Hack the Route Start free Open app Detection and response
Fail open and fail closed
What an inline security device does to traffic when it stops: let it all through, or let none through.
An inline device (an IPS, a firewall, a proxy) sits in the path, so its failure is the network's problem. Fail
open lets traffic pass unchecked while it is down: the network keeps working, unprotected (NFQUEUE's
--queue-bypass, a hardware bypass switch on an IPS appliance). Fail closed stops traffic: protected, and an
outage. Which one is a policy decision between availability and security. A passive sensor on a mirror port has no such
choice to make: when it stops, only visibility is lost.