PIX515 problem, switching between primary-secondary

[arqdennis]

I got the following from syslog. it repeats itself over and over. switching from primary to secondary and visa-versa. I need some clues on what could be causing this. I am running PIX515 with s/w version 4.4(8).

105008: (Primary) Testing Interface 5
104002: (Primary) Switching to STNDBY.
104003: (Primary) Switching to FAILED.
105009: (Primary) Testing on interface 5 Failed
105003: (Primary) Monitoring on interface 2 waiting
105003: (Primary) Monitoring on interface 0 waiting
105003: (Primary) Monitoring on interface 1 waiting
104004: (Primary) Switching to OK.
104001: (Primary) Switching to ACTIVE (cause: state check).
104001: (Primary) Switching to ACTIVE (cause: the otherside want me take over).
105004: (Primary) Monitoring on interface 2 normal
105004: (Primary) Monitoring on interface 0 normal
105004: (Primary) Monitoring on interface 0 normal


thanks in advance,

ARQ.

 

[arqdennis]

by the way we are not using interface 5...

ARQ.

 

[yizhar]

HI.

I have no experience with fail-over but will try to help here.

Did you verify in the config that interface 5 is administrativly shut down?
Use also "show interface" to check.

OR instead - you can try to connect interface 5 of both boxes to same hub and see what happens.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[arqdennis]

yeap, they are down on both primary and secondary. I have not seen problems yet with the failover disconnected. seems that the primary checks the secondary and if it's not working the secondary will go online. After a few minutes the secondary probs the primary and if it's ok it will run the primary PIX box.

interface ethernet4 "pix/intf4" is up, line protocol is down
...
interface ethernet5 "pix/intf5" is up, line protocol is down
...

thanks,

ARQ.

 

[xlee]

Are you doing stateful failover? If you are, you'll need version 5.0 or later.

 

[rubbaninja]

I know this one

All enabled interfaces must be connected between the Active and Standby units. If an interface is not in use, use the shutdown option to the interface command to disable the interface.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v53/config/advanced.htm#xtocid14

 

[Guest_imported]

You MUST disable able any interfaces that are not in use or failover will not work.

Also:

- Enable portfast on all ports on the switch that connects directly to the PIX Firewall.

- Turn off trunking on all ports on the switch that connects directly to the PIX Firewall.

- Turn off port channeling on all ports on the switch that connects directly to the PIX Firewall.