topic PIX failover mechanism in Network Security

PIX failover mechanism

leejoansin — Fri, 21 Feb 2020 07:40:04 GMT

I am deploying a pair of PIX directly connecting to a pair of firewalls managed by a 3rd party. My firewall pair is to provide for the necessary redundancy in case of failure in the master PIX. The connections between PIX and 3rd party's firewalls were point-to-point, i.e. master PIX to master firewall and standby PIX to standby firewall (See Scenario 1). However I was told that connecting in this way will cause failover mechanism to fail. To make the failover works I have to connect as per in Scenario 2.

Qn:

1. Is it true that I need to connect in scenario 2?

2. Just wondering how the PIX failover mechanism works? Is it by keepalive messages sending across the external-facing interfaces?

Thank you!

Re: PIX failover mechanism

Endwigast — Wed, 06 Oct 2004 13:10:31 GMT

Hi hope this helps

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_installation_guide_chapter09186a00800eb0c4.html

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094ea7.shtml

🙂

Re: PIX failover mechanism

a.awan — Wed, 06 Oct 2004 17:19:41 GMT

Scenario two is the correct way. The reason being that the PIX firewalls in a failover configuration send failover hello packets on all interfaces and if an interface does not detect two consecutive hello packets in a specific time interval the interface enters testing mode.

Re: PIX failover mechanism

leejoansin — Wed, 06 Oct 2004 23:46:45 GMT

Thank you! It helps a lot! 🙂