PIX Failover

[k.sato]

Hello,

I have 2 PIX running PIX Version 5.3(1).

One is Active and the other is standby.

In this case, if I changed the configuratio of Active PIX, do I need to change the config of the standby too?

Or standby PIX automatically speak to active one, and

update its config ?

Also, when I change the configuration, do I better disconnect cables between active and standby's?

please give me ideas.

[joneschw1]

When you make a code update on the primary, it replicates to the secondary. This happens fairly quickly, but not immediately. You can do a write standby to sync them.

Let me know if this answers your question. By the way, you may want to take the code version up. It has a lot of enhancements and fixes.

[k.sato]

Thank you for helpful information.

What happen if I put command to active one, then to standby one eather ?

[joneschw1]

You only need to type that command on the active one. Cisco reccomends that you should not issue commands on your standby machine.

If you have a failover to your standby, the old standby machine becomes the "Active" machine, and the old active becomes the standby. Thus, you are still issuing that command on the "Active" PIX.

By the way, here is an excellent document from Cisco on the failover process in general. I think it will clear up a lot of your questions. Please rank this post if it was helpful to you, etc.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a008017278a.html#97616

[cdacnoida]

Dear,

You don't need to touch the standby PIX. When you put the standby PIX for the first time, the active PIX would sync with the standby and would automaticall erase all the configuration on the standby PIX. It will duplicate it's conf on the standby.

whenever you make anychanges in the active, it would get replicated on the standby automatically in future as well, so you don't have to worry about anything at all.