Cisco PIX 525 Spécifications télécharger pdf (Page 360)

10-6

Cisco PIX Firewall and VPN

78-15033-01

Chapter 10 Using PIX Firewall Failover

Understanding Failover

Primary and Secondary Vs. Active and Standby

The main differences between the two units in a failover pair are related to which unit is active and which

unit is standby, namely which IP addresses to use and which unit actively passes traffic.

However, a few differences exist between the units based on which unit is primary and which unit is

secondary:

• The primary unit always becomes the active unit if both units start up at the same time (and are of

equal operational health).

• The primary unit’s MAC addresses are always coupled with the active IP addresses. The exception

to this rule occurs when:

–

The secondary unit is active, and cannot obtain the primary’s MAC addresses over the failover

link.

–

If you hardcode them into the configuration (see the failover mac address command in the

Cisco PIX Firewall Command Reference for more information about setting the MAC

addresses).

In cable-based failover, the serial failover cable is marked with one end as “Primary” and the other as

“Secondary.” The cable itself determines which unit is primary. In LAN-based failover, you must set the

primary and secondary identification in the configuration.

Configuration Replication

The two PIX Firewall units share the same configuration. The configuration can be the same because it

includes both the active IP

addresses and the standby IP addresses. When a unit is active, it uses the

active IP addresses; when a unit is standby, it uses the standby IP addresses.

Note Because the configuration is the same on both units, the host names, usernames, and passwords are also

the same.

For LAN-based failover, the configuration on the two units differs slightly, because you must set up the

Ethernet link in advance. You must also define each unit as a primary or secondary unit within the

configuration (as opposed to cable-based failover, where the serial failover cable itself defines these

roles).

The active unit sends the configuration in running memory to the standby unit. On the standby unit, the

configuration exists only in running memory. You can optionally save the configuration to Flash memory

using the write memory command. If you save the configuration to Flash memory, and you reboot the

standby unit when the active unit is unavailable, the standby unit can become the active unit because it

has a valid configuration.

Note If you enter the write memory command on the active unit, the command is replicated to the standby

unit, which proceeds to write its configuration to Flash memory.

1 2 ... 355 356 357 358 359 360 361 362 363 364 365 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 360