I have been reading about, and will try to set up, Firewall Stateful Interchassis Redundancy for my edge ASR-1002-X routers. I have found the Config guide for that feature here and one of the prereqs is "The active device and the standby device must have the same Cisco IOS XE Zone-Based Firewall configuration," which makes sense.
What I can't find is how to keep the ZBFW config "in sync" between the routers.
- I am assuming there is an automated way to do this, a la the ASA failover pair configuration sync process (a loose example, I grant), but I cannot find how to automate the sync. I am hoping this can be done for ONLY the ZBFW config, as the routers have different BGP configs, etc.
- If there is not, does anyone know what happens while one is making changes to the ZBFW config on one or the other routers? Does this break the state sync?
Thanks for any help.
Paul
