Inline Sets

Before you can use inline interfaces in an inline deployment, you must configure inline sets and assign inline interface pairs to them. An inline set is a grouping of one or more inline interface pairs on a device; an inline interface pair can belong to only one inline set at a time.

The Inline Sets tab of the Device Management page displays a list of all inline sets you have configured on a device.

You can add inline sets from the Inline Sets tab of the Device Management page or you can add inline sets as you configure inline interfaces.

You can assign only inline interface pairs to an inline set. If you want to create an inline set before you configure the inline interfaces on your managed devices, you can create an empty inline set and add interfaces to it later. You can use alphanumeric characters and spaces when you type a name for an inline set.

Note

Create inline sets before you add security zones for the interfaces in the inline set; otherwise security zones are removed and you must add them again.

Name

The name of the inline set.

Interfaces

A list of all inline interface pairs assigned to the inline set. A pair is not available when you disable either interface in the pair from the Interfaces tab.

MTU

The maximum transmission unit for the inline set. The range of MTU values can vary depending on the model of the managed device and the interface type.

Caution

Changing the highest MTU value among all non-management interfaces on the device restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Inspection is interrupted on all non-management interfaces, not just the interface you modified. Whether this interruption drops traffic or passes it without further inspection depends on the model of the managed device and the interface type. See Snort® Restart Traffic Behavior for more information.

Failsafe

Behavior of the interface on a NGIPSv device when the Snort process is busy or down.

  • Enabled—New and existing flows pass without inspection when the Snort process is busy or down.

  • Disabled—New and existing flows drop when the Snort process is busy and pass without inspection when the Snort process is down.

The Snort process can be busy when traffic buffers are full, indicating that there is more traffic than the managed device can handle, or because of other software issues.

The Snort process goes down when you deploy a configuration that requires it to restart. See Configurations that Restart the Snort Process When Deployed or Activated for more information.

Note

When traffic passes without inspection, features that rely on the Snort process do not function. These include application control and deep inspection. The system performs only basic access control using simple, easily determined transport and network layer characteristics.