Continuous Failover

[bbrown23]

I have two pix 535 configured in failover but recently the primary unit began to failover constantly. When i power off the standby unit however, it no longer does this. Any ideas what would cause this behavior.

Any ideas is greatly appreciated.

[joshua.ferguson]

Can you see anything in the log or syslog (if you are send information to a syslog server), around the time the secondary fails that might be suspect? Also is this a LAN based failover or do you have the serial failover cable between the two???

[bbrown23]

Thank you.

Unfortunately i can't find any clues in the syslog. i'm using a serial cable between the two devices. i'm tempted to power up the standby unit and try to replicate the event and see if i get any clues but since i'm in a semi-production enviroment, i'm a little hesitant to do this.

Desperate for ideas

[shannong]

Are the firewalls on the same switch?

WHat does [show fail] say?

High load and low memory can cause this. The pix may lose hellos and stateful information during both conditions that can cause failovers to occur.

Are you logging a lot of messages? I believe that failover shares the same memory blocks with syslog, and an enormous number of messages can cause this. Especially if a lot of traffic is getting denied by scans, DoS, etc.

What does the cpu utilization look like when it happens? You can track cpu, free mem, memory blocks, interface usage, connections, and xlates via snmp.