Visibility 101 See all 9 deployment scenarios: full diagrams, architecture details, free PDF Get All 9 Scenarios
A Field Guide

Inline security,
without the downtime.

Inline tools only protect you when traffic flows through them, so a tool that fails or needs an update can take your whole network down with it. Here's how to deploy them without the risk.

4 Best Practices
9 Real-World Scenarios
10M–100G Bandwidth Coverage
[ 01 ]    The Premise

Every inline tool sits in the live traffic path, so when one fails or needs an update, it can take the network down with it. These four practices remove that single point of failure, one layer at a time.

Best Practice 01

Protect every inline tool with a Bypass TAP.

The Risk

An inline tool is a single point of failure. If it hangs, loses power, or needs an update, the network goes down with it.

The Fix

A Bypass TAP heartbeats the tool nonstop. The instant a beat doesn't return, traffic bypasses the tool automatically, so the link never drops.

FIG. 01 / BYPASS AUTO-BYPASS ROUTER SWITCH BYPASS TAP EXTERNAL NGFW INLINE TOOL ♥ HEARTBEAT NGFW OFFLINE ♥ FLATLINE → BYPASS
Best Practice 02

Chain your tools, isolate the one that fails.

FIG. 02 / CHAIN ISOLATE FAILURE NETWORK EDGELENS FOCUS INLINE BYPASS NGFW WAF DLP IPS ♥ ALL TOOLS HEALTHY IPS ISOLATED ♥ IPS FLATLINE → ISOLATED
The Risk

Chain several tools the native way and one failure breaks the whole path, with no clue which tool died.

The Fix

EdgeLens Focus heartbeats each tool on its own. When one flatlines, it's isolated while the rest keep inspecting.

  • Chain up to 4 toolsEach one independently monitored.
  • Load balanceSpread traffic across the chain.
Best Practice 03

Stay online with automatic failover.

The Risk

Two redundant tools. Both need critical updates. But the network can't be down.

The Fix

Run two tools as an HA pair. When the active one flatlines, traffic swings to the standby instantly, with zero gap.

FIG. 03 / HA AUTO-FAILOVER ROUTER NETWORK EDGELENS BYPASS IPS EDGELENS BYPASS IPS ACTIVE STANDBY ♥ ACTIVE PATH LIVE IPS ACTIVE DOWN NOW ACTIVE ♥ FLATLINE → FAILOVER
Best Practice 04

Manage both inline and out-of-band tools.

FIG. 04 / INLINE + OUT-OF-BAND 100% VISIBILITY ROUTER SWITCH OUT-OF-BAND PKT CAPTURE SIEM WIRESHARK IDS EDGELENS FOCUS INLINE BYPASS NGFW ENTITY 1 INLINE ♥ UPTIME + 100% VISIBILITY
The Risk

It is no longer feasible to rely on a single firewall to protect the network. Those days are long gone. Multiple cybersecurity solutions are needed to protect and defend a network: both inline and out-of-band tools.

The Fix

An EdgeLens Focus ensures network uptime and 100% network visibility: it manages the availability of inline tools while its packet broker feeds out-of-band monitoring like threat detection, packet capture, and performance monitoring.

[ Editorial Note ]
"Security should never cost you uptime. External bypass means you never choose."
Garland Technology, on deploying inline tools without risk

External bypass vs. built-in.

Built-in bypass usually triggers only on a full power loss, not the hangs, crashes, and congestion behind most outages. And it can't feed your out-of-band tools.

An external Bypass TAP is independent: it actively monitors the tool, covers far more failure modes, and lets you update or pilot tools safely.

Built-in bypass protects the box. External bypass protects the network.
[ The Full Guide ]

Nine scenarios. Every diagram. One PDF.

This page covers the principles. The full guide walks through nine real-world deployments, with a complete architecture diagram for each.

Inline Security Tools Best Practices Guide cover
AOne Bypass TAP protecting a single inline tool
BTaking an IPS offline for updates with zero downtime
CChaining multiple inline tools through one bypass
DLoad balancing traffic across chained tools
EIsolating a failed tool out-of-band for triage
FHigh availability: Active/Standby with automatic failover
GHigh availability: Active/Active "Crossfire" redundancy
HDecrypting SSL/TLS for inline and out-of-band tools
IA combined stack: chaining, high availability, and decryption together
↓ FREE DOWNLOAD ↓

Find the architecture that matches your environment.

Nine complete deployment blueprints, from a single Bypass TAP to high-availability stacks with decryption at 100G. Match yours, copy the design.

Already know your setup? Talk to an engineer instead →