LAN Base versus Crossover cable statefull Failover

[aessome]

could any one tel me the better configuration method for failover ?

Thanks

AFE

[scoclayton]

Hi,

I am not 100% sure exactly what you are asking because LAN based failover and staeful failover are not comparable ways to do failover. Failover can either be LAN based (using an ethernet cable on a dedicated interface) or you can use the serial failover cable. If this is what you are asking, then the preferred method is still to use the serial cable. The reason for this is because there is a lead in the serial cable that is solely dedicated to detecting power loss on the other side. As a result, failover detection due to power loss on the other side occurs faster. If the two PIX's are physically more than 6 feet apart, then you will be limited to using LAN based failover. This solution works well outside of detecting a power loss on the mate quickly.

Stateful failover can be used (although, it is not required) with both methods. Stateful failover is the method we use to share state between the two PIX's so if a failover occurs, the stand-by PIX is able to seemlessly continue the current conns from the primary.

Hope this helps.

Scott

[aessome]

Hello Scott,

Thanks for yopur replay. At the moment i have a statefull failover with a dedicated serial cable and an crossover cable connected to both PIXs. My problem is: sometimes ( min. One time a week) the Pix is making an unnecessary failover and the losing of VPN Connections are not nice for the customer because 4000 Remote users must setup a new connection to the PIX. what cann be causing this Probl ?

design:

ISP ISP

| |

Router1 Router2

| |

| |

Switch1 Switch2

| |

| |

PIX1----Ethe Crossover cable -----PIX2

----Serial Failover cable-----

| |

| |

Switch1 Switch2

| |

LAN LAN

[scoclayton]

OK, so we are actually trying to determine why a failover is occuring. Best course of action to get started in this case is to setup a syslog server (if you don't already have one) and see what the logs say when the failover occurs. Once you get this info, let us know and we can help you narrow in on the problem. Too many possibilities to speculate at this point.

Scott

[pavlosd]

To be honest, I am quite confused with the way you put it. I suppose you mean, have dedicated interface for failover or use a "traffic" interface for LAN failover. The best is of course to have a dedicated interface. Reason is the performance is affected by the traffic. A lan failover is a shared interface with LAN. moreover new PIX ios configurations offer advanced failover options that sometimes require Gigabit ethernet. I am using the interface dedicated failover and I am quite happy with it.