Re: [fw-wiz] PIX stateful failover and separate external circuits

James Burns wrote:
Hi Florin,

The information you have been given is correct. For a Pix to support
stateful failover, a dedicated LAN interface between the two units is
required. You can read more here:

http://www.cisco.com/warp/public/110/failover.html#statefulfailover

Exactly. I just realized I've seen this a while ago - I had a pair of
PIXes in a failover configuration, each one connected to a different
switch, and the inter-connection between switches broke. The firewalls
went nuts trying to kickstart the failover process.

So yeah, the interfaces of the primary and the secondary need to be in
the same LAN segment.

--
Florin Andrei

http://florin.myip.org/
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: [fw-wiz] PIX Failover Questions
    ... Stateful Failover on the PIX is somewhat different to what you outline ... port will result in the traffic to that port being sent over the failover ... Ethernet link and out the matching standby port on the other PIX. ...
    (Firewall-Wizards)
  • RE: [fw-wiz] PIX stateful failover and crossover cables
    ... From the installation guide on failover off of the CCO-- ... Step 6 If you are using Stateful Failover, use one of the following types ... •100BaseTX half-duplex hub using straight Cat 5 cables. ... > connect the two PIX security appliances." ...
    (Firewall-Wizards)
  • Re: Failover Clarification
    ... >1) Standard Failover ... >2) Stateful Failover ... Serial cable replicates config between the 2 x units ... LAN connection between 2 x PIX's must be via a Hub ...
    (comp.dcom.sys.cisco)