topic Re: Failover Communication in Network Security https://community.cisco.com/t5/network-security/failover-communication/m-p/759159#M1005271 <HTML><HEAD></HEAD><BODY><P>There should be NO ACL. Don't use a crossover ethernet cable or fiber to connect the two failover LAN interfaces. Instead, each interface should connect to a switch port so that the link status is always up to one firewall interface if the other firewall interface fails. Otherwise, both units sense a link-down condition and assume that their interfaces have a failover.</P><P></P><P>Yes, a crossover will work; but it isnt a best practice.</P><P></P><P>Please rate if you are satisfied.</P><P></P><P>Cheers!</P></BODY></HTML> Sun, 13 May 2007 01:38:43 GMT joshua.walton 2007-05-13T01:38:43Z Failover Communication https://community.cisco.com/t5/network-security/failover-communication/m-p/759158#M1005265 <P>Hi,</P><P></P><P>I am reviewing the PIX config of my client who is configuring deny ip any any ACL on the failover interface between the 2 failover units!! </P><P></P><P>I was confused of this configuration and just would like to check if this will deny the stateful information flow b/ the 2 firewalls?</P><P></P><P>Please advise!</P><P></P><P>Regards,</P><P>Haitham</P> Mon, 11 Mar 2019 10:09:27 GMT https://community.cisco.com/t5/network-security/failover-communication/m-p/759158#M1005265 haithamnofal 2019-03-11T10:09:27Z Re: Failover Communication https://community.cisco.com/t5/network-security/failover-communication/m-p/759159#M1005271 <HTML><HEAD></HEAD><BODY><P>There should be NO ACL. Don't use a crossover ethernet cable or fiber to connect the two failover LAN interfaces. Instead, each interface should connect to a switch port so that the link status is always up to one firewall interface if the other firewall interface fails. Otherwise, both units sense a link-down condition and assume that their interfaces have a failover.</P><P></P><P>Yes, a crossover will work; but it isnt a best practice.</P><P></P><P>Please rate if you are satisfied.</P><P></P><P>Cheers!</P></BODY></HTML> Sun, 13 May 2007 01:38:43 GMT https://community.cisco.com/t5/network-security/failover-communication/m-p/759159#M1005271 joshua.walton 2007-05-13T01:38:43Z Re: Failover Communication https://community.cisco.com/t5/network-security/failover-communication/m-p/759160#M1005285 <HTML><HEAD></HEAD><BODY><P>Even if there is a ACL that has a deny any any on that failover link interfaces then the failover communication still works.</P><P></P><P>But personaly I prefer to remove it !</P><P></P><P>sincerely</P><P>Patrick</P></BODY></HTML> Sun, 13 May 2007 02:37:03 GMT https://community.cisco.com/t5/network-security/failover-communication/m-p/759160#M1005285 Patrick Iseli 2007-05-13T02:37:03Z