor.

Use an external (to the sensor) switch, create two VLANS, connect them together via the sensor (each VALN to sensor connection is a Trunk with one one VLAN in it). Then create a second connection via a patch cable betwen the two VLANS, give it a higher STP metric, enable Spanning tree on these 4 ports. The bypass cable will only run traffic if the sensor stops passing BPDUs.

- Bob

Re: VLAN PAIRS Bypass or failover??

Hi rhermes,

I understood the STP part but not the connections part. I´m using only 1 interface to do the VLAN PAIR, the retag is being done in an interface.(and 1 interface in the switch). where should I connect the 4 ports.

Thank you for your time.


Re: VLAN PAIRS Bypass or failover??

If you're only using one interface on the sensor, then you only need three switch ports; one trunking both VLANS to the sensor and one port in each VLAN as a regular (non-trunked) access port connected together via a patch cable.

- Bob

Re: VLAN PAIRS Bypass or failover??


last question. Who is going to make the vlan re-tagging? will VLAN 1 be able to talk to VLAN2 ?

Cisco Employee

Re: VLAN PAIRS Bypass or failover??

The sensor knows the vlan tags, so he will change the vlan tags when bridging the vlans.

I hope it makes sense.



Re: VLAN PAIRS Bypass or failover??

When traffic flow through the IPS Sensor, the VLAN pair in the sensor will re-tag the traffic on the trunk port..

When the sensor stops passing layer 2 frames, Spanning trree Protocol will unblock the failover cable port and allow traffic to pass between VLAN 1 and VLAN2 untaged (these poerts are not trunks).

- Bob