Trend Micro TippingPointTM

Threat Protection System (TPS)
Stacking User Guide

TMPrivacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback regarding product usage and detection information to Trend Micro.
Some of this data is considered personal in certain jurisdictions and under certain regulations. If you do not want Trend Micro to collect personaldata, you must ensure that you disable the related features.
The following link outlines the types of data that the Security Management System collects and provides detailed instructions on how to disable thespecific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend Micro Privacy Policy:
https://www.trendmicro.com/en_us/about/legal/privacy-policy-product.html

Legal Notice© Copyright 2023 Trend Micro Incorporated. All rights reserved.
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine are trademarks or registered trademarks of Trend Micro Incorporated.
All other product or company names may be trademarks or registered trademarks of their owners.
Publication: February 2023

Overview
Stacking enables you to increase the overall inspection capacity of your Trend Micro™ TippingPoint™ ThreatProtection System (TPS) security device by grouping multiple TX Series or TXE Series devices and poolingtheir resources.
Note
A stack can have either TX or TXE TPS devices, but not both. For expediency, the device graphics in this guideillustrate stacking TX devices. Configurations for stacking the 9200TXE devices follow the same guidelines you
would use for stacking the 8200TX device; the I/O slot numbers for both of these 1U models correspond.

You can configure up to five devices in a stack. The stack operates as a single device that you manage on the
TippingPoint Security Management System (SMS). For a stack of TX Series devices, the devices can be thesame or a mixture of both 8200TX and 8400TX TPS models. All devices in a stack should be licensed for thesame inspection throughput.
In-line inspection capacity increases with each device that you add to the stack. For example, for each 8200TX
or 8400TX added to a stack of devices, the inspection capacity increases according to the licensed inspection
capacity of each device, up to a stacking maximum of 120 Gbps.
Important
Before you attempt to configure a stack, make sure you install the following TippingPoint software:•

For TX Series stacks, TippingPoint Operating System (TOS) v5.0.0 or later for the SMS to centrally manage eachstack of devices, and TOS v5.0.3 or later for each security device in the stack.

•

For TXE Series stacks, TOS v6.0 or later for both the SMS and TPS devices.

•

All devices in a stack must be running the same TOS version.

Note
No additional licensing is required to implement stacking.

Not all TPS features are supported in a stack configuration. Learn more.

Setting up the stack
You can customize the stack by adding the number of devices and enabling the features you need.
After you set up a basic stack, you can consider whether to configure it to be a resilient stack. Learn more.
For information about how to install your security device, consult the Read Me First and Threat Protection
System (TPS) Hardware Specification and Installation Guide.

Stacking components
You need the following components for each stack member. Also, you need network I/O modules for the stackmembers that you connect to the network.
•

For TX Series stacks:
1

TPS Stacking User Guide••

TippingPoint 8200TX or 8400TX device•

TippingPoint 40G QSFP+ Active Optical Cable (AOC) or discrete QSFP+ Transceivers and Cables

For TXE Series stacks:•

TippingPoint 9200TXE device•

TippingPoint 100G QSFP28-DD Active Optical Cable (AOC) or discrete 100G QSFP28-DD Transceivers
and Cables

Basic stack configuration
When you configure a basic stack, every member of the stack must be operational. If any member of a basic
stack becomes unavailable, the entire stack becomes unavailable.
Important
Before you attempt to configure a stack, make sure you install the following TippingPoint software:•

For TX Series stacks, TippingPoint Operating System (TOS) v5.0.0 or later for the SMS to centrally manage eachstack of devices, and TOS v5.0.3 or later for each security device in the stack.

•

For TXE Series stacks, TOS v6.0 or later for both the SMS and TPS devices.

Install the stacking components
A TPS device stack consists of two or more devices that connect through a stacking bus.
The stacking bus consists of a pair of dedicated 40 GbE QSFP+ (TX Series) or 100G QSFP28-DD ports (TXE
Series) on each stacking device. These special purpose (SP) ports directly connect each stack member to its
peer by using AOC or QSFP+ cables. Do not connect the SP ports through a switch.
Note
A stack can have either TX or TXE TPS devices, but not both. For expediency, the device graphics in this guideillustrate stacking TX devices. Configurations for stacking the 9200TXE devices follow the same guidelines you
would use for stacking the 8200TX device; the I/O slot numbers for both of these 1U models correspond.

To install the stacking components
Procedure
1.

Install the I/O modules in the stacking device that you plan to use as the network segment device. A
network segment device operates in-line in the network and distributes network traffic to each stackmember for inspection. The other stack members do not need network I/O modules.
Note
If you have a mixed stack configuration with 8400TX and 8200TX devices, maximize the physical network I/Oslots that are available to the stack by installing network I/O modules in any of the network I/O slots on the
8400TX security device.

For information about how to install I/O modules, see the Threat Protection System (TPS) Hardware
Specification and Installation Guide.
2

TPS Stacking User Guide

2.

Install the AOC or QSFP+ (for TXSeries)/QSFP28-DD (for TXE Series) cables in the SP ports of bothdevices so that each device connects to its peer in a ring topology.
Note
When you install the AOC cable, you should orient the transceiver with the tab on top. There is only one way tocorrectly insert the AOC cable. If the cable does not slide in easily and click to latch, it may be upside down.
Learn more.

The following example shows a mixed stack configuration with an 8400TX (bottom) and an 8200TX (top)security device. The AOC cables are properly installed in the SP ports.

The next example shows the network I/O modules are properly installed in slots 1 and 2 of the network
segment device (bottom).

Create the stack
Create the stack configuration in the SMS to centrally manage your installed stacking devices.
Complete these tasks to create the stack:•Manage the devices
3

TPS Stacking User Guide•

Create the stack configuration•

Distribute the inspection profile

Manage the devices
Manage the devices that you want to stack with the SMS so that you can create and manage the stack.
For each device, install the required TOS version. The TOS version must be the same on each TPS device.
If you are repurposing an existing device for use in the stack, verify the device configuration. Learn more.

Create the stack configuration
Create the stack configuration to specify the devices that are connected to the stacking bus and the Devices
options.
Note
You must have a SuperUser role for SMS administration to create a stack.

To create a basic stack with two devices
Procedure

4

1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, right-click a stacking device and select New Stack.

3.

In the Choose Devices dialog, specify the stack name.

4.

Choose Normal for the Stack Resilience option.

TPS Stacking User Guide

5.

Select both devices.
••

If a device is not displayed, validate the following items:•

The device is not already a member of another stack.

•The device is a either a TX Series (8200TX or 8400TX) or TXE Series TPS.

If either device does not have a Ready for stacking status, troubleshoot the issue.

6.

Select the device with network I/O modules and click Set as Segment Reference Device. Stacking
replicates the I/O module configuration of the segment reference device to the other stack members.

7.

Click OK.

8.

In the All Devices workspace, double-click the stack shelf-level image to view stack health.

9.

In the Summary tab, verify the stack health isNormal.

If the stack is not healthy, identify and resolve any issues.

Distribute the inspection profile
Distribute the inspection profile to the stack by choosing from the network segments on the segment
reference device. The SMS distributes the inspection profile to the corresponding segments on each memberof the stack.
The following example shows the profile distribution to the default segment group, which includes all thesegments on the stack.

5

TPS Stacking User Guide

After you distribute the inspection profile, use the Sync Health tab to identify and resolve any
synchronization issues with the stack. Learn more.

Resilient stack configuration
You can change the configuration of a basic stack to a resilient stack. In a resilient stack, the network traffic
continues to be inspected when a single stack member is not ready to inspect by rebalancing network traffic
between the remaining devices that are ready to inspect.
To enable a resilient stack configuration, follow the same process that is described in Create the stackconfiguration, but select the N+1 Redundancy Stack Resiliency option.
When all the devices in the stack are ready to inspect, the stack balances network traffic across all thedevices. If a single stack member is not ready to inspect, the stack balances network traffic between theremaining devices, reducing inspection capacity.
Important
When the stack is configured with a single network segment device, if the network segment device is not ready toinspect, the entire stack is not ready to inspect. To enable the stack to continue to inspect traffic when the network
segment device is not ready to inspect, configure multiple network segment devices.

The following example shows a resilient stack:•The network segment device (1) is at the bottom of the stack.

•The network segment device balances network traffic from each utilized segment to the other device inthe stack.

•The stack continues to inspect if the top device is unavailable.

Multiple network segment devices
You can change the device configuration of an N+1 Redundancy resilient stack to include multiple network
segment devices (NSDs). With more than one NSD, the stack continues to inspect network traffic if any stackmember, including a network segment device, becomes unavailable. If any stack member becomes unavailable,
the stack rebalances network traffic between the remaining available devices.
Consider these points when you configure multiple NSDs:•

6

If you configure multiple NSDs, ensure each network segment device is the same TPS model (forexample, either 8200TX or 8400TX, but not both) to prevent configuration issues.

TPS Stacking User Guide•

Configure the same slot on each device with either the same network I/O module or no network I/O
module.
The following example shows the slot numbers for 8200TX and 8400TX devices.

•

Traffic can come in both NSDs as long as the corresponding segment ports of each device are connectedto the same networks.
The next example shows a valid two-device stack where port 1–1A on IPS–A and IPS–B are connected to
Network A and port 1–1B on IPS–A and IPS–B are connected to Network B. You can designate either NSD
as the segment reference device. Each NSD balances traffic from each utilized segment to the othermember of the stack on a per flow basis.

•

For stacks of four or five devices, the NSD devices cannot be adjacent to each other.
The next example shows a valid five-device stack where the bottom device and the second device fromthe top have been designated as the NSDs. Both NSDs must be the same model, and in this example they
are 8400TX devices.

7

TPS Stacking User Guide•

The maximum number of active NSD devices in any stack is two.

Updating the stack configuration
Update the stack configuration, for example, when you need to add another device to the stack.
Important
Do not reboot all devices in a stack at the same time. When you have to reboot devices in a stack configuration,
reboot each device that you updated sequentially. Allow each device to finish the boot sequence completely—
ensuring that the SMS has successfully managed the device—before rebooting the next device.
All devices in the stack must be managed and communicating with the SMS when you change any configuration.
Otherwise, the stack configuration will get out of sync.

Learn more about how configuring a stack of devices differs from configuring a standalone device.
The following information describes several ways that you can update the stack configuration:

8•

Enable stack resiliency•

Change the segment reference device•

Replace a device in the stack•

Remove a device from the stack•

Add a device to the stackTPS Stacking User Guide•

Delete the stack•

Granting permissions to the stack•

Distribute a TOS update

Enable stack resiliency
When you enable stack resiliency, make sure the stack is configured with enough devices to provide therequired inspection capacity if a single stack member is not ready to inspect. Disable stack resiliency tomaximize inspection throughput.
To enable or disable stack resiliency
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

In the Summary tab, click Edit.

4.

In Edit Stack Configuration, select a Stack Resilience option:•

N+1 Redundancy – This option enables the stack to continue to inspect traffic if a single stackmember is not ready to inspect. If more than one device is not ready to inspect, the stackautomatically goes into Intrinsic HA Layer-2 Fallback.

•Normal – This option automatically places the stack and all of its devices into Intrinsic HA Layer-2
Fallback if a single stack member is not ready to inspect.

Change the segment reference device
Update the stacking configuration to designate a network segment device as the segment reference device.
Stacking replicates the network I/O module configuration of the segment reference device to the other stackmembers. Learn more.
To change the segment reference device
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

In the Summary tab, click Edit.

4.

In Edit Stack Configuration options, select the network segment device from the Segment Reference
Device list.

What to do next
After you change the segment reference device, distribute the inspection profile to update the stack. Learn
more.
9TPS Stacking User Guide

Replace a device in the stack
The following information describes how to replace a stacking device.
To replace a device in the stack
Procedure
1.

Enable Intrinsic HA Layer-2 Fallback on the stack.

2.

Remove the device from the stack configuration. If the device you want to replace is the segment
reference device, temporarily designate another device as the segment reference device. You cannot
remove a device from the stack configuration while it is the segment reference device.
a.

In the SMS tools, click Devices.

b.

In the All Devices workspace, double-click the stack.

c.

In the Summary tab, select a device from the Stack Member list.

d.

Click Remove.

3.

Install the replacement device in your rack and install the AOC or QSFP+ cables to connect the
replacement device to the stacking bus.

4.

If you need to replace any network I/O modules, install the same I/O modules in the same slots of thereplacement device.

5.

Manage the new device with the SMS and then add the stacking device to the stack configuration.
If necessary, update the stack configuration to designate the replacement device as the segment
reference device.

6.

Distribute the inspection profile to the stack.

7.

Disable Intrinsic HA Layer-2 Fallback on the stack.

Remove a device from the stack
Remove a device from the stack when you need to decrease inspection capacity, or when you need to replacea device in the stack.
Note
A stack with a single stack member is supported on a temporary basis, for example, to replace a device in the stackwith two devices. However, a single-device stack has a degraded health status.

To remove a device from the stack

10

1.

Enable Intrinsic HA Layer-2 Fallback on the stack.

2.

Remove the stack member from the stack configuration.
a.

In the SMS tools, click Devices.

b.

In the All Devices workspace, double-click the stack.

c.

In the Summary tab, select a device from the Stack Member list.

TPS Stacking User Guided.

Click Remove.
You cannot remove a device from the stack while it is the segment reference device. If necessary,change the segment reference device to a different stacking device and then remove the stackmember.

3.

Disconnect the AOC or QSFP+ cables to remove the device that you do want from the stacking bus.

4.

Disable Intrinsic HA Layer-2 Fallback on the stack.
Note
To reuse a device after it is removed from the stack, either as a standalone device or as part of a different stack, use
the debug factory-reset command in conjunction with a TippingPoint technical support representative torestore the device to its original settings. Learn more.

Add a device to the stack
Add a device to the stack when you need to increase the inspection capacity of the stack, or when you need toreplace a device in the stack.
Note
You must have permission to manage a device in order to add the device to a stack.

If you are repurposing an existing device for use in the stack, always reset the device to factory settings, andthen install the required TOS version. See Learn more.
When you add a device to the stack configuration, the SMS automatically enables stacking on the device. If
necessary, remove the device from the stack configuration, and then add it again to enable stacking. Learn
more.
To add a device to the stack1.

Use the SMS to place the stack in Intrinsic HA Layer-2 Fallback.

2.

Install the AOC or QSFP+ cables to connect the new device to the stacking bus.

3.

Manage the new stacking device with the SMS.

4.

Add the stacking device to the stack.
a.

In the SMS tools, click Devices.

b.

In the All Devices workspace, double-click the stack.

c.

In the Summary tab, click Add.

d.

Select the device to add.
If the SMS cannot add the device to the stack, identify and resolve the issue.

e.

Click OK and view the updated stack health.

f.

If the device you are adding is intended to be the segment reference device, update the stackconfiguration to designate the device as the segment reference device.

5.

Distribute the inspection profile to the stack.

6.

Take the stack out of Intrinsic HA Layer-2 Fallback.
11

TPS Stacking User Guide

After you add a device to the stack, update any scheduled profile distributions to include the new stackmember as a target for the distribution.

Delete the stack
Delete the stack to return the devices to the SMS as standalone devices. To reuse a device after it is removed
from the stack, either as a standalone device or as part of a different stack, use the debug factory-reset
command in conjunction with a TippingPoint technical support representative to restore the device to its
original settings.
To delete the stack
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, right-click the stack and click Delete Stack.

What to do next
After you delete the stack:•Use the debug factory-reset command in conjunction with a TippingPoint technical support
representative to restore the device to its original settings.

•

Remanage each device on the SMS. Stacking is disabled on each device.

•

Reconfigure inspection policies on the devices. Inspection policies are not preserved after the factory
reset.

•

Reconfigure profile distributions after you remanage the device on the SMS.

Granting permissions to the stack
Grant permissions to the stack so that an assigned user group can perform the following functions:•

Create, update, or delete the stack•

Add a device to or remove a device from the stack

The following information describes how to grant permissions to the stack:•Add stack management to the user role•

Grant the user group access to the stack

Add stack management to the user role
Grant permission to a user role to manage a stack.
This capability requires the user group to also have access to the stack. Learn more.
To update the user role
12

TPS Stacking User Guide

Procedure1.

In the SMS tools, click Admin.

2.

Click Authentication and Authorization > Roles.

3.

In the User Roles workspace, select the user role and click Edit.

4.

In Capabilities options, click Devices.

5.

Select the Device Group/Stack Management capability.

Grant the user group access to the stack
Grant the user group access to the stack. With access to the stack, and permission to manage the stack, theuser group can perform basic operations on the stack.
To grant the user group access to the stack
Procedure1.

In the SMS tools, click Admin.

2.

Click Authentication and Authorization > Groups.

3.

In the User Groups workspace, select the user group you want and click Edit.

4.

In Devices options, select each stack you want from the list of devices.

Distribute a TOS update
Distribute a TOS update to the stack so that each stack member is updated with the same TOS version.
Before you distribute a TOS update, enable Intrinsic HA Layer-2 Fallback on the stack. Intrinsic HA Layer-2
Fallback remains enabled until the stack primary confirms that there are enough devices in the stack with thesame TOS version that are ready to inspect.
Distribute a TOS update to the stack using the same steps you would follow for a standalone TPS device.
Use the Sync Health tab to verify that the same TOS version is installed on each stacking device.
Note
If the TOS update does not install properly on a stack member, distribute the TOS update to the stack again. If thestacking device has issues, remove it from the stack to make any updates, and then add the device to the stack.

Differences between configuring a stack and a standalone device
The following information highlights options that are exclusive for configuring security policy on a stack:•

Security policy configuration•

Events and reports•

System updates and snapshots
13

TPS Stacking User Guide•

SMS database restore to a different SMS

Security policy configuration
Configure the security policy on the stack using the same steps you would follow for configuring the security
policy for a standalone TippingPoint IPS or TPS security device.
Use the following guidelines when configuring the security policy for your stack.
TippingPoint Operating System (TOS) distribution
A TOS distribution to the stack places all of the stacking devices into Intrinsic HA Layer-2 Fallback while the
TOS update is installed.
Perform a planned TOS update by enabling Intrinsic HA Layer-2 Fallback on the stack and then distributing
the TOS update to the stack. Stacking requires the same TOS version on each of the stacking devices.
Digital Vaccine Labs package distribution
When you distribute a Digital Vaccine package to the stack, the SMS distributes Digital Vaccine, AUX DV, andDV Toolkit packages to each member of the stack. All devices in a stack must have the same Digital Vaccine
packages.
Note
Each time you add or delete a member in a stack, you must update the Digital Vaccine distribution schedule. This isbecause Digital Vaccines are always distributed according to which members were in the stack at the time the
distribution was first scheduled. For example, if you schedule a distribution and then remove a device from thestack, the SMS still distributes the package to all the devices that were members of stack when the distribution was
first scheduled, including the device you removed.

Inspection profile distribution
Distribute your inspection profiles so that they are sent to selected segments on the stack. To do this, specify
the virtual segments or segment groups on the segment reference device when you distribute the profile.
After you do this, the inspection profile goes to the corresponding segments or segment groups on eachmember of the stack.
Distribute an inspection profile to all segments of the stack, including any disabled ports.
If a network segment does not have a profile, a
Major indicator is displayed in the Sync Health tab. On IPS
devices only, slot 4 is reserved for the stacking bus.
Scheduled profile distribution
When working with scheduled profile distributions on the stack, consider the following points.
Scheduled profile distributions – Stack:A scheduled profile distribution to the stack runs on the stack members that were in the stack when you
created the scheduled profile distribution. If you reconfigure the stack, update the list of target devices in thescheduled profile distribution to include the current stack membership. For example, update the list of target
devices when you:14•

Add a device to the stack•

Remove a device from the stack•

Delete the stackTPS Stacking User Guide

After you delete the stack, the scheduled profile distribution continues to run on the segment reference
device. On IPS devices only, subsequent profile distributions are not distributed to slot 4 of the segment
reference device.
Scheduled profile distributions – Segment Group:
A scheduled profile distribution to a segment group on the stack runs on the stack members that were in thestack when you created the scheduled profile distribution. If you reconfigure the stack, update the list oftarget devices in the scheduled profile distribution to include the current stack membership. For example,
update the list of target devices when you:•Add a device to the stack•

Remove a device from the stack•

Delete the stack

After you delete the stack, any scheduled profile distributions continue to run on all physical network
segments that were in the stack. Scheduled profile distributions no longer run on a network segment withouta physical network I/O module
Device configuration
Configure the devices in the stack as you would a standalone device.
To edit the device configuration for the stack:1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, right-click the stack and select Edit Stack Member Configuration.

3.

In Device Configuration options, configure the stacking devices.

Segment groups
When creating a segment group for the stack, choose from the physical segments on the segment reference
device.
Segment details
On IPS devices only, you can rename a physical segment on slots 1–3, and optionally, propagate that segment
name to the corresponding segment on each member of the stack.
Virtual segment details - physical segments
When you create a virtual segment on the stack, the available physical segments consist of network
segments. On IPS devices only, slot 4 is reserved for the stacking bus.
Active Responder policy - quarantine actions
When you want a stack to quarantine network traffic, use the SMS to create an Active Responder policy that
propagates the IPS Quarantine action set to the stack. Responder applies the policy thresholds to the stack sothat a filter hit on any stack member is applied to the policy threshold, and any stack member that inspects
the traffic can also quarantine the traffic when the stack-level policy is triggered.
Inspection bypass rules
When working with inspection bypass rules, consider the following points:•

Create inspection bypass rules on the segment reference device.

•

Network I/O slots are available for inspection bypass rules. On the IPS only, slot 4 is reserved for the
stacking bus.
15

TPS Stacking User Guide•

Inspection Bypass mismatches are displayed in the Sync Health tab.
To resolve any issues, update the inspection bypass rules on the segment reference device. The Sync
Health tab automatically updates the synchronization status.

•

The SMS synchronizes inspection bypass rules across the stack when you finish updating inspection
bypass rules on the segment reference device.
Note
Before you configure an inspection bypass rule, distribute an inspection profile to the corresponding segments.

VLAN translation
When working with VLAN translation, consider the following points:•

Network I/O slots are available for VLAN translation. On IPS devices only, slot 4 is reserved for the
stacking bus.

•

Create VLAN translations on the physical segments that connect to the network. If the same network is
on more than one segment, create the same VLAN translations on the segments. VLAN translation
occurs after inspection but before the traffic exits the stack, so it is important to only configure VLAN
translation on the segments that connect to the network.

Events and reports
View events and reports for a stack using the same steps you would follow for a standalone TippingPoint IPS
or TPS security device.
The following table provides stacking-related information for events and reports.
Consider these points

For
EventsReports

16

When you create an inspection query with filter criteria for the stack, consider the following points:•

Query the segments from the segment reference device to include events from all corresponding segments acrossthe stack.

•You can filter inspection events by stack. In the Device/Segment/Rule section of the criteria, there is a box for
selection of Device/Group/Stack. An inspection event indicates the stack member that inspected the flow.

•

A saved event query on the segment reference device includes events from any devices that were stack members
when you created the query. If you replace the segment reference device, update your event query to include any
stack members.

When you report on the stack, consider the following points:•

Query a segment from the segment reference device to include data from all corresponding segments across thestack.

•

Stack member-level reporting shows the traffic statistics for the specified segment.

•

Saved report queries on the segment reference device include data from any devices that were stack members
when you created the query. If you replace the segment reference device, update your report query to include any
stack members.

•

Run the Device Traffic report on the stack or on a particular segment of the segment reference device to report on
statistical changes in network traffic patterns across the stack. Traffic reports include traffic information fromnetwork I/O slots only. On IPS devices only, slot 4 is reserved for the stacking bus.

TPS Stacking User Guide

System updates and snapshots
Do not rollback to an unsupported TOS version or to a snapshot that was taken of the device before it wasadded to the stack.
If you rollback to a snapshot that has a different stack resiliency setting, the Sync Health tab in the SMS
displays the misconfiguration. To resolve this issue, edit and save the stack configuration with the stack
resiliency setting you want.
Never rollback to an unsupported version. For example, if you rollback the TippingPoint Operating System ona stacking device from v3.9.0 to v3.8.x, then the unsupported TOS version prevents the device fromparticipating in the stack. This problem can also occur if you restore a snapshot on a stack member, but thesnapshot was taken before the device was added to the stack.
Note
If you restore a stacked device snapshot to a standalone device, the device state will be invalid. As a workaround,use the reboot -full command to put the device back into a valid state.

SMS database restore to a different SMS
When you restore the SMS backup to a different SMS, and the SMS manages a stack with virtual segments,
you must manually repair the stack configuration to update its virtual segments.
To repair the stack configuration
1.

Click Devices on the SMS toolbar.

2.

In the All Devices workspace, add each of the devices in the stack.

3.

In the left navigation pane, click Virtual Segments.

4.

In the Virtual Segments list, edit and save (without making any changes) each virtual segment in thestack with a physical segment (including any hidden segments). A hidden segment is a segment on astacking device that does not have a network I/O module.
Note
Use the Segments Assigned column to identify the virtual segments with physical segments and hidden
segments. For example, a virtual segment with a Segments Assigned value of 8 (16 hidden) indicates there
are eight physical segments and 16 hidden segments.

5.

Delete any virtual segments that have no physical or hidden segments. For example, delete a virtual
segment where the Segments Assigned value is 0 (0 hidden).

Troubleshooting
Use the following information to identify and resolve stacking issues:•

Verify AOC cable installation•

View stacking status•

Verify stack health and synchronization•

Resolve issues adding a device to the stack configuration
17

TPS Stacking User Guide•

View stacking tier statistics•

Intrinsic HA Layer-2 Fallback•

Export a Tech Support Report•

CLI commands for stacking

Verify AOC cable installation
The following information describes how to verify the AOC cable installation. Also, you can use thisinformation to verify the installation of a QSFP+ transceiver.
The following example shows a special purpose port with the AOC cable installed correctly.

The next example shows a special purpose port with the AOC cable partially inserted upside down.

18

TPS Stacking User Guide

View stacking status
Use the Devices workspace to view and manage the stack and its devices.

Device details
The All Devices workspace provides a consolidated view of information and configuration settings for the
stack and individual stack members. Click Stack State to view stacking details and verify stack health.
The following information describes the device detail states for a stack.
Stack is normal
The stack state is normal.

Stack with a device in Intrinsic HA Layer-2 Fallback
The following icon indicates that a device is in Intrinsic HA Layer-2 Fallback:

Stack with an unmanaged device
icon indicates that the smstx1002 device is unmanaged by the SMS and another device could be in
The
Intrinsic HA Layer-2 Fallback. The navigation pane indicates that the smstx1001 device is the segment
reference device for the stack.

19

TPS Stacking User Guide

Stack with an unmanaged device that is also in Intrinsic HA Layer-2 FallbackThe
icon and the
HA Layer-2 Fallback.

icon indicate that a device is not managed by the SMS and another can be in Intrinsic

Stack is in Intrinsic HA Layer-2 FallbackThe

icon indicates the stack is in Intrinsic HA Layer-2 Fallback.

Front panel stacking LEDs
Use the front panel stacking LEDs to identify the stacking status directly from the device:
20

TPS Stacking User Guide••

Stack: Indicates whether stacking is enabled on the device. Stacking is automatically enabled when you
add the device to the stack configuration. If necessary, remove the device from the stack configurationand then add it again to enable stacking. LED color indicates the following states:•

Solid green: Indicates that the device is ready to inspect and is inspecting network traffic.

•

Off: Indicates that stacking is not enabled on the device.

Stack Primary: Indicates whether the device is the stack primary. The stack primary is a device role thatis responsible for managing stack configuration and states. The devices in the stack automatically electthe stack primary. All stack members are eligible for election to stack primary.
•

Solid green: Indicates that the device is the stack primary.

•

Off: Indicates that the device is not the stack primary.

The following example shows the stacking LEDs on the front of each device in the stack:Device shelf-level graphic
The device shelf-level graphic, as shown in the following example, identifies the stacking status:•

The STK LED indicates whether stacking is enabled. If the STK LED is green, stacking is enabled.

Verify stack health and synchronization
Use the SMS to identify and resolve stack health and synchronization issues. In the All Devices workspace,double-click the stack to view its status information:•

Use the Summary tab to verify the health of the stack. The icon on the Summary tab indicates the most
severe status for the stack. If the stack is in a degraded state, use the Stack Members table to troubleshootand resolve any issues.
21

TPS Stacking User Guide

Perform stack health troubleshooting steps in the following order:•

1.

View overall health of the stack2.

Verify stacking bus state

3.

Verify stack member state

4.

Verify device state

Use the Sync Health tab to verify the synchronization status of each device in the stack. If
synchronization is in a degraded state, use the Issues table to troubleshoot and resolve any issues. Learn
more.

View overall health of the stack
The Summary tab displays the current stack configuration, overall stack state, and the status of the stacking
bus topology. If the status of the stack is not green (normal), identify and resolve any issues.
To view overall health of the stack
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

In the Summary tab, use the stack health summary information to identify the current health of thestack and its configuration.
•

Stack name — Indicates the name of the stack. Click Edit to rename the stack.

•

Stack state — Indicates the current state of the stack as reported by the segment reference device.
Note
If the Stacking State is not normal, use the Stack Port A and Stack Port B columns, along with the Status
column, to troubleshoot and resolve any issues.

The following information provides special purpose port status information and suggested actions.
Status

Suggested action

Indicates that the stack is working
correctly.

No action is required.

Not Ready to Inspect Unknown

Indicates that the stack is notinspecting traffic for an unknown
reason.

This is a transitory state and no action
is required.

Not Ready to Inspect Rebooting

Indicates that the stack is notinspecting traffic because one or moreof the stack members is rebooting.

This is a transitory state and no action
is required.

Not Ready to Inspect Layer 2 Fallback

Indicates that the stack is notinspecting traffic because one or moreof the devices is stuck in Intrinsic HA
Layer-2 Fallback.

At a minimum, reboot the device. If thedevice returns to this state, a hardwarerelated issue is likely.

Ready to Inspect - Normal

22

Information

TPS Stacking User Guide

StatusInformation

Suggested action

Not Ready to Inspect Recoverable Layer 2 Fallback

Indicates that the stack is notinspecting traffic because one or moreof the devices is waiting for you todisable Intrinsic HA Layer-2 Fallback.

Disable Intrinsic HA Layer-2 Fallback on
the stack.

Not Ready to Inspect Invalid

Indicates that the stack is notinspecting traffic because one or more
devices has not completed the bootsequence.

Validate that each device hascompleted its boot sequence. To
validate a particular device, log in to its
serial interface and look for Run Level
12 in the boot sequence. If necessary,
reboot the device.

Indicates that the number of devices inthe stacking bus does not match thestack configuration.

Validate that the number of devices
that are cabled together in the stacking
bus correspond to the stackconfiguration in the SMS.

Indicates that the stack is in Intrinsic HA
Layer-2 Fallback but can return to
Ready to Inspect - Normal when
the stack primary determines that theminimum number of devices are readyto inspect.

Depending on whether you configured
the stack for resiliency, all but one of
the stack members, or all of the stackmembers must declare they are
Ready to Inspect - Normal before
the stack primary returns the stack to
Ready to Inspect - Normal.
Learn more.

Ready to Inspect - Layer 2
Fallback•

Stacking bus — Indicates the current state of the stacking bus topology.
The following information provides stacking bus status information and suggested actions.
StatusInformation

Suggested Action

Connected in a ring

Indicates that the AOC or QSFP+ cables
are installed correctly.

No action is required.

Not Connected in a ring

Indicates that the AOC or QSFP+ cables
are not installed correctly.

Verify the stacking bus health.

•

Stack Resilience — Indicates whether the stack goes into Intrinsic HA Layer-2 Fallback if a single
device is not ready to inspect. Learn more.

•

Segment Reference Device — Indicates the network segment device that the SMS uses as areference to manage the inspection policy across each segment of the stack. Click Edit to change thesegment reference device.

•

Stack Members (N) — Indicates the number of TPS devices in the stack configuration and does notreflect the number of devices in the stacking bus.
Note
For information about the status of the stacking bus topology, use the Stack Port A and Stack Port B
columns. Learn more.

Verify stacking bus state
The Summary tab displays stacking bus health by checking the state of the special purpose ports and thestate of the stack topology on each device. If the status of the stacking bus is not green (normal), identify andresolve any issues.
23

TPS Stacking User Guide

To verify stacking bus state
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

In the Summary tab, verify stacking is enabled on each device and the status of special purpose port
connectivity:•

Enabled — Indicates whether stacking isenabled or

disabled.

When you add a device to the stack configuration, the SMS automatically enables stacking on thedevice. If necessary, remove the device from the stack configuration and then add it to the stack toenable stacking. If necessary, remove the device from the stack and then add it to the stack to enable
stacking.
•

Stack Port A and Stack Port B — Indicate the special purpose port connectivity.
The following information provides special purpose port status information and suggested actions.
Status

Suggested action

devicename

Indicates the device to which thespecial purpose port is resolved.

No action is required.

<No Peer>

Indicates a peer device is notconnected to the special purpose port.

Validate that the special purpose port isconnected to a special purpose port ona peer device.

Indicates stacking is not enabled on thepeer device.

Validate that stacking is enabled on thepeer device.

Indicates the peer device is not
managed by the SMS.

Manage the peer device with the SMS.

Indicates the peer device has not
returned any stacking information.

Verify that the special purpose port
connects the peer device to the samestacking bus as the segment reference
device.

<Unknown> (mac-address-hex)
No peer information isavailable

4.

Information

Use the Status column to verify the stack topology state.
The following information provides stack topology status information and suggested actions.
Status24

Information

Suggested action

Segment Reference

Indicates that the device has been
designated as the segment reference
device and is ready for stacking.

No action is required.

NormalIndicates that the device is functioning
normally.

No action is required.

Missing peer

Indicates a peer device is not connectedto the special purpose port.

Validate that the special purpose port isconnected to a peer device.

Indicates the peer device that isconnected to the special purpose port
does not have stacking enabled.

Validate that stacking is enabled on thepeer device.

TPS Stacking User Guide

StatusInformation

Suggested action

Peer {device-name} is not astack member

Indicates that a device special purpose
port references a device that is not
actually a part of the stack. This message
appears once for each special purpose
port.

Update the stack configuration to add thedevice.

Indicates that the device is not in thestack topology.

Validate that the SP port connects to a
special purpose port on a peer device.

Indicates that there is an I/O module on
the device that does not match the I/O
module in the segment reference device.

Verify that the slot on the device isconfigured with the same network I/O
module or no network I/O module ascompared to the segment reference
device.

The peer device that is connected to thespecial purpose port is not managed by
the SMS.

Manage the peer device with the SMS.

The peer device is not added to the SMS
stack configuration.

Use the SMS to update the stackconfiguration.

Not in stack

Wrong I/O Modules in slot(s){slot numbers}

Unknown peer(s) found

Verify stack member state
The Summary tab displays the state of each stack member as reported by the device. If the status of a stackmember is not green (normal), identify and resolve any issues.
To verify stack member state
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

In the Summary tab, use the Stack Member State column to verify the stack member status.
The following information provides stack member status information and suggested actions.
StatusInformation

Suggested action

RTI - Normal

Indicates that the stack member isworking correctly.

No action is required.

NRTI - Unknown

Indicates that the stack member is notinspecting traffic for an unknown reason.

This is a transitory state and no action isrequired.

NRTI - Rebooting

Indicates that the stack member is notinspecting traffic because it is rebooting.

This is a transitory state and no action isrequired.

NRTI - L2FB

Indicates that the stack member is notinspecting traffic because it is stuck in
Intrinsic HA Layer-2 Fallback.

At a minimum, reboot the device. If thedevice returns to this state, a hardwarerelated issue is likely.

NRTI - L2FB, Recoverable

Indicates that the stack member is notinspecting traffic because it is waiting for
you to disable Intrinsic HA Layer-2
Fallback.

Disable Intrinsic HA Layer-2 Fallback on
the stack.

25

TPS Stacking User Guide

Status
RTI - L2FB

Information

Suggested action

Indicates that the stack member is in
Intrinsic HA Layer-2 Fallback but canreturn to
Ready to Inspect Normal when the stack primary
determines that the minimum number ofdevices are ready to inspect.

Depending on whether the stack is a
resilient configuration, all but one of thestack members, or all of the stackmembers must declare they are
Ready to Inspect - Normal before
the stack primary returns the stack to
Ready to Inspect - Normal. Learn
more.

Verify device state
The Summary tab displays the state of each device. If the status of a device is not green (normal), identify andresolve any issues.
To verify device state
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

In the Summary tab, use the Device State column to verify the device status.
The following information provides device status information and suggested actions.
StatusInformation

Suggested action

NormalIndicates that the device is working
normally.

No action is required.

Updating

Indicates that the device is updating its
status.

This is a transitory state and no action isrequired.

Unmanaged

Indicates the device is not managed by
the SMS.

Use the SMS to manage the device.

Not Communicating

Indicates that the device is notcommunicating across the management
network with the SMS.

Verify network connectivity between the
SMS and the device. Also, verify therequired ports are not blocked.

Layer 2 Fallback

Indicates that the device is not inspecting
traffic because Intrinsic HA Layer-2
Fallback is enabled.

If you enabled Intrinsic HA Layer-2
Fallback on the device, disable Intrinsic
HA Layer-2 Fallback.
If you cannot disable Intrinsic HA Layer-2
Fallback, determine whether stacking has
put the device into Intrinsic HA Layer-2
Fallback.

Rebooting

Indicates that the device has started areboot based on a request from the SMS.

This is a transitory state and no action isrequired.

Verify stack synchronization
The Sync Health tab displays stack synchronization status. For example, synchronization status indicates
whether the same TOS version is installed on each device. If the status of the synchronization health is notgreen (normal), identify and resolve any issues.
26

TPS Stacking User Guide

There are configuration items that should match across each segment of the stack, such as virtual segments
and profiles. If they do not match, the SMS indicates the mismatch and shows the degraded stack health.
To verify stack synchronization
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

Click the Sync Health tab.

4.

Use the Status For and Issue columns to identify synchronization issues.
The following information provides synchronization status information and suggested actions.
Stack information
TOS

Information
Indicates the TOS version for each of
the devices.
Critical indicator: Indicates amismatch in versions or distribution.

Suggested Action
Distribute the TOS version to the stack.

Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by TOS
Versions.
Digital Vaccine

Indicates the Digital Vaccine version foreach of the devices.
Major indicator: Indicates amismatch in versions or distribution.

Distribute the Digital Vaccine package to the stack.

Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Digital
Vaccines.
{aux-dv-sub type-name}ThreatDV Versions

Indicates the ThreatDV version of a
specific ThreatDV subtype for each of
the devices. If a ThreatDV subtype has
not been distributed to a device, thecell value is <None>.

Distribute the ThreatDV package to the stack.

Major indicator: Indicates amismatch in versions or distribution.
If a ThreatDV subtype is not distributed
to any devices, it is not displayed.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by ThreatDV
Versions.

27

TPS Stacking User Guide

Stack information{dvt-name}

Information
Indicates the Digital Vaccine Toolkit(DVT) version of a specific DVT for eachof the devices. If a DVT has not been
distributed to a device, the cell value isSuggested Action
Distribute the DVToolkit package to the stack.

<None>.

Major indicator: Indicates amismatch in distributions (notversions).
If the DVT is not displayed, the DVT was
not distributed to any devices.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by DVToolkit
Versions.
{physical-segment-nameand-direction}

Indicates the{profile name} {profileversion} was distributed to a physicalsegment on each of the devices.

Distribute the profile to the physical segment.

Major indicator: Mismatch between
profile name, profile version, or
distribution.
Major indicator: <Unknown>
Indicates a profile has not been
distributed to a segment on one of thedevices.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by PhysicalSegment's Profiles.
{virtual-segment-name}Indicates the{profile-name} {profileversion} was distributed to a virtual
segment on each of the devices.
Major indicator: <Unknown>
Indicates a profile has not been
distributed to a virtual segment on any
device, or a profile exists but it was not
distributed by the SMS.
: Indicates a
Major indicatormismatch between profile name,profile version, or distribution. There is
one row for each virtual segment.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Virtual
Segment's Profiles.

28

Distribute the profile to the virtual segment.

TPS Stacking User Guide

Stack information
Missing {virtual-segmentname}

Information
Indicates a virtual segment exists on
the SRD but is missing from all theother stack members.

Suggested Action
Edit and save the virtual segment to update thestack.

Critical indicator: There is one
missing virtual segment row for each
virtual segment on the SRD that is noton any of the other member devices.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Missing
Virtual Segment.
Extra {virtual-segmentname}Indicates an extra virtual segment
exists on one of the stack members but
is missing from the SRD.

Delete the extra virtual segment if it is not applicable.
Or, edit and save the virtual segment to update thestack.

Critical indicator: There is one extra
virtual segment row for each virtual
segment that is not in the segment
reference device but is in one of theother devices in the stack.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Extra
Virtual Segment.
Mismatched group for{virtual-segment-name}Indicates the{segment-group-name}to which a virtual segment belongs foreach of the devices.

Edit and save the segment group (without making
any changes) to update the segment group with all of
its segments.

Critical indicator: There is one row
for each virtual segment that has amismatch in segment groups.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Virtual
Segment's Group.
Mismatched group for{physical-segment-name}Indicates the{segment-group-name}to which a physical segment belongs
for each of the devices.
Critical indicator
listed.

Edit and save the segment group (without making
any changes) to update the segment group with all of
its segments.

: The mismatch is

There is one row for each physicalsegment that has a mismatch insegment groups.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by PhysicalSegment's Group.

29

TPS Stacking User Guide

Stack information

Information

Extra rule {inspection-bypassrule-name}Indicates that there is an inspection
bypass rule on a stacking device that is
not on the segment reference device.

Suggested Action
Edit and save the inspection bypass rule (without
making any changes) to update the stack.

Critical indicator: There is one row
for each inspection bypass rule.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Extra
Rule.
Missing {inspection-bypassrule-name}Indicates that there is an inspection
bypass rule on the segment reference
device that is missing from a device inthe stack.

Edit and save the inspection bypass rule (without
making any changes) to update the stack.

Critical indicator: There is one row
for each inspection bypass rule.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Missing
Rule.
Stack Resilience {stackresilience-value}

Indicates that there is at least one
device with a different Stack Resilience
option than what is configured for the
stack.
Critical indicator: The mismatch islisted.

Edit and save the stack configuration (without
making any changes) to update all of the stacking
devices.

Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Device
Resilience Mismatch.
SSL Enabled

Indicates that SSL inspection is enabled
on some of the devices in the stack but
not all of them.

Edit the device configuration on each stacking device
to verify that SSL inspection is enabled (Devices > All
Devices > device-name > Device Configuration).

SSL Licensed

Indicates that some of your devices
have a license that allows SSL
inspection and others that do not allow
SSL inspection.

Update your license package to assign a productcapability that you have purchased, such as SSL
inspection, to each stacking device. When you install
the license package on the device, be sure to reboot
the device and enable the license capability for SSL
inspection.
Important
Do not reboot all devices in a stack at thesame time. When you have to reboot devices
in a stack configuration, reboot each device
that you updated sequentially. Allow eachdevice to finish the boot sequence completely—ensuring that the SMS has successfully
managed the device—before rebooting thenext device.
Go to TMC at https://tmc.tippingpoint.com/ toreview and manage the capabilities in your license
package.

30

TPS Stacking User Guide

Stack information
License Throughput

Information
Indicates that some of your devices
have a license for a different inspection
throughput rate than the other devices.

Suggested Action
Update your license package to assign a productcapability that you have purchased, such as
inspection throughput, to a particular security
device.
Go to TMC at https://tmc.tippingpoint.com/ toreview and manage the capabilities in your license
package.

Extra VLAN {translationdescription}

Indicates that there is a VLAN
translation rule on a stacking device
that is not on the segment reference
device.
There is one row for each VLAN
translation rule.
Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Extra
VLAN.

Missing VLAN {translationdescription}

Indicates that there is a VLAN
translation on the segment reference
device that is missing from a device inthe stack.
There is one row for each VLAN
translation rule.

Remove the device from the stack, restore the device
to its original settings, and then add the device to thestack.
If necessary, edit the VLAN translation mappings forthe segment reference device to include the VLAN
translation mapping from the stacking device.

Edit and save the VLAN translation mapping on thesegment reference device (without making any
changes) to update all of the stacking devices.

Tip: To filter synchronization
information by this type of issue, use
the Type column to filter by Missing
VLAN.

Resolve issues adding a device to the stack configuration
The following information provides device status and suggested actions for adding a device to the stackconfiguration.
StatusInformation

Suggested action

Indicates that there is no issue with adding
the device to the stack.

No action is required.

This device's TOS version
doesn't match the TOS version forthe selected devices.

Indicates that there is a TOS version
mismatch.

The TippingPoint Operating System (TOS)
version must be the same on each device inthe stack. If necessary, install a matching
TOS version on the device and then add it
to the stack.

This device does not support
stack sizes of more than ##devices.

Indicates a device is valid for stacking, butthat the maximum number of devices inthe stack has been reached.

Remove a device from the stack so that you
can add the device.

Device is not communicating

Indicates that the device is notcommunicating with the SMS.

Verify network connectivity between the
SMS and the device. Also, verify therequired ports are not being blocked.

Device is unmanaged

Indicates that the SMS no longer manages
the device.

Use the SMS to manage the device.

Ready for stacking

31

TPS Stacking User Guide

View stacking tier statistics
Use the SMS to view tier statistics on the device for stacking (Tier S) in addition to tiers 1–4.
The tier statistics area provides information on packets and speed as measured in Mbps by tier. Refer to the
SMS User Guide for more information about tier statistics for the various TippingPoint devices.
Tier S data includes stacking data from the special purpose ports.
Inspection Tier
Stack : Segment Ports

Information
This inspection tier presents the total I/O module throughput for the network segment device as wellas the receive rates from the I/O module to each stack member.
When stacking is enabled, the following information is displayed:•••

Segment Rx Mbps displays the aggregate received traffic from all network segments on thisdevice.

Segment Tx Mbps displays the aggregate traffic transmitted from all network segments on thisdevice.

Stack Balance (A/B/C) displays the load balance percentage, in which 100% equates toperfect balance across the number of devices in the stack. For devices that are in Intrinsic HA
Layer-2 Fallback, the Rx rate is zero, and this zero value is included in the load balance calculation.
This statistic is similar to the A/B/C Balance percentage in Tier 1.
•<host n> Rx Mbps displays the traffic balanced from this device's network segments to theother devices in the stack.

Note that the number of packets going through each host is flow-based, so it is notuncommon to see a slight difference between them.
•Stack : Stack Ports

Segment ratio to tier 1 displays the percentage of traffic that is inspected by this device asa ratio of the segment Rx traffic.

This inspection tier presents special purpose port throughput, including through traffic and return
traffic rates.
When stacking is enabled, the following information is displayed:••

Stack Rx Mbps displays the aggregate traffic that is received on both special purpose ports.
Stack Tx Mbps displays the aggregate traffic that is transmitted from both special purpose

ports.

•

Stack Rx > Stack Tx displays the total amount of transit or through traffic on the special
purpose ports; for example, traffic that is received on special purpose port 1, which is forwarded
by the switch to special purpose port 2.

•

Stack Rx > Seg Tx displays the amount of return traffic coming in on a special purpose portthat is returning to the outbound network segment.

•

Stack ratio to tier 1 displays the percentage of traffic that is inspected by this device as aratio of the stack Rx traffic.

Intrinsic HA Layer-2 Fallback
Intrinsic High Availability (Intrinsic HA) determines how the device manages traffic on each segment in theevent of a system failure. Layer-2 Fallback either permits or blocks all traffic on each segment, depending on
the Intrinsic HA action setting for the segment. Any permitted traffic is not inspected.
You can enable Intrinsic HA Layer-2 Fallback on a stack member or the entire stack, for example, to performscheduled maintenance. When you finish, disable Intrinsic HA Layer-2 Fallback to resume normal operation.
Stacking automatically enables and disables Intrinsic HA Layer-2 Fallback on a stack member or the stack asneeded, depending on the inspection state of the stack or the devices.
32

TPS Stacking User Guide•

Ready to Inspect (RTI) indicates that a device or the stack is ready to inspect traffic. If enough devices
are ready to inspect, the stack primary takes the stack out of Intrinsic HA Layer-2 Fallback. Learn more.

•

Not Ready to Inspect (NRTI) indicates that a device or the stack is not ready to inspect traffic.
When a device or stack is not ready to inspect, Intrinsic HA Layer-2 Fallback remains enabled until thecause is resolved. In some cases, this is a temporary recoverable condition and in other cases, recovery
requires manual intervention. Learn more.
Tip
If a device or the stack is in Intrinsic HA Layer-2 Fallback, disable Intrinsic HA Layer-2 Fallback on the stack to
restore the stack to normal operation. If the stack does not return to normal operation, verify the stack health todetermine why the stack is in Intrinsic HA Layer-2 Fallback and resolve any issues. Learn more.

Enable Layer-2 Fallback on the stack
Enable Intrinsic HA Layer-2 Fallback on the stack to either permit or block all traffic on each segment of any
devices in the stack, depending on the Intrinsic HA action setting for each segment. When you disable
Layer-2 Fallback on the stack, the stack returns to normal operation.
To resume normal operation, the stack must validate:•

The minimum number of devices are ready to inspect. Learn more.

•

The stack members communicate regularly with the stack primary.
If the number of missed heartbeats exceeds a threshold value, or if the device does not send a heartbeat
message within 15 minutes of rebooting, the device is not ready to inspect.

•

The same TOS version is installed on each device. Learn more.

If you manually enable Layer-2 Fallback on the stack, you must also disable it to resume normal operation. If
necessary, resolve any Layer-2 Fallback issues on a stacking device so that you disable Layer-2 Fallback.
To configure Layer-2 Fallback on the stack
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, right-click the stack and click Edit > Intrinsic HA, then choose an option:•

Fallback – Enables Layer-2 Fallback.

•Normal – Disables Layer-2 Fallback.

Enable Layer-2 Fallback on a stacking device
Enable Intrinsic HA Layer-2 Fallback on a stacking device to either permit or block all traffic on any segment,
depending on the Intrinsic HA action setting for each segment.
When you disable Layer-2 Fallback on a stacking device, the stack primary determines whether to return thedevice and the stack to normal operation. Learn more.
Before you enable Layer-2 Fallback on a stacking device, consider whether the loss of the device would place
the entire stack into Layer-2 Fallback. For example:
33

TPS Stacking User Guide•

Resilient stack configuration – The loss of a single device would not place the stack into Layer-2 Fallback.

•Single network segment device – The loss of the network segment device would place the stack into
Layer-2 Fallback.

To configure Layer-2 Fallback on a stacking device
Procedure1.

In the SMS tools, click Devices.

2.

In the All Devices workspace, double-click the stack.

3.

In the left navigation pane, expand the stack.
If a stacking device is in Layer-2 Fallback, the name of the device is appended by (fallback). In thefollowing example, MyStack and its stack members are in Layer-2 Fallback.

4.

Click the device that is in Layer-2 Fallback.
The stacking device shelf-level graphic is displayed.

5.

In the Device workspace, right-click the shelf-level graphic and click Edit > Intrinsic HA, then choose an
option:•Fallback – Enables Layer-2 Fallback.

•Normal – Disables Layer-2 Fallback.

Export a Tech Support Report
You can collect diagnostic information from a TPS device by exporting a Tech Support Report (TSR). The TSR
collects information from diagnostic commands and log files into a report that customer support can use todiagnose issues with the device.
Tip
When you export a TSR from the SMS, the TSR does not include snapshot information. However, you can create asnapshot from the SMS.

To collect diagnostic information for the stack1.
34

Use the SMS to export a TSR from each device in the stack.

TPS Stacking User Guide

2.

Save each TSR to your local system.

3.

Email the TSR files to customer support for assistance.

To create a Tech Support Report1.

In the SMS tools, click Devices.
••

If the device is not a member of a stack:a.

In the All Devices workspace, right-click the shelf-level graphic for the standalone IPS or TPS
device and select Export TSR.

b.

Click Export to download a tar.zip file of the report to your local Downloads directory.

If the device is a member of a stack:a.

In the All Devices workspace, double-click the stack.

b.

In the left navigation pane, expand the stack to select the stacking device.

c.

Right-click the shelf-level graphic for the stacking device and select Export TSR.

d.

Click Export to download a tar.zip file of the report to your local Downloads directory.

CLI commands for stacking
From the device CLI, run the show stacking command to display stacking status information. For more
information about stacking-related commands, see the TPS Command Line Interface Reference.

Considerations
Consider these points when planning your stacking deployment:•

The following options, which require state information to be shared across multiple devices, are notsupported in a stacking configuration:•

Transparent HA•

IPS Quarantine. As a workaround, use SMS Responder to propagate IPS Quarantine to stackmembers.

•

Scan/sweep filters•

Policy-based rate limits•

SSL inspection (9200TXE devices only)•

The SMS is required to manage the stack and any stack members. You cannot manage the stack fromthe device CLI.

•

All stack members must use consistent sets of inspection profiles to ensure inspection policies areapplied consistently, regardless of which device inspects the traffic.
Note
There are differences between configuring a stack of devices compared with configuring a standalone device. Learn
more.

35

TPS Stacking User Guide

Repurposing a device
If you have an existing TPS device that is not currently deployed in your network, you can repurpose thedevice for use in a stack. Also, if you remove a device from a stack, you can repurpose it for use in anotherstack or as a standalone device.
To repurpose a device, use the debug factory-reset command to restore the device to its original settings.
Consider the following points when you repurpose a device for use in a stack:36•

Install the same TippingPoint Operating System (TOS) version on each device in the stack.

•Configure the same slot on each device with either the same network I/O module or no network I/O
module as compared to the network segment device.