Summary
High-speed Ethernet bypass modules provide automatic network failover protection when security appliances or servers are compromised or malfunction. NEXCOM's 100G Ethernet bypass LAN modules (NC 221FMS3 and NC 421FMS3), based on NVIDIA Mellanox ConnectX-5 technology, enable transparent traffic forwarding or blockage during server outages. This inline architecture ensures continuous network availability while protecting against both cyberattacks and unplanned system failures.
Problem / Requirements
5G network infrastructure demands continuous uptime for mission-critical services. Traditional server-based security implementations create a critical dependency: if the appliance fails or becomes compromised, traffic either halts completely or bypasses security controls entirely. Organizations require:
- Automatic failover mechanisms that don't require manual intervention
- Transparent traffic preservation during server reboots or security incidents
- Multiple operational modes for flexible security postures
- Support for high-speed data planes (100G Ethernet and beyond)
Technical Approach
Ethernet bypass modules operate inline between network infrastructure and security appliances, intercepting Layer 2 traffic without protocol processing overhead. Based on NVIDIA Mellanox ConnectX-5 technology, these modules implement hardware-based switching that activates automatically when the downstream appliance becomes unresponsive.
The architecture supports three distinct operational modes:
- Direct Mode: Normal pass-through with no traffic modification (used during healthy appliance operation)
- Bypass Mode: Automatic forwarding around the appliance if connectivity is lost
- Block Mode: Complete traffic halt during detected compromise or failure scenario
This switching occurs without software intervention, ensuring sub-millisecond response times and zero loss of in-flight packets.
Implementation Notes
The NC 221FMS3 (dual-port) and NC 421FMS3 (quad-port) modules integrate into NEXCOM's 5G network security infrastructure with PCIe-based connectivity. Performance at 100G line rate ensures negligible latency even during failover transitions. The modules operate transparently from the perspective of upstream routing and switching devices—no configuration changes required in existing network topology.
Deployment scenarios include placement between core network switches and distributed security appliances, or between load balancers and appliance clusters. Multiple modules can operate in series for defense-in-depth scenarios where nested security layers each require failover protection.
Challenge-Solution Mapping
/table
Challenge | Solution
Server failure creates complete traffic halt | Inline bypass module forwards traffic automatically
Compromised appliance may block legitimate traffic | Block mode halts suspicious activity until remediation
Security appliance reboots disrupt operations | Transparent failover during maintenance windows
High-speed networks (100G+) require low-latency failover | Hardware-based switching with sub-millisecond response
Manual intervention delays incident response | Automatic mode transitions triggered by connectivity loss
Complexity of managing multiple security layers | Bypass modules operate independently per appliance
/endtable
Specifications Snapshot
/table
Specification | Detail
Technology | NVIDIA Mellanox ConnectX-5
Port Speed | 100G Ethernet per port
Models | NC 221FMS3 (2-port), NC 421FMS3 (4-port)
Operational Modes | Direct, bypass, block
Failover Response | Sub-millisecond (hardware-based)
Interface | PCIe x16
Traffic Filtering | Layer 2 transparent (no processing overhead)
/endtable
Key Takeaways
1. Inline failover modules eliminate single-point-of-failure topology – Bypass architecture ensures traffic flows with or without appliance functionality, preventing outages from cascading.
2. Hardware-based switching delivers deterministic sub-millisecond failover – Software-based approaches cannot match the response speed required for high-speed packet forwarding.
3. Multiple operational modes accommodate diverse security policies – Direct, bypass, and block modes enable granular failover behavior tailored to individual risk profiles.
4. 100G Ethernet support matches modern backbone speeds – Bypass modules become transparent performance bottlenecks in contemporary data center deployments.
5. Transparent operation requires no topology reconfiguration – Existing routing and switching devices operate unchanged; bypass module acts as invisible intermediary.
Contact NEXCOM
For specifications, availability, and technical inquiries, contact NEXCOM via the official website.
