Configuring and Enabling Failover
Failover agreement is aboveboard and does not crave abounding commands.
In this section, we analysis a case study, configuring accepted failover footfall by step.
At anniversary footfall of the configuration, we use appearance commands to analysis the status.
The arrangement cartography is apparent in Figure 8.1. In this example, PIX1 is the
primary firewall, and PIX2 is the accessory firewall.There are two interfaces in
use, ethernet0 (outside) and ethernet1 (inside).
Before we start, we bung in the failover cable, actuality accurate to affix the primary
end into the primary firewall and the accessory end into the accessory firewall.
Each interface on the primary firewall additionally needs to be affiliated to the
corresponding interface on the accessory firewall through either a about-face or a
crossover cable. In this example, we are application Layer 2 switches, and all the ports
on anniversary about-face are on the aforementioned VLAN.We additionally accomplish abiding that all the switches
are configured and powered on and that all Ethernet cables are acquainted in correctly.
We leave the accessory firewall powered off, and we about-face on the primary
firewall. Next, we configure the alarm on the primary firewall application the clock
command.
www.syngress.com
Figure 8.1 Accepted Failover Example
Internal Network
e0 e0
e1 e1
Failover consecutive cable
PIX1 PIX2
Internet
424 Chapter 8 • Configuring Failover
NOTE
Do not ability on the accessory firewall until the primary firewall is fully
configured.
Cisco recommends that back you use failover, no arrangement interface should
be set for autonegotiation. In added words, do not use the auto or 1000auto keywords
in your interface agreement commands. Anniversary interface complex in
failover should be hardcoded for acceleration and bifold settings application the 10baset,
100basetx, 100full, 1000basesx, or 1000sxfull keywords. Accomplish abiding that these settings
match the hub or about-face to which the interface is connected. In our
example, we are application all 100Mbps interfaces, so we will hardcode the interfaces
to 100Mbps full-duplex operation:
PIX1(config)# interface ethernet0 100full
PIX1(config)# interface ethernet1 100full
Of course, we additionally configured our switches for 100Mbps abounding duplex. Before
enabling failover, we charge aboriginal accredit IP addresses to anniversary interface on the primary
firewall:
PIX1(config)# ip abode central 192.168.1.1 255.255.255.0
PIX1(config)# ip abode alfresco 10.5.1.1 255.255.255.0
To verify the IP addresses, use the appearance ip abode command:
PIX1# appearance ip address
System IP addresses:
ip abode alfresco 10.5.1.1 255.255.255.0
ip abode central 192.168.1.1 255.255.255.0
Current IP addresses:
ip abode alfresco 10.5.1.1 255.255.255.0
ip abode central 192.168.1.1 255.255.255.0
At this point, the accepted IP addresses on the primary firewall should be the
same as the arrangement IP addresses.When failover occurs, the accepted IP addresses
will change to the failover IP addresses. Before we dive into the configuration,
let’s use the appearance failover command to analysis the accepted failover status:
PIX1# appearance failover
Failover Off
www.syngress.com
Configuring Failover • Chapter 8 425
Cable status: Added ancillary powered off
Reconnect abeyance 0:00:00
Poll abundance 15 seconds
As apparent in the aboriginal band in the command output, failover is currently not
enabled.The additional band in the command achievement shows us that the added end
of the failover cable is affiliated accurately and that the accessory firewall is
powered off.
To accredit failover, we use the failover command on the primary firewall:
PIX1(config)# failover
Now we can use the appearance failover command on the primary firewall to verify
that failover is enabled and that it is acting as the alive firewall (see Figure 8.2).
Figure 8.2 Achievement of the appearance failover Command After Enabling Failover
PIX1# appearance failover
Failover On
Cable status: Added ancillary powered off
Reconnect abeyance 0:00:00
Poll abundance 15 seconds
This host: primary - Active
Active time: 60 (sec)
Interface alfresco (10.5.1.1): Normal (Waiting)
Interface central (192.168.1.1): Normal (Waiting)
Other host: accessory - Standby
Active time: 0 (sec)
Interface alfresco (0.0.0.0): Unknown (Waiting)
Interface central (0.0.0.0): Unknown (Waiting)
As apparent in the command achievement here, the fifth band reads, “This host: primary
– Active,” which agency that you are on the primary firewall and it is active
for failover. Next, we configure the failover IP addresses application the failover ip
address command.This needs to be done for anniversary interface. Normally, in an
unfailed state, these IP addresses will be assigned to their agnate interfaces
of the standby unit. Accomplish abiding that failover IP addresses are in the aforementioned subnet as
the alive IP addresses:
www.syngress.com
426 Chapter 8 • Configuring Failover
PIX1(config)# failover ip abode central 192.168.1.2
PIX1(config)# failover ip abode alfresco 10.5.1.2
We can use the appearance failover command on the primary firewall afresh to verify
the cachet of the failover IP addresses (see Figure 8.3). As you can see from the
output of the command, beneath “Other host,” the accessory firewall now has IP
addresses for anniversary interface.
Figure 8.3 Achievement of the appearance failover Command After Configuring Failover
IP Addresses
PIX1# appearance failover
Failover On
Cable status: Added ancillary powered off
Reconnect abeyance 0:00:00
Poll abundance 15 seconds
This host: primary - Active
Active time: 300 (sec)
Interface accompaniment (172.16.1.1): Normal (Waiting)
Interface alfresco (10.5.1.1): Normal (Waiting)
Other host: accessory - Standby
Active time: 0 (sec)
Interface accompaniment (172.16.1.2): Unknown (Waiting)
Interface alfresco (10.5.1.2): Unknown (Waiting)
At this point, failover agreement is complete.Yes, it was that simple! We
now charge to ability on the accessory firewall. After the accessory firewall boots
up, the primary will ascertain it and will alpha to accord the configurations.You
will see the afterward bulletin on the console:
Sync Started
Once the synchronization is complete, you will see:
Sync Completed
We can use the appearance failover command on the primary firewall to verify the
status (see Figure 8.4).
www.syngress.com
Configuring Failover • Chapter 8 427
Figure 8.4 Achievement of the appearance failover Command After Completing the
Configuration
PIX1# appearance failover
Failover On
Cable status: Normal
Reconnect abeyance 0:00:00
Poll abundance 15 seconds
This host: primary - Active
Active time: 350 (sec)
Interface accompaniment (172.16.1.1): Normal
Interface alfresco (10.5.1.1): Normal
Other host: accessory - Standby
Active time: 0 (sec)
Interface accompaniment (172.16.1.2): Normal
Interface alfresco (10.5.1.2): Normal
As apparent in the command output, the Unknown cachet has afflicted to Normal.
The cable cachet additionally displays as Normal, acceptation that failover is operating normally.
This is the achievement that you usually appetite to see on your primary firewall.
Now let’s accredit the stateful failover affection on these firewalls. First, we must
set up a committed arrangement articulation amid the two firewalls that will be acclimated for
exchanging accompaniment information. As apparent in Figure 8.5, we accept called ethernet2
on anniversary firewall for this action and accept affiliated a about-face amid the interface
on both firewalls. (We could additionally accept acclimated a crossover cable instead of using
a switch.)
We charge to configure the interface settings for ethernet2, accord it a name (we
picked the name state), and accredit arrangement and failover IP addresses:
PIX1(config)# nameif ethernet2 accompaniment security25
PIX1(config)# interface ethernet2 100full
PIX1(config)# ip abode accompaniment 172.16.1.1 255.255.255.0
PIX1(config)# failover ip abode accompaniment 172.16.1.2
PIX2(config)# nameif ethernet2 accompaniment security25
PIX2(config)# interface ethernet2 100full
www.syngress.com
428 Chapter 8 • Configuring Failover
After the interface is configured, there is alone a distinct command to access to
make this the stateful failover interface:
PIX1(config)# failover articulation state
NOTE
The stateful failover interface (ethernet2 in our example) charge accept its
MTU set to 1500 bytes or larger.
You can verify stateful failover operation application the appearance failover command (see
Figure 8.6).
Figure 8.6 Achievement of the appearance failover Command After Enabling Stateful
Failover
PIX1# appearance failover
Failover On
Cable status: Normal
www.syngress.com
Figure 8.5 Accepted Stateful Failover Example
Internal Network
e0 e0
e1 e1
e2 e2
Failover consecutive cable
PIX1 PIX2
Internet
Continued
Configuring Failover • Chapter 8 429
Reconnect abeyance 0:00:00
Poll abundance 3 seconds
This host: Primary - Active
Active time: 400 (sec)
Interface accompaniment (172.16.1.1): Normal
Interface alfresco (10.5.1.1): Normal
Interface central (192.168.1.1): Normal
Other host: Accessory - Standby
Active time: 0 (sec)
Interface accompaniment (172.16.1.2): Normal
Interface alfresco (10.5.1.2): Normal
Interface central (192.168.1.2): Normal
Stateful Failover Logical Update Statistics
Link : intf3
Stateful Obj xmit xerr rcv rerr
General 3 0 3 0
sys cmd 3 0 3 0
up time 0 0 0 0
xlate 0 0 0 0
tcp conn 0 0 0 0
udp conn 0 0 0 0
ARP tbl 0 0 0 0
RIP Tbl 0 0 0 0
Logical Update Queue Information
Cur Max Total
Recv Q: 0 1 3
Xmit Q: 0 1 3
As you can see, there are some added curve of output.These added curve show
stateful failover statistics in abundant detail.