PIX firewalls can be configured in high-availability pairs. In this configuration,
should the primary PIX fail, the secondary will take over. All PIX firewalls are capable
of being configured for failover, except the 501 and 506e models. To use this feature, the
PIX must be licensed for it. To determine whether your PIX is capable of being configured
for failover, use the
show version command:
sho version | include FailoverFailover: Enabled
To be installed as a failover pair, each PIX firewall must have the same PIX software release installed. Each PIX in a failover pair must also have the exact same configuration. As a result, the hostname will be the same on both firewalls in the pair. If you attempt to configure the standby firewall, you will receive an error telling you that any changes you make will not be synchronized:
conf t**** WARNING *** Configuration Replication is NOT performed from Standby unit to Active unit. Configurations are no longer synchronized.
You won't actually be prevented from making the changes, though. I have stared stupidly at this message more times than I can count while making changes after working for 18 hours straight.
When in a failover pair, PIX firewalls are referenced by specific names, depending on their roles:
The primary PIX is the firewall on the
primary end of the failover cable. This is a physical designation. On FWSMs, or models that do not use the failover cable, the primary PIX is configured manually ...