Top 7 Bypass TAPs for 5G Core Inline Security

5G core security now runs inline. Firewalls, GTP firewalls, IPS and DDoS appliances sit directly on user-plane links. Each of those appliances is a potential single point of failure. A crashed firewall or a failed software update can black out subscriber traffic across a region. Bypass TAPs remove that risk. They check each inline tool with heartbeat packets and route traffic around it when it stops responding. The pressure is rising going into 2027. User-plane links are getting faster, and more security functions now run as software on commodity servers. UK operators also face Telecommunications Security Code of Practice deadlines on 31 March 2027. This guide compares seven bypass TAP vendors on speed, failover design, service chaining and operator fit. Every specification comes from vendor datasheets, documentation or product pages.

Bypass TAPs for 5G Core Security at a Glance

1. Network Critical

Network Critical: Bypass TAPs, SmartNA-XL, SmartNA-PortPlus

Network Critical builds bypass TAPs as hot-swap modules for its SmartNA chassis family. You can mix bypass, passive fibre and copper TAP modules in one unit. That suits 5G core sites where inline firewalls and out-of-band probes share the same racks.

The SmartNA-XL is a five-slot 1RU hybrid TAP and packet broker with 480 Gbps of bi-directional visibility. Network Critical lists 10G active fibre bypass protection for it, with 40G and 100G versions available. Bypass modules handle frames up to 16,383 bytes, leaving headroom for GTP-U encapsulation. The same chassis aggregates, filters and load balances traffic. One device can protect the inline tool and feed your passive tools.

For larger tool farms, the SmartNA-PortPlus scales from 48 to 194 ports at 1G to 100G. It delivers 1.8 Tbps of line-rate throughput. Session-aware load balancing by IP, protocol, port, VLAN or MAC spreads traffic across parallel inline tools. DC input from -40 to -72VDC fits standard -48V telecom power.

Drag-n-Vu handles configuration through a drag-and-drop interface, with a RESTful API for automation. Network Critical reports typical deployments completing in under two hours. Every platform ships on a perpetual licence with no subscription. SNMP traps, link status traps and alarm generation report bypass events to your NOC.

Best for: Operators who want bypass protection, TAP access and packet brokering in one modular chassis, without subscription costs.

Proven results:

• Major League Baseball: A national carrier used SmartNA Bypass TAPs to keep replay video flowing when monitoring tools went offline
• Vodafone: Achieved 100% accurate traffic visibility on key links across four generations of mobile network
• Darktrace: Used the SmartNA-PortPlus API to control filtering and port mapping automatically, with no human intervention

2. Gigamon

Gigamon: GigaVUE-HC3 and GigaVUE-HC1-Plus bypass combo modules

Gigamon builds bypass into its GigaVUE HC Series visibility nodes rather than selling standalone bypass units. The GigaVUE-HC3 accepts bypass combo modules with two 100G or 40G inline network pairs. Each module also carries sixteen 10G or 25G ports. A single chassis takes up to four of these modules.

Protection works on two levels. Logical bypass routes around an inline tool when heartbeats fail or connectivity drops. Physical bypass uses optical relays, so traffic keeps flowing if the node loses power or a module is pulled. Gigamon Resiliency for Inline Protection (GRIP) pairs two HC nodes. If one loses power, the other takes over the inline path.

This design suits operators already running Gigamon for out-of-band visibility. Inline and out-of-band traffic share one fabric and one management plane. Gigamon's own documentation notes that inline bypass configuration can be complex and must follow a set order. Budget for specialist engineering time and subscription licensing when you model total cost.

3. Keysight

Keysight: iBypass 100G, iBypass VHD

Keysight's iBypass range came from the Ixia acquisition and is common in service-provider security stacks. The iBypass 100G supports 40G and 100G network links in dual mode, with QSFP28 tool ports. Its two-bay chassis takes one bypass module per bay, and each module protects a single security tool.

The two modules can run active-standby or active-active. A second firewall or IPS then takes over before traffic is bypassed. Bi-directional heartbeats check tool health, and Link Fault Detect limits traffic interruption. The switch can also fail over when it detects CRC errors. For 10G links, the iBypass VHD fits up to 12 bypass switches in 1U.

Keysight ships preset heartbeat profiles for common security tools inside the interface. Its IFC Centralized Manager configures tens to hundreds of bypass switches from one console. That helps operators protecting tools across several 5G core sites. Pricing sits at the premium end, in line with Keysight's wider Vision portfolio.

4. Garland Technology

Garland Technology: EdgeSafe Bypass TAPs, EdgeLens

Garland's EdgeSafe Bypass TAPs cover 1G to 100G links and use heartbeat packets to detect inline tool failure. EdgeSafe adds filtering, so you send only the traffic your inline tool needs to inspect. That reduces load on expensive IPS and firewall capacity. EdgeSafe can also act as a standard network TAP. It sends filtered copies of full-duplex links to out-of-band tools.

EdgeLens hybrid inline packet brokers combine bypass protection with packet broker functions. These include advanced filtering and out-of-band tool feeds. Garland also pairs its bypass range with Mira Encrypted Traffic Orchestration. Mira decrypts TLS and SSH traffic so inline tools can inspect it.

Garland states a no-subscription commercial model on its website. Its portable managed bypass TAPs cover 100M to 10G, with a GUI for quick set-up. The range is strongest in US enterprise and OT deployments. European operators should check local support coverage, as field presence there relies mainly on distributors.

5. Niagara Networks

Niagara Networks: 3808E Hybrid Bypass, 3296 Passive Bypass

Niagara Networks puts inline bypass at the centre of its carrier and enterprise portfolio. The 3808E is a carrier-grade platform combining bypass, active TAP and packet broker functions. It supports 1G to 100G links with redundant power and sub-50 ms failover.

Niagara uses a dual-protection design. A switching fabric bypass reacts when heartbeats stop returning from the inline tool. An internal optical relay takes over if the bypass switch itself loses power. The 3296 passive bypass switch protects up to eight network links with relay-based continuity.

Niagara supports inline service chains, such as firewall to IPS to SSL inspection. The bypass switch manages the whole chain as one protected segment. That maps well to 5G user-plane stacks with several tools in series. A REST API lets you automate fail-safe scenarios. Niagara's packet brokers reach 400G, while its bypass portfolio runs up to 100G.

6. Silicom

Silicom: IS100 Intelligent Bypass Switch, IS40, bypass server adapters

Silicom approaches bypass from the appliance side as well as the network side. The IS100 is its fourth-generation 100G external bypass switch. It is a 1U host taking up to two modules, each protecting one bypass segment. Both multimode and single-mode 100G optics are supported.

The IS100 generates its own heartbeats, so the protected tool needs no driver or management software. It runs in four modes: inline, bypass, tap and link drop. Redundant AC or -48V DC power supplies suit telco central offices. The IS40 covers 10G and 40G links and adds selective bypass filtering with allow and block lists.

Silicom also builds bypass server adapters, including a dual-port 100G card based on Intel's E810 controller. This matters in 5G cores where firewalls and DPI run as software on commodity servers. The adapter keeps traffic flowing if the host fails. Check how far tap mode covers your out-of-band needs before ruling out a separate packet broker.

7. Profitap

Profitap: F1-10G-BP Bypass TAP

Profitap is a Netherlands-based visibility vendor best known for portable capture and its IOTA analysis appliances. Its F1-10G-BP bypass TAP protects inline IDS, IPS and next-generation firewalls on 10G links. It sends heartbeat packets to check tool health and switches to bypass mode on failure.

The unit is designed to keep the link up even if the TAP itself becomes unavailable. Fail-safe protection covers tool hardware faults, power loss and software problems. It uses SFP+ ports and dual 12V DC inputs in a compact form factor.

At 10G, the F1-10G-BP fits 5G edge sites, MEC deployments and management links better than core user-plane links. Profitap has strong European reseller coverage, which helps operators wanting local support. Its wider range includes cloud TAPs for Kubernetes and virtual machines, useful alongside physical bypass. For 40G and 100G core links, you will need a different bypass platform.

How to Choose the Right Bypass TAP for Your 5G Core

Match bypass speed to your user-plane roadmap

Start with every N3, N6 and N9 link you protect today, then map its upgrade plan. Every vendor in this guide publishes bypass protection at 100G or below. For 400G links, plan to break traffic out to 100G inline segments. You can feed out-of-band tools at full rate through a 400G packet broker such as the SmartNA-PortPlus HyperCore.

Understand the failover design

Bypass products fail over in two ways, and your 5G core needs both. Check these points in every datasheet:

• Heartbeat detection. Bi-directional, configurable heartbeats catch a hung tool that still shows link.
• Physical relay. Optical or copper relays keep traffic moving if the bypass unit loses power.
• Failover time. Vendors quote figures such as sub-50 ms. Test with your own traffic during the pilot.
• Fail-back rules. Confirm how many good heartbeats are needed before traffic returns to the tool.

Plan for service chains and redundancy

5G user-plane security rarely means one tool. You may chain a GTP firewall, an IPS and a DDoS appliance on one link. Look for active-standby or active-active support, so a second tool takes over before bypass is needed. Hybrid TAPs combine bypass, aggregation and load balancing in one chassis, which simplifies chained designs.

Check telco power and management fit

Central offices and core data centres often run -48V DC power. Confirm DC input ranges and dual hot-swap power supplies before you shortlist. Bypass events also need to reach your NOC. SNMP traps, link status alerts and a REST API let you log and automate every failover.

Build compliance evidence into the design

UK Tier 1 providers face Telecommunications Security Code of Practice measures due by 31 March 2027. The revised Code issued in July 2026 adds further measures due between 2028 and 2029. Bypass devices will not deliver compliance on their own. But logged failover events and documented inline protection help you evidence availability controls to Ofcom.

Model three-year total cost

Compare purchase price, support, licences and subscriptions over three years. Some platforms license inline features per port or per year. Perpetual licences make costs predictable for budget planning. Factor in engineering time too, as complex inline configuration adds hours to every change window.

Frequently Asked Questions

What does a bypass TAP do in a 5G core network?

A bypass TAP keeps 5G user-plane traffic flowing when an inline security tool fails or goes offline. It sends heartbeat packets through the tool and checks that they return. If they stop, the TAP routes traffic around the tool automatically. Many models also copy traffic to out-of-band monitoring tools.

Is a bypass TAP the same as a bypass switch?

Yes, the two terms are used almost interchangeably. Some vendors reserve "bypass TAP" for devices that also copy traffic to passive monitoring tools. Network Critical's bypass switch modules sit in the same chassis as its TAP and packet broker functions.

Do firewalls with built-in bypass still need an external bypass TAP?

Usually, yes, on critical links. Internal bypass protects against some faults, but it lives inside the appliance. Removing or replacing that appliance still breaks the link. An external bypass TAP lets you pull a tool for upgrades or RMA without a maintenance window.

Which 5G core interfaces need bypass protection?

Any interface carrying an inline security tool needs bypass protection. N6 is the most common, where firewalls, IPS and DDoS tools sit between the UPF and the data network. N3 and N9 also need it where GTP firewalls inspect user-plane tunnels. Operators planning wider coverage can review Network Critical's telecommunications network visibility solutions.

Can one bypass TAP protect several security tools in series?

Yes, if it supports service chaining. Vendors such as Niagara Networks manage a firewall, IPS and inspection chain as one protected segment. Confirm whether a mid-chain failure bypasses the whole chain or only the failed tool. That choice decides how much inspection you keep during an outage.

Protect Your 5G Core Security Stack With Network Critical

Your inline security stack is only as available as the bypass layer beneath it. Choose a platform that fails safe, reports every event and scales with your user plane. Network Critical combines bypass protection, TAP access and packet brokering in one modular SmartNA chassis. Its hybrid packet brokers let one device protect inline tools and feed passive probes. Drag-n-Vu lets your own engineers handle changes, with typical deployments completing in under two hours. Modular SmartNA hardware scales from 10 Mbps to 400 Gbps across the portfolio without a forklift upgrade. Perpetual licensing removes subscription costs entirely. Network Critical's modelling shows 40 to 60 per cent lower three-year TCO than subscription-based incumbents.

Talk to the Network Critical team to book a free network audit of your 5G core inline links.