Cisco PIX 525 Spécifications télécharger pdf (Page 357)

10-3

Cisco PIX Firewall and VPN

78-15033-01

Chapter 10 Using PIX Firewall Failover

Understanding Failover

This section describes how failover works, and includes the following topics:

• Overview, page 10-3

• Network Connections, page 10-3

• Failover and State Links, page 10-4

• Primary and Secondary Vs. Active and Standby, page 10-6

• Configuration Replication, page 10-6

• Failover Triggers, page 10-7

Overview

The failover feature allows you to use a standby PIX Firewall to take over the functionality of a failed

PIX Firewall. When the active unit fails, it changes to the standby state, while the standby unit changes

to the active state. The unit that becomes active takes over the active unit’s IP addresses and

MAC

addresses, and begins passing traffic. The unit that is now in standby state takes over the standby

addresses and MAC addresses. Because network devices see no change in the MAC to IP address

pairing, no ARP entries change or time out anywhere on the network. (See the

“Primary and Secondary

Vs. Active and Standby” section for more information about MAC addresses).

The PIX Firewall supports two types of failover:

• Regular Failover—When a failover occurs, all active connections are dropped and clients need to

reestablish connections when the new active unit takes over.

• Stateful Failover—During normal operation, the active unit continually passes per-connection

stateful information to the standby unit. After a failover occurs, the same connection information is

available at the new active unit. Supported end-user applications are not required to reconnect to

keep the same communication session.

The state information passed to the standby unit includes:

–

NAT translation table

–

TCP connection states

–

H.323, SIP, and MGCP UDP media connections

Network Connections

Both units require the same access to the inside and outside networks. You must place them in parallel,

as shown in

Figure 10-1. Because the standby unit does not pass traffic, only the active unit takes part in

networking. The active and standby units must be on the same subnet, so there cannot be a router

between the two units. However, you can place one or more switches between the two units.

1 2 ... 352 353 354 355 356 357 358 359 360 361 362 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 357