Cisco 500 Series, Configuration Manual

Page: 236 / 1140

14-16
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 14 Configuring Failover
Understanding Failover
•
UDP connection states.
• The ARP table.
•
The Layer 2 bridge table (when running in transparent firewall mode).
• The HTTP connection states (if HTTP replication is enabled).
•
The ISAKMP and IPSec SA table.
• GTP PDP connection database.
•
SIP signalling sessions
The information that is not passed to the standby unit when Stateful Failover is enabled includes the
following:
•
The HTTP connection table (unless HTTP replication is enabled).
• The user authentication (uauth) table.
•
The routing tables. After a failover occurs, some packets may be lost our routed out of the wrong
interface (the default route) while the dynamic routing protocols rediscover routes.
• State information for Security Service Modules.
•
DHCP server address leases.
The following WebVPN features are not supported with Stateful Failover:
•
Smart Tunnels
• Port Forwarding
•
Plugins
• Java Applets
•
IPv6 clientless or Anyconnect sessions
• Citrix authentication (Citrix users must reauthenticate after failover)
Note If failover occurs during an active Cisco IP SoftPhone session, the call remains active because the call
session state information is replicated to the standby unit. When the call is terminated, the IP SoftPhone
client loses connection with the Cisco CallManager. This occurs because there is no session information
for the CTIQBE hangup message on the standby unit. When the IP SoftPhone client does not receive a
response back from the Call Manager within a certain time period, it considers the CallManager
unreachable and unregisters itself.
For VPN failover, VPN end-users should not have to reauthenticate or reconnect the VPN session in the
event of a failover. However, applications operating over the VPN connection could lose packets during
the failover process and not recover from the packet loss.
Failover Health Monitoring
The security appliance monitors each unit for overall health and for interface health. See the following
sections for more information about how the security appliance performs tests to determine the state of
each unit:
• Unit Health Monitoring, page 14-17
•
Interface Monitoring, page 14-17