Fail-open and bypass
What keeps the line up when software or hardware fails — software fail-open, hardware bypass pairs, the watchdog, and a manual bypass plan.
An inline unit carries all of a customer's traffic. SENTRA designs for failure at three levels.
1. Software fail-open (every unit)#
| If this stops… | …traffic |
|---|---|
| The SENTRA services (AI daemon, console, inspector) | Keeps flowing — the firewall rules stay loaded in the kernel |
| The DNS/HTTPS name filter | Flows unfiltered (the packet queue fails open) |
| The intrusion-prevention engine | Flows uninspected (the queue fails open) |
| A bridge segment's software | The kernel bridge keeps forwarding |
| A bad configuration change | Rolls back by itself after 60 seconds |
At boot, the unit loads its last confirmed ruleset before the network comes up.
2. Hardware bypass (premium SME units)#
A bypass pair is a WAN and LAN port wired through relays. While the unit is healthy, traffic goes through NTS. If the unit loses power or stops sending its heartbeat, the relays close and connect WAN straight to LAN — the line stays up, unprotected, until the unit is back.
NTS drives the bypass card on bare metal through two commands in its configuration:
"bypass": {"heartbeat_cmd": "<command that tells the card we are alive>",
"fail_cmd": "<command that lets the card bypass>"}
The NTS daemon runs heartbeat_cmd while the ruleset is loaded and healthy, and fail_cmd when it is not. The commands come from the bypass card's vendor tools and are set by SENTRA when the unit is qualified.
3. Watchdog and power#
- Enable the board's hardware watchdog so a hung unit restarts itself.
- Put the unit — and the modem/ONT and router — on a small UPS. Most outages are power, not hardware.
Units without hardware bypass#
Home and standard SME units have no bypass relays. Plan a manual bypass:
- Keep a spare patch cable with the unit.
- If the unit fails and the line must come back at once: connect the cable from the modem/ONT (or carrier hand-off) directly to the router/firewall, skipping the SENTRA unit. - Bridge layout: works immediately — nothing else changes. - Routed layout: your router must be set up to act as the gateway first; plan this with your provider.
- Tell your provider; the unit is replaced or repaired, then re-inserted.
For homes, print this on the quick-start card: "If the SENTRA light is red or off and the internet is down, plug the modem straight into your router and call us."