When it's the network choke point, no failover, and when the device is set to "fail closed".