topic Re: PIX Failover question in Network Security

PIX Failover question

kope — Fri, 21 Feb 2020 08:47:25 GMT

I got the following message when the primary PIX fail over to the secondary. My question is just how do I fail back to the primary PIX as an active unit?

# sh failover

Failover On

Cable status: Normal

Reconnect timeout 0:00:00

Poll frequency 15 seconds

Last Failover at: 09:53:43 cst Sun Mar 19 2006

This host: Primary - Standby

Active time: 8750355 (sec)

Interface outside (18.18.46.5): Normal

Interface inside (18.18.46.130): Normal

Interface dmz (18.18.45.2): Normal

Interface failover (10.10.10.3): Normal

Other host: Secondary - Active

Active time: 181080 (sec)

Interface outside (18.18.46.4): Normal

Interface inside (18.18.46.129): Normal

Interface dmz (18.18.45.1): Normal

Interface failover (10.10.10.1): Normal

Thanks.

Re: PIX Failover question

gfullage — Tue, 21 Mar 2006 23:30:36 GMT

To fail back to the primary unit you can either do:

failover active

on the primary, or do:

no failover active

on the secondary. Keep in mind that because a failover pair are always the same hardware, there theoretically is no advantage to running on the primary unit, and so if the units do fail over to the secondary for some reason, they will NOT fail back automatically. If for whatever reason you prefer running on the primary unit, then you have to manually fail them back using either of the above two commands.

Re: PIX Failover question

sebastan_bach — Wed, 22 Mar 2006 01:45:55 GMT

hi glen how are u . sebastan remember. good to see u in the forum adn helping us out. hey glen i have a serious doubt regarding the interface testing procedure in the pix failover process. if possible kind help me out . in the topic "stateful failover with cross-over cable between pix firewalls".if possible.pls help me out.waiting for ur reply. see ya and bye

sebastan

Re: PIX Failover question

kope — Wed, 22 Mar 2006 02:11:41 GMT

Thank you so much for your reply.

In fact, since it failover to the secondary unit for some reason, I am fine with just running on the secondary unit as an active unit. However, I got the following message when I try to configure something on the secondary unit. Is there a way to fix this without using the "failover" command you have suggested?

________________________________________

PRSPIX1# conf t

**** WARNING ***

Configuration Replication is NOT performed from Standby unit to Active unit.

Configurations are no longer synchronized.

Re: PIX Failover question

thamdani — Wed, 22 Mar 2006 09:07:22 GMT

Hi,

Pix will not replicate the config from standby to active unit,so make sure when ever you make any config changes it has to be on the Active unit.

Simply Check which Pix is Active then make the config changes on that.

Tanveer

Re: PIX Failover question

mloring — Tue, 28 Mar 2006 16:35:43 GMT

And check to see why the actice PIX failed in the first place. You don't want to leave behind a lingering problem....