synchronizing pix failover with primary pix

[vikrantarora]

When i telnet into the failover pix and do config t from configuration mode, i get the following error message:
Pix-Admin1# config t
**** WARNING ***
Configuration Replication is NOT performed from Standby unit to Active u
nit.
Configurations are no longer synchronized.

How do I synchronize?
I read somewhere that i shud do "erase mem" on the failover and then do "wirte standby" on primary.
i want to confirm that when i do "erase mem" on failover, it wont erase the configuration on the primary as well.

 

[yizhar]

HI.

Try the command "show failover" to verify which pix is the active unit.
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[vikrantarora]

i have found out whcih is active. now how do i synchronize or why am i getting the following warning when i do "config t" on one of them:

Pix-Admin1# config t
**** WARNING ***
Configuration Replication is NOT performed from Standby unit to Active u
nit.
Configurations are no longer synchronized.

I get this on the same firewall irrespective of teh fact if it is active or standby!

 

[haknwak]

You need to be into the primary machine - it doesn't matter if it's failver active or not.

make sure the config of that machine is what you want for both

- then do a 'wr mem' and 'wr stand'

if any problems you can always do a 'fail active' on this one then write the config to memory. "If you lived here, you'd be home by now!"

George Carlin

 

[haknwak]

Also - you can always go make the primary active, then do the commands as well

Get into the secondary machine and to a 'no fail active'

This should force the primary into active mode - then

Get into the primary and do a 'fail active' command.

Then set it's config the way you want and then do

'wr mem' and 'wr stand' "If you lived here, you'd be home by now!"

George Carlin

 

[vikrantarora]

I can not make any changes to the standby unit. I keep getting the message:
**** WARNING ***
Configuration Replication is NOT performed from Standby unit to Active u
nit.
Configurations are no longer synchronized.

My question is , if I am allowed or not to make config changes ot the standby unit or not??

 

[haknwak]

vikrantarora - that's what I said - you must make changes to the primary - in failover both units must have the same config.

You change config on the primary then you do a 'write memory' to update it and then a 'write standby' writes the config to the secondary unit.

It may be easier, as I mentioned, to make the primary unit acctive first though. "If you lived here, you'd be home by now!"

George Carlin