PIX Failover question

[kope]

I got the following message when the primary PIX fail over to the secondary. My question is just how do I fail back to the primary PIX as an active unit?

# sh failover

Failover On

Cable status: Normal

Reconnect timeout 0:00:00

Poll frequency 15 seconds

Last Failover at: 09:53:43 cst Sun Mar 19 2006

This host: Primary - Standby

Active time: 8750355 (sec)

Interface outside (18.18.46.5): Normal

Interface inside (18.18.46.130): Normal

Interface dmz (18.18.45.2): Normal

Interface failover (10.10.10.3): Normal

Other host: Secondary - Active

Active time: 181080 (sec)

Interface outside (18.18.46.4): Normal

Interface inside (18.18.46.129): Normal

Interface dmz (18.18.45.1): Normal

Interface failover (10.10.10.1): Normal

Thanks.

[gfullage]

To fail back to the primary unit you can either do:

failover active

on the primary, or do:

no failover active

on the secondary. Keep in mind that because a failover pair are always the same hardware, there theoretically is no advantage to running on the primary unit, and so if the units do fail over to the secondary for some reason, they will NOT fail back automatically. If for whatever reason you prefer running on the primary unit, then you have to manually fail them back using either of the above two commands.

[sebastan_bach]

hi glen how are u . sebastan remember. good to see u in the forum adn helping us out. hey glen i have a serious doubt regarding the interface testing procedure in the pix failover process. if possible kind help me out . in the topic "stateful failover with cross-over cable between pix firewalls".if possible.pls help me out.waiting for ur reply. see ya and bye

sebastan

[kope]

Thank you so much for your reply.

In fact, since it failover to the secondary unit for some reason, I am fine with just running on the secondary unit as an active unit. However, I got the following message when I try to configure something on the secondary unit. Is there a way to fix this without using the "failover" command you have suggested?

________________________________________

PRSPIX1# conf t

**** WARNING ***

Configuration Replication is NOT performed from Standby unit to Active unit.

Configurations are no longer synchronized.

[thamdani]

Hi,

Pix will not replicate the config from standby to active unit,so make sure when ever you make any config changes it has to be on the Active unit.

Simply Check which Pix is Active then make the config changes on that.

Tanveer

[mloring]

And check to see why the actice PIX failed in the first place. You don't want to leave behind a lingering problem....