PIX Failover 1

[HTY]

Hi,
I have 2 PIX units in a LAN failover enviroment, each of the 2 units have:
- 1 outside connection.
- 1 inside connection.
- 1 LAN Failover link to the other unit.
- 1 Stateful Failover link to the other unit.

1st question:
What happens if a failure happens on the LAN FO Cable? will the hello messages go through the other interfaces (inside, outside ans stateful FO)? will the PIX units change their roles?

2st question:
What happens if a failure happens on the Stateful FO cable? Will the state synchronization messages go through the other interfaces (inside, outside and LAN failover)? )? will the PIX units change their roles?

3rd question:
What happens if a failure happens on both Stateful and LAN FO cables???

Thanks for your answers.


Hicham

 

[tbissett]

The hello packets sent across the Ethernet interfaces merely determine if the interfaces are up and working. They do not send failover status messages (unless the interface is configured as the LAN failover int).

Answers to the questions:

1st question
If the failover cable is severed or unplugged from EITHER unit, failover switching is disabled. Whichever unit was active at the time remains active.

2nd question
A failure in the stateful failover cable would disable stateful failover. Stateful messages do not go through the network interfaces. "Regular" failover would continue to work.

3rd question
Switching would be disabled as well as stateful failover. The primary unit would continue to function.

 

[8624]

you have two pix firwall and statful failover is configured proper, if on usit fails, the other unit will
assume the roll. Taking all the ip address, an the complate configuration of the failed unit. you the admin will know somthing happeen, but the users will not be effcted.

 

[smartino]

To all,

My question is:

1. Can you configure the Fiber failover cable for all failover and eliminate the statefule failover cable (serial?)

IE: Do you need both cables connected for proper operation?

thanks

Steve