Network Warrior

Failover

PIX firewalls can be configured in high-availability pairs. In this configuration, should the primary PIX fail, the secondary will take over. All PIX firewalls are capable of being configured for failover, except the 501 and 506e models. To use this feature, the PIX must be licensed for it. To determine whether your PIX is capable of being configured for failover, use the show version command:

PIX#sho version | include Failover
Failover:                    Enabled

To be installed as a failover pair, each PIX firewall must have the same PIX software release installed. Each PIX in a failover pair must also have the exact same configuration. As a result, the hostname will be the same on both firewalls in the pair. If you attempt to configure the standby firewall, you will receive an error telling you that any changes you make will not be synchronized:

PIX#conf t
**** WARNING ***
     Configuration Replication is NOT performed from Standby unit to Active unit.
     Configurations are no longer synchronized.

You won't actually be prevented from making the changes, though. I have stared stupidly at this message more times than I can count while making changes after working for 18 hours straight.

Failover Terminology

When in a failover pair, PIX firewalls are referenced by specific names, depending on their roles:

Primary

The primary PIX is the firewall on the primary end of the failover cable. This is a physical designation. On FWSMs, or models that do not use the failover cable, the primary PIX is configured manually ...