Chapter 3 Determine Your High Availability Strategy; Failover, Or High-Availability - McAfee M-1250 - Network Security Platform Manual

C 3
H A P T E R
Determine your high availability strategy
Before you move your McAfee
impact of a Sensor outage and its effect on your network. In inline mode, the Sensor does
become a single point of failure. McAfee
options to minimize network downtime in the event of Sensor failure. For example,
Sensors support complete stateful failover, delivering the industry's first true high-
availability IPS deployment, similar to what you'd find with firewalls. If you're running the
Sensor in inline mode, McAfee recommends that you deploy two Sensors redundantly for
failover protection.
The following deployment options are available:
•

Failover, or High-Availability.

•
Fail-open or fail-closed functionality.
Fail-open with external hardware.
Fail-open with the Layer 2 Passthru (L2) feature
Failover, or High-Availability
Where redundancy is an essential requirement, it is best practice to implement Network
Security Platform 'high-availability' configuration. When running Sensors inline, this option
is available to an identical pair of Sensors (same model, software image, signature set)
deployed redundantly in inline mode. Both Sensors in the pair are active and share full
state, so that the information on both Sensors is always current. Latency is very minimal;
than other devices providing failover, such as, firewalls.
The keys to the Network Security Platform failover architecture are as follows:
Sensors configured for failover confirm a "heartbeat" once each second.
Sensors configured for failover share flow information in real time.
Sensors are invisible at Layer 2 and above; the monitoring ports do not have MAC
addresses.
As a result, you do not have to worry about Layer 2 and 3 topology changes when you
introduce Network Security Platform failover into the environment, and in the unlikely event
of a Sensor failure, failover is instantaneous and connection state is maintained.
All Sensor models support failover.
This subject is discussed in detail in the document
Availability
.
®
Network Security Sensor (Sensor) inline, consider the
®
Network Security Platform provides a variety of
Special Topics Guide—Sensor High
4