topic Re: PIX 515E Failover in Network Security

PIX 515E Failover

thebigc — Fri, 21 Feb 2020 07:06:11 GMT

Hi.

Having just read a doc regarding how failover is implemented on PIX 515Es - I noticed something that I'm hoping somebody out there will have a good answer for:

"It is recommended that you connect the Primary and Secondary PIXes with a dedicated switch. Do not use crossover cables."

This is talking about the LAN failover link and the Stateful failover link. What I want to know is why it is not recommended and what the issue is with using crossover cables? Surely putting in another switch to connect the units introduces a point of failure that isn't required?

FYI the doc I'm refering to is http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094ea7.shtml#before

Thanks,

Colin

Re: PIX 515E Failover

jlebaron — Thu, 13 Nov 2003 23:14:54 GMT

Sure, that switch could be another point of failure.

But think about this, the failover will occur when the lan failover interface loses carrier. If you are using a crossover cable, and one of your pix's goes to toast, what happens with the other pix's ethernet interface? If you are using a crossover cable, it will see the interface down as well.

Big problem...the stateful lan failover link needs to have a connection up..hence, the reason for the switch.

Maybe not the best explanation..but you get the idea ?

Re: PIX 515E Failover

thebigc — Fri, 14 Nov 2003 10:27:16 GMT

Makes perfect sense, thanks.

Colin