When an inline IPS reboots at a single-box branch, what does its bypass relay do, and what does that cost against an intruder?

## Inline means the box is the wire A passive sensor gets a copy of traffic and can only complain. An inline IPS is spliced into the path: packets enter one port, are evaluated, and leave the other. That is what lets it drop a packet rather than describe it afterwards, and it is also why its failure is not a monitoring gap but a link failure. A branch office on consumer broadband, with one box, no redundant pair and no local hands, has no second path to fall back to. ## What the bypass relay actually is On most inline appliances the two inline ports are wired through a physical relay. Under normal operation the contacts are open and each port terminates on the engine. When the engine stops -- power loss, a panic, or a watchdog heartbeat that stops arriving -- the contacts close and the two ports are connected directly to each other. Copper to copper (or an optical equivalent), no software involved. The two facts that matter: - It is **physical**, so it works precisely when the software does not. You cannot decide the posture during the outage; you decided it when the box was installed and configured. - It is **blind**. The relay has no visibility, no counters of its own and no log. Nothing records what crossed while it was closed. Some boxes also expose a *software* bypass -- the engine is running but told to forward without inspecting, typically to survive overload. That is a different mechanism with the same visible symptom, and both leave the same hole. ## Fail-open and fail-closed, wired per branch The relay can be configured either way, and at a single-box branch the choice is not abstract: | Posture | During a reboot | What you pay | |---|---|---| | Fail-open (relay closes) | Branch keeps working | Every packet crosses uninspected | | Fail-closed (relay stays open) | Branch link is down | The branch cannot trade until the box boots | The right answer differs by what the branch carries. A site whose traffic is guest wifi and web browsing can be dark for four minutes at 02:00; a site running card payments may not, or may be the one site you least want unjudged. That is a per-branch decision, and somebody at the branch has to accept whichever way it goes. ## Link state is part of the decision A related mechanism is link-state propagation: if one side of the inline pair loses link, the box drops the other side too. Without it, an upstream router keeps seeing a healthy interface and keeps sending traffic into a box that cannot forward -- a black hole that looks fine from both ends. With it, the failure is visible and any WAN failover that exists can react. At a single-WAN branch there is nothing to fail over to, so the value is simply that the branch knows it is down instead of silently blackholing. ## What the window costs you against an intruder Two distinct exposures live in a scheduled window: 1. **New traffic crosses unjudged.** Nothing evaluates it, so nothing drops it and nothing records it at the engine. If your rules would have caught an exploit attempt or a callback, they do not, and no alert is ever raised. 2. **Existing sessions survive.** A connection opened before the window keeps flowing through the closed relay and is still open when the engine returns -- at which point the engine has no handshake and no reassembly state for it and must decide whether to adopt it blind or cut it. The honest framing for an interview is that a maintenance window is a small, announced, repeated hole in a control you otherwise trust, and the point is not to pretend it is not there but to bound it: know its length, know its posture, know what still records during it. ## What still records The engine records nothing while it is stopped, so the accounting comes from upstream: router or WAN flow records (a five-tuple, packet and byte counts, timestamps -- and no payload at all), DNS resolver logs, proxy logs if the branch is proxied. Those let you say that bytes moved between these addresses at these times; they never let you say what those bytes were. That distinction is exactly what you will be asked for afterwards. ## The failure nobody plans for The relay can also fail to restore -- it latches closed, or the box never comes back and the branch is left running on bare copper. With no local hands, the fix is a courier or a van, and that cost belongs in the plan before the window opens, not after. The corresponding discipline is to verify positively after every window that the box is back in path and inspecting, rather than concluding from a quiet alert feed that all is well.