Silicom IS100 40/100G Bypass Switch｜TAP

Inline security tools such as NGFW, IPS, WAF, DDoS, SSL, and DPI systems act as the first line of defense against cyberattacks, worms, and other intrusions.
These devices must deeply inspect every packet to verify its safety before allowing it to pass, a process that requires significant CPU resources and close coordination between hardware and software. However, the performance of these security appliances often depends on the complexity and number of their inspection rules—meaning that the actual throughput is rarely equal to the interface speed. As a result, occasional system crashes or instability during software updates can cause unexpected network outages, leading to immediate business disruption and even direct revenue loss.

A Bypass Switch mitigates this risk by ensuring that network connectivity is maintained even when inline devices fail. From a protection standpoint, Bypass Switches can be categorized into three levels:

• Standard：Switches to bypass mode when the inline device or the switch itself loses power.
• Advanced：Includes standard features plus automatic bypass during inline device failure or disconnection.
• Ultimate：Adds full self-monitoring capabilities, enabling bypass even if the Bypass Switch itself crashes or loses power.

 
The IS100 100G Bypass Switch delivers ultimate-level protection, featuring both active and passive bypass capabilities to safeguard network uptime during device maintenance, system crashes, or power outages.
It not only transmits heartbeat packets to monitor the health of inline security appliances but also performs self-health monitoring.
If the switch itself fails or loses power, it automatically enters bypass mode—ensuring uninterrupted network service and eliminating any single point of failure.




A common misconception among users is that inline security devices equipped with bypass-capable NICs can prevent network downtime during device failures. In reality, the most frequent cause of outages in IPS, WAF, DAM, or bandwidth management systems operating in inline mode is not just hardware failure—but system crashes or devices entering a “half-dead” state, where performance severely degrades without a complete disconnection. This often results in packet loss, application failure, or total loss of connectivity.

Even in HA (High Availability) environments, such failures typically require manual intervention—engineers must physically isolate the malfunctioning inline device before traffic can properly fail over to the secondary unit.
While a bypass-capable NIC can allow traffic to flow only when the device is powered off, it does not provide true automated failover protection. As a result, businesses still experience service interruptions and downtime before the issue is resolved.
Recognizing these challenges, more organizations are now prioritizing advanced link protection mechanisms and investing in intelligent bypass solutions that deliver fully automated failover and ensure continuous network availability—without manual intervention or downtime.



The Silicom IS100 Intelligent Bypass Switch is built in a standard 1U chassis and features two modular expansion slots. Each 100G module supports one pair of bypass ports (1 segment).
 
The IS100 Intelligent Bypass Switch supports both single-mode fiber (100GBase-LR4) and multi-mode fiber (100GBase-SR4 / SR10) standards, providing flexibility for various deployment needs.
Each bypass module includes two MPO/LC network ports for connecting the upstream and downstream network links, and two QSFP28 ports for attaching inline security appliances operating in inline mode.


The Silicom IS100 Intelligent Bypass Switch supports four operating modes:
Normal Inline, Bypass, TAP (Traffic Access Point), and Linkdrop mode.
 

The IS100 bypass module generates Heartbeat packets that travel along the live network path to the inline monitoring appliance.
These Heartbeat packets enter the appliance through its network ports and are bridged internally together with other network traffic before being sent out through the opposite port—creating a continuous verification loop. If the IS100 module detects the return of the Heartbeat packets within the predefined interval, it confirms that the inline device is operating normally and maintains the current inline mode.

If the IS100 bypass module fails to detect the return of Heartbeat packets from the inline device within the configured timeout period,
the system automatically switches to one of the predefined modes — Bypass, TAP (Traffic Access Point), or Linkdrop — depending on user configuration.

When the inline monitoring appliance resumes normal operation and the Heartbeat packets are detected again within the preset interval,the IS100 automatically restores the Normal Inline mode.
Typically, the Bypass mode is triggered in cases of power failure, link failure, system crash of the inline software application, or when manually activated by the user for maintenance or troubleshooting purposes.


 The IS100 features a dual bypass safety architecture designed by Silicom to ensure continuous network protection. This architecture is based on two independent bypass routing circuits — one active and one passive.

If the system detects a failure in the active bypass routing path, it automatically switches to the passive bypass route.
As a result, the IS100 not only monitors the health of the connected inline appliances, but also verifies the integrity of its own bypass functionality, providing an extra layer of reliability and assurance to users.

 

The IS100 is a 1U rack-mount system that supports up to two 100G bypass modules.
It equipped with dual redundant 110–220V AC power supplies or optionally with dual redundant -48V DC power inputs.