You are configuring gateway IDS/IPS settings in Aruba Central. For which reason would you set the Fail Strategy to Bypass?

The "Fail Strategy" setting within the Aruba Central IDS/IPS configuration dictates the gateway's behavior in the event of an IDS/IPS engine failure. The "Bypass" option configures a fail-open mechanism. This means if the inspection engine fails or is unable to process traffic for any reason, the gateway will permit the traffic to pass through without inspection. This strategy prioritizes network availability and connectivity over security inspection during a failure state, preventing the security feature from causing a network outage.

B: Allowlisting is a specific policy configuration to explicitly permit certain traffic, which is unrelated to the engine's overall failure-handling strategy.

C: The fail strategy pertains to the local IDS/IPS engine's operational status, not the gateway's external internet connectivity.

D: Decisions on which traffic to inspect (e.g., based on authentication state) are configured within the IDS/IPS policies, not by the global fail strategy setting.

1. Aruba Central Help Portal

"Configuring Security Policy for Gateways": In the section for Intrusion Detection and Prevention System (IDS/IPS)

the documentation specifies the options for "Fail Strategy". It explicitly states: "Fail Strategy—Select one of the following options if the IDS/IPS engine fails: Bypass—Allows the traffic to pass through without inspection. Block—Blocks the traffic." This directly supports that "Bypass" is chosen to permit traffic when the engine fails. (Reference: Aruba Central Help > Gateway > Configuration > Security > Intrusion Detection and Prevention).