topic Re: Statefull failover Not working-PIX 525 in Network Security

Statefull failover Not working-PIX 525

azharmd — Fri, 21 Feb 2020 07:08:55 GMT

Hey can be some help me out

I have two PIX 525 and i implemented Statefull Failover between them -- its not working .. but when i enabled LAN based Failover it works fine ....

PIX- 6.2(2) version

thnx

Re: Statefull failover Not working-PIX 525

scoclayton — Wed, 10 Dec 2003 22:29:44 GMT

Hi,

I would be happy to help but I am going to need quite a bit more information to get started. First of all, Lan based failover and stateful failover are not related. Lan based failover is another option you can use if your PIX's are too far apart for the Serial failover cable. Stateful failover can be run or not run in conjunction with both lan based failover and serial based failover. What are you doing to determine that stateful failover is not working?

Scott

Re: Statefull failover Not working-PIX 525

azharmd — Sun, 14 Dec 2003 15:13:36 GMT

My basic idea is to achieve the Statefull failover , since it was not working i configured the LAN based failover(which is working) I would like to know

1.Does Statefull failover works same as LAN based i mean connections will remain as it is during the failover......

post ur email address so i can drop u the complete configuration

Re: Statefull failover Not working-PIX 525

scoclayton — Mon, 15 Dec 2003 18:52:09 GMT

Hi,

Let me try this again. Stateful failover and Lan based failover do not really have anything to do with one another. Lan based failover is another way of accomplishing failover between two PIX's if the distance between the two PIX's is greater than 6 feet (the length of a standard Cisco serial failover cable). Stateful failover is a method used in addition to one of the failover implementations above. It is used to pass "state" information from the active PIX to the stand-by PIX so that currently established connections are not dropped if a failover occurs. In serial based failover setups, you need to dedicate a seperate ethernet interface on both PIX's for the stateful failover communications. In a Lan Based failover setup, you can use the same interface and cable between the two PIX's for both purposes BUT, this is not recommended. The stateful link can be heavily utilized and you do not want this traffic to starve your normal failover communications between the two PIX's and cause an unnecessary failover. Does this help you undertand a little?

Scott