PIX-525 "Ethernet Only" Failover Question

[rsp11]

Hi All,
We have 2x PIX-525 v6.0(2) with:[ol][li]Serial Failover cable (Cisco special RS-232)[/li] [li]Ethernet Stateful Cable [/li][li] 8 Ethernet ports, 7 used with 1 spare [/li][/ol]Questions?[ol][li]We need to locate these boxes in separate buildings so I need to replace the serial cable with Ethernet. I know I'll need to upgrade to v6.2 but I can't find any resources on the net either from Cisco or anyone else detailing how it is done, i.e. a step-by-step guide. Can anyone help?[/li][li]Can this change be done without downtime, i.e. can I turn off and disconnect the primary, upgrade and reconfigure it, reconnect it to take over as primary (may be no stateful) then do the same with the secondary??[/li][/ol]

 

[baddos]

Upgrade both PIX's to 6.2 or 6.3.1 first.
Then before unhooking the serial cable, enter these commands into the Primary (active) PIX.

failover link nameoffointerface
failover lan unit primary
failover lan interface nameoffointerface
failover lan key myFOpassword

Then issue a write memory
Then issue a write standby
After the syc completed text is seen, you can disconnect the secondary pix and stick it in the other building. If then want the secondary PIX to become the primary PIX, then telnet to the primary PIX and type "failover lan unit secondary".

Definatly upgrade the PIX os first so you can do this with the least amount of downtime. There will be some downtime when you upgrade the PIX's and do the failing over.

-Bad Dos

 

[rsp11]

Thanks for that baddos

If I make the Secondary the active box, then upgrade the Primary. When I bring the Primary back online, what state will the pair be in? i.e., will I then be able to perform a "stateful" failover back to the Primary or will it be a none-stateful failover.
I am asking this because I've read that both boxes must be at the same level to achieve stateful failover.
I don't mind taking a hit, I just need to be sure I will be...[flush]

 

[baddos]

You need to have one box turned off when you upgrade the OS. THen when it's upgraded, turn it off and repeat the process on the other PIX. You can't have the PIX in failover where they are running different versions.

Your PIX won't be a stateful failover until you have the failover lan option on. But in either case, it doesn't matter which one is active.