LAN Based failover on the PIX

[fpulice]

LAN-based failover was introduced in v6.2. I'm looking to try it, just wondering if anybody tried it. I'm really worried about its stability.

[s.jankowski]

So far I have not faced any problems. Just a few pointers that you may already know like, Do not use a crossover cable in conjunction with lan-based failover. For more pointers read through the below URL

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a00800eb72f.html#1008963

[fpulice]

Thanks for the reply. Here's a followup question, is it critical to synchronize the time between the two PIXs? Do you think it would help to use an NTP server for stability?

[gfullage]

It's not critical to sync the time on the PIX, this doesn't have anything to do with failover per se. It's probably a good idea to use NTP just for your logging, etc, at least then you know your logs are always correct.

I've configured LAN failover fora number of customers and haven't had any problems. If you're using stateful, then make sure that your stateful link is at least as fast as the fastest interface on the PIX (that goes for any failover though).