topic pix failover transition time in Network Security

pix failover transition time

ponparthi — Fri, 21 Feb 2020 08:01:16 GMT

Hi all

I have configured my pix 525 for failover.

But when i power off my primary (active) unit the ping response initiated to a internet host from one of my vlan gets dropped for a minitue and i start getting the response only after a minute from the internet.

Is this transition period for failover the normal behaviour or it should come fast.

As per cisco website i have read that standby unit should come up in 30 to 45 seconds

The output of the sh failover is pasted below.

Any help appreciated

Regards

Parthiban

sh failover

Failover On

Cable status: Normal

Reconnect timeout 0:00:00

Poll frequency 3 seconds

failover replication http

Last Failover at: xx:xx:xx xxx Thu Mar 10 2005

This host: Primary - Active

Active time: 598662 (sec)

Interface outside (x.x.x.x): Normal

Interface inside (10.1.253.1): Normal

Interface stateful-failover (10.1.252.1): Normal

Interface intf3 (0.0.0.0): Link Down (Shutdown)

Interface REMOTEZONE (10.1.7.254): Normal

Interface DMZ (10.1.14.254): Normal

Interface BACKBONEZONE (10.1.6.30): Normal

Interface INTF4 (0.0.0.0): Link Down (Shutdown)

Other host: Secondary - Standby

Active time: 0 (sec)

Other host: Secondary - Standby

Active time: 0 (sec)

Interface outside (x.x.x.x): Normal

Interface inside (10.1.253.2): Normal

Interface stateful-failover (10.1.252.2): Normal

Interface intf3 (0.0.0.0): Link Down (Shutdown)

Interface REMOTEZONE (10.1.7.253): Normal

Interface DMZ (10.1.14.253): Normal

Interface BACKBONEZONE (10.1.6.29): Normal

Interface INTF4 (10.1.6.28): Link Down (Shutdown)

Re: pix failover transition time

sachinraja — Thu, 17 Mar 2005 11:15:12 GMT

Hi,

have the failover poll interval to the minimum.. i think 3 secs is the min value.. another thing to make sure is to have the switch ports connected to the PIX firewall interfaces, to have port fast enabled...

Portfast should be enabled on all the ports whre the PIX interface directly connects, and trunking, channeling should be disabled.. this way, if the PIX's interface goes down during failover, the switch does not have to wait for 30 secs while the port is transitioned from listening state to a forwarding state....

try this and let us know....

Raj

Re: pix failover transition time

ponparthi — Fri, 18 Mar 2005 06:22:08 GMT

Hi Raj

Thanks for your response. I have enabled the post fast already for all the ports directly connected to pix. but trunking is also off, I have given switchport mode access in all the ports. what do u mean by channeling on these ports.

Further my client is worried about the transition time of the secondary firewall only when primary (active) goes down.

So when i power down my primary active could you please tell me how fast the secondary will become active.

Regards

Parthiban