<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2975524&amp;fmt=gif">
BLOG

Is There A Difference? Bypass Switch vs. Bypass TAP

September 7, 2016

I love talking with engineers and CISOs and listening to how they describe situations, devices and challenges within networking. The IT world loves acronyms, tech terms and jargon, but what surprises me is that manufacturers, resellers, technology partners and end users all define terms a little differently.

For example, the use of "Bypass Switch" and "Bypass TAP," as we come across this a lot being one of the leading manufactures of bypass TAPs.

The terms bypass switch vs. bypass TAP are interchangeable; however the products manufactured by switch and TAP vendors are not interchangeable. Each manufacturer has different features, regardless of bypass TAP vs. switch that need to be considered when deciding how to protect your inline appliance, while making the most use of your budget.

The technology behind Garland's EdgeSafeTM bypass TAPs, was invented in 2001 by Jerry Dillard, CTO/Co-Founder of Garland Technology, who invented bypass technology for an early intrusion prevention systems (IPS), later applying it as an external device, foreseeing the added resiliency to the solution.

"Knowing the loss of time and money was unacceptable, I designed the network bypass TAP. This solution continuously checked the health of the device and ensured the integrity of traffic flows regardless of their condition."

The term "Bypass switch" is used by Ixia, Apcon, and some other manufactures, but here are a few clear differences in Garland's Bypass TAPs.

Features Bypass Switch Garland EdgeSafe
Bypass TAP

Copy/sends full duplex traffic

Designed to support active, inline tools

During failsafe inline appliance still receives packets in 'breakout' TAP mode

X

Failsafe for tool failure

Failsafe for TAP/switch failure

Failsafe for power failure

Heartbeat inline tool health check

Supports inline bypass (normal mode): traffic flows through attached monitoring device

Supports out-of-band bypass (bypass mode): The monitoring device is bypassed and traffic flows directly between the network ports 

Supports breakout TAP mode: Operates as a full-duplex breakout TAP

Supports aggregation mode: Operates as an aggregator TAP and captures 100% full duplex network traffic

X

Supports regeneration/ SPAN mode: Operates in regeneration/SPAN mode to distribute the link’s traffic to up to three network tools

X
Built and supported in USA X

 

Download Now: 3 Keys to Network Resiliency - A Security Engineer's Go-to Guide to Avoiding Network Downtime [Free whitepaper]

 

Don't Bypass the Differences

We find people are not aware that Garland's EdgeSafeTM bypass TAP in failsafe mode still delivers the packets to the inline appliance. The competitors bypass switches do not do this, leaving the appliance blind to any network threats when in failsafe mode. Still receiving these packets, allows quicker MTTR to troubleshoot, optimize and get the tool back inline.

EdgeSafeTM bypass TAPs support the entire lifecycle of your appliance by being able to immediately switch modes for evaluation & optimization, validation and trouble-shooting & updates.
Modes-Sandbox3-1

 

An EdgeSafeTM bypass TAPs can also be repurposed in your network for use as a 'breakout' TAP, aggregation or regeneration/SPAN TAP, saving you money on as a multi-functional TAP.

Not Just Word Play

You can call it whatever term you prefer  - or we could make up a CamelCase for it and call it "switchTAP" or a "failsafe doohickie" But that seems just a bit contrived. However, as you're conducting your research, just be sure the features are what you need for 100% network uptime, visibility and access.

Looking to add a bypass solution to your security deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!

New call-to-action

See Everything. Secure Everything.

Contact us now to secure and optimized your network operations

Heartbeats Packets Inside the Bypass TAP

If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.

If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.

While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.

Some of you may have noticed a flaw in the logic behind this solution!  You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.

Glossary

  1. Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.

  2. Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.

  3. Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.

NETWORK MANAGEMENT | THE 101 SERIES