High Availability configuration with PIX

[jeff_green]

Hi,

I've been asked to for a HA firewall solution for a prpject. I'm considering a pair of 535s in a LAN failover config (statefull failover) - I don't have any problem with that. However I need both PIXs to be redundantly connected to the internal LAN (thru 2 seperate ethernet cards & switches). That means either

a) I need the 2 i/f to have the same security level

and use OSPF

b) Some clever Layer2 i/f pairing (which I dont think

PIX supports)

Has anybody tried this +/or can offer hints ?

Many Thanks,

[andy-cole]

This sounds like standard LAN based failover, just connect each inside interface into a seperate switch.

The PIX spoofs the IP and MAC address, so there are no ARP issues when it fails over.

Or do you mean you want both firewalls to be active at the same time, which is not a failover application.

Andy

[jeff_green]

Hi Andy,

Thanks for the reply !

Yes, my inclination is to go for option a) 2 inside

i/f with the same security level connected to 2

seperate switches (4500s) and use OSPF routing on

each PIX. The 4500s are interconnected via 2 ISLs

for redundancy purposes.

The PIXs will be running in statefull failover mode

with their own VLAN as per Cisco recommendations.

I was thinking of some sort of etherchannel arrangement but the PIXs don't support that.

Many Thanks,