Resilience and fail-open design

A security product that stops traffic when it has a problem becomes the outage. SENTRA is designed so that its own failures degrade inspection, not connectivity.

SENTRA AI Threat Shield#

• A separate fail-open guard service watches the shield. If the shield stops answering, the guard sends website traffic straight to the web server until the shield is healthy again.
• An emergency bypass switch (sentra-shield-setup bypass on) does the same on purpose, within about 5 seconds, and is undone with bypass off.
• Updates restart the shield for about 10 seconds while websites keep working.

SENTRA Network Threat Shield#

• Packet inspection (the IPS, DNS and HTTPS-name filtering) uses kernel queues bound fail-open, with rules that bypass the queue when no inspector listens: if an inspector stops or falls behind, packets pass rather than drop.
• Two boxes can run as an active / standby pair: the standby takes over within about 3 seconds, with the connection table copied across so open connections survive.

Licensing and updates#

• Licences are verified offline; a box never needs the Licensing Authority to keep working.
• If a licence lapses, protection keeps running exactly as configured (30-day grace, then only configuration changes for that module are blocked).
• If the Licensing Authority is sealed or unreachable, check-ins fail harmlessly and are retried.
• An update that fails any check is refused and nothing changes; an update that fails to install is recorded and the previous version keeps running. GUARD and VIEW can roll back to the previous release.