topic PIX Failover - IP reachability in Network Security

PIX Failover - IP reachability

swapnendum — Mon, 11 Mar 2019 10:34:21 GMT

In a typical Active/standby failover scenario, is it complulsory to have an IP reachability between a pair of interfaces ? For e.g DMZ interface on Primary is 192.168.55.1/24 and on secondary is 192.168.55.2/24. Can failover work normally if there is no connectivity between 192.168.55.1 and 192.168.55.1 ?

All the 4 tests i.e.

1. Link Up/Down test

2. Network Activity test

3. ARP test

4. Broadcast Ping test

can be passed without reachablity between the interface pairs.

Can somebody explain this and correct me on this?

Re: PIX Failover - IP reachability

gaetan.allart — Mon, 25 Jun 2007 09:44:48 GMT

No it cannot work.

Each of your failover cluster member sends "probes" to his mate on each monitored interface.

If it cannot join the other one, it becomes active then.

Regards,

Gaetan

Re: PIX Failover - IP reachability

Fernando_Meza — Mon, 25 Jun 2007 10:55:07 GMT

Hi .. if the status of the interface (either from layer 1 to layer 3) is not OK, then the failver is triggered. If you are tying not to monitor one interface then you can do that by adding the no monitor-interface if_name command from global config mode. Failover will work as normal but will not check the status of the interface where you entered the mentioned command. by the way the command is on code 7.0 and above

I hope it help .. please rate it if it does !!!