Thread: [Snort-inline-users] Help- Snort_inline Single Point of Failure

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Is snort-inline a single point of failure when the box facing hardware
failure, for example power supply problem. Any idea how to solve this?

Best regards,

Shyap

Not really sure what you are asking me here.  Are you asking me if a
box running snort-inline dies how to get traffic to pass?  The short
answer is if you don't have redundent connections to whatever network
segment you are trying to protect you can't do this.  This isn't a
snort-inline limitation though, this is a network design limitation.

Regards,

Will

On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...> wrote:
>  
>  
> 
> Is snort-inline a single point of failure when the box facing hardware
> failure, for example power supply problem. Any idea how to solve this? 
> 
>   
>  
> 
> Best regards, 
> 
> Shyap
>  
>  
> 
>

Hi Will,

I agree what you are saying, but in certain circumstances when budget is a
concern for customer, then we need to work out a solution to fix the budget
as well as to minimize the downtime. 

Is there a way other than having another redundant box, Snort_inline can
still allow traffic to pass in the event of power loss or other failures? 

regards

-----Original Message-----
From: Will Metcalf [mailto:wil...@gm...] 
Sent: Tuesday, February 22, 2005 1:45 AM
To: sin...@ex...
Cc: sno...@li...
Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure

Not really sure what you are asking me here.  Are you asking me if a
box running snort-inline dies how to get traffic to pass?  The short
answer is if you don't have redundent connections to whatever network
segment you are trying to protect you can't do this.  This isn't a
snort-inline limitation though, this is a network design limitation.

Regards,

Will

On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...>
wrote:
>  
>  
> 
> Is snort-inline a single point of failure when the box facing hardware
> failure, for example power supply problem. Any idea how to solve this? 
> 
>   
>  
> 
> Best regards, 
> 
> Shyap
>  
>  
> 
>

I know that certain commercial IPSs like Proventia have ethernet
interfaces with a relay that fail open when the power is disconnected
to them.  Maybe you could use interfaces like this in your IPS.

On Tue, 22 Feb 2005 10:48:42 +0800, Yap Sin Hoe <sin...@ex...> wrote:
> Hi Will,
> 
> I agree what you are saying, but in certain circumstances when budget is a
> concern for customer, then we need to work out a solution to fix the budget
> as well as to minimize the downtime.
> 
> Is there a way other than having another redundant box, Snort_inline can
> still allow traffic to pass in the event of power loss or other failures?
> 
> regards
> 
> -----Original Message-----
> From: Will Metcalf [mailto:wil...@gm...]
> Sent: Tuesday, February 22, 2005 1:45 AM
> To: sin...@ex...
> Cc: sno...@li...
> Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure
> 
> Not really sure what you are asking me here.  Are you asking me if a
> box running snort-inline dies how to get traffic to pass?  The short
> answer is if you don't have redundent connections to whatever network
> segment you are trying to protect you can't do this.  This isn't a
> snort-inline limitation though, this is a network design limitation.
> 
> Regards,
> 
> Will
> 
> On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...>
> wrote:
> >
> >
> >
> > Is snort-inline a single point of failure when the box facing hardware
> > failure, for example power supply problem. Any idea how to solve this?
> >
> >
> >
> >
> > Best regards,
> >
> > Shyap
> >
> >
> >
> >
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> 

-- 
Thanks,
Rich Compton

There are small integrated computers made by IBT out of Canada that have 
this feature.  They are roughly $300 for a 1ghz passively cooled box 
with 128mb RAM, 4 10/100 NICs, and a 20gb hard drive.  The first two 
NICs on the board have relays that fail to closed acting as a 
pass-through when the box loses power.  Overall the boxes are extremely 
well-made, and I can recommend them heartily.

Richard Compton wrote:
> I know that certain commercial IPSs like Proventia have ethernet
> interfaces with a relay that fail open when the power is disconnected
> to them.  Maybe you could use interfaces like this in your IPS.
> 
> 
> On Tue, 22 Feb 2005 10:48:42 +0800, Yap Sin Hoe <sin...@ex...> wrote:
> 
>>Hi Will,
>>
>>I agree what you are saying, but in certain circumstances when budget is a
>>concern for customer, then we need to work out a solution to fix the budget
>>as well as to minimize the downtime.
>>
>>Is there a way other than having another redundant box, Snort_inline can
>>still allow traffic to pass in the event of power loss or other failures?
>>
>>regards
>>
>>-----Original Message-----
>>From: Will Metcalf [mailto:wil...@gm...]
>>Sent: Tuesday, February 22, 2005 1:45 AM
>>To: sin...@ex...
>>Cc: sno...@li...
>>Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure
>>
>>Not really sure what you are asking me here.  Are you asking me if a
>>box running snort-inline dies how to get traffic to pass?  The short
>>answer is if you don't have redundent connections to whatever network
>>segment you are trying to protect you can't do this.  This isn't a
>>snort-inline limitation though, this is a network design limitation.
>>
>>Regards,
>>
>>Will
>>
>>On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...>
>>wrote:
>>
>>>
>>>
>>>Is snort-inline a single point of failure when the box facing hardware
>>>failure, for example power supply problem. Any idea how to solve this?
>>>
>>>
>>>
>>>
>>>Best regards,
>>>
>>>Shyap
>>>
>>>
>>>
>>>
>>
>>-------------------------------------------------------
>>SF email is sponsored by - The IT Product Guide
>>Read honest & candid reviews on hundreds of IT Products from real users.
>>Discover which products truly live up to the hype. Start reading now.
>>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>>_______________________________________________
>>Snort-inline-users mailing list
>>Sno...@li...
>>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
> 
> 
> 

Hi Chris,

Sound good. Do you have any contact or information?

-----Original Message-----
From: Christopher Black [mailto:bla...@um...] 
Sent: Tuesday, February 22, 2005 12:59 PM
To: Richard Compton
Cc: sin...@ex...; Will Metcalf;
sno...@li...
Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure

There are small integrated computers made by IBT out of Canada that have 
this feature.  They are roughly $300 for a 1ghz passively cooled box 
with 128mb RAM, 4 10/100 NICs, and a 20gb hard drive.  The first two 
NICs on the board have relays that fail to closed acting as a 
pass-through when the box loses power.  Overall the boxes are extremely 
well-made, and I can recommend them heartily.

Richard Compton wrote:
> I know that certain commercial IPSs like Proventia have ethernet
> interfaces with a relay that fail open when the power is disconnected
> to them.  Maybe you could use interfaces like this in your IPS.
> 
> 
> On Tue, 22 Feb 2005 10:48:42 +0800, Yap Sin Hoe <sin...@ex...>
wrote:
> 
>>Hi Will,
>>
>>I agree what you are saying, but in certain circumstances when budget is a
>>concern for customer, then we need to work out a solution to fix the
budget
>>as well as to minimize the downtime.
>>
>>Is there a way other than having another redundant box, Snort_inline can
>>still allow traffic to pass in the event of power loss or other failures?
>>
>>regards
>>
>>-----Original Message-----
>>From: Will Metcalf [mailto:wil...@gm...]
>>Sent: Tuesday, February 22, 2005 1:45 AM
>>To: sin...@ex...
>>Cc: sno...@li...
>>Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of
Failure
>>
>>Not really sure what you are asking me here.  Are you asking me if a
>>box running snort-inline dies how to get traffic to pass?  The short
>>answer is if you don't have redundent connections to whatever network
>>segment you are trying to protect you can't do this.  This isn't a
>>snort-inline limitation though, this is a network design limitation.
>>
>>Regards,
>>
>>Will
>>
>>On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...>
>>wrote:
>>
>>>
>>>
>>>Is snort-inline a single point of failure when the box facing hardware
>>>failure, for example power supply problem. Any idea how to solve this?
>>>
>>>
>>>
>>>
>>>Best regards,
>>>
>>>Shyap
>>>
>>>
>>>
>>>
>>
>>-------------------------------------------------------
>>SF email is sponsored by - The IT Product Guide
>>Read honest & candid reviews on hundreds of IT Products from real users.
>>Discover which products truly live up to the hype. Start reading now.
>>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>>_______________________________________________
>>Snort-inline-users mailing list
>>Sno...@li...
>>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
> 
> 
> 

On Mon, 21 Feb 2005, Richard Compton wrote:

> I know that certain commercial IPSs like Proventia have ethernet 
> interfaces with a relay that fail open when the power is disconnected to 
> them.  Maybe you could use interfaces like this in your IPS.

 	Run two firewalls talking free-VRRP.  It seems to work OK and
 	will provide this feature of having a standby.

Nick Rogness <ni...@ro...>
-
   How many people here have telekenetic powers? Raise my hand.
   				-Emo Philips

Richard Compton wrote:
> I know that certain commercial IPSs like Proventia have ethernet
> interfaces with a relay that fail open when the power is disconnected
> to them.  Maybe you could use interfaces like this in your IPS.
> 

If you are going to go commercial

http://www.sourcefire.com/products/is.html