Cisco 500 Series, Configuration Manual

Page: 248 / 1140

14-28
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 14 Configuring Failover
Configuring Failover
Cable-based failover is only available on the PIX 500 series security appliance.
To configure cable-based, Active/Active failover, perform the following steps:
Step 1 Connect the failover cable to the PIX 500 series security appliances. Make sure that you attach the end
of the cable marked “Primary” to the unit you use as the primary unit, and that you attach the end of the
cable marked “Secondary” to the unit you use as the secondary unit.
Step 2
Power on the primary unit.
Step 3 If you have not done so already, configure the active and standby IP addresses for each data interface
(routed mode), for the management IP address (transparent mode), or for the management-only
interface. The standby IP address is used on the security appliance that is currently the standby unit. It
must be in the same subnet as the active IP address.
You must configure the interface addresses from within each context. Use the changeto context
command to switch between contexts. The command prompt changes to
hostname/ context (config-if)#
, where context is the name of the current context. You must enter a
management IP address for each context in transparent firewall multiple context mode.
Note
Do not configure an IP address for the Stateful Failover link if you are going to use a dedicated
Stateful Failover interface. You use the
failover interface ip command to configure a dedicated
Stateful Failover interface in a later step.
hostname/context(config-if)# ip address active_addr netmask standby standby_addr
In routed firewall mode and for the management-only interface, this command is entered in interface
configuration mode for each interface. In transparent firewall mode, the command is entered in global
configuration mode.
Step 4 (Optional) To enable Stateful Failover, configure the Stateful Failover link.
a.
Specify the interface to be used as Stateful Failover link:
hostname(config)# failover link if_name phy_if
The if_name argument assigns a logical name to the interface specified by the phy_if argument. The
phy_if argument can be the physical port name, such as Ethernet1, or a previously created
subinterface, such as Ethernet0/2.3. This interface should not be used for any other purpose (except,
optionally, the failover link).
b.
Assign an active and standby IP address to the Stateful Failover link:
hostname(config)# failover interface ip if_name ip_addr mask standby ip_addr
The standby IP address must be in the same subnet as the active IP address. You do not need to
identify the standby IP address subnet mask.
The Stateful Failover link IP address and MAC address do not change at failover except for when
Stateful Failover uses a regular data interface. The active IP address always stays with the primary
unit, while the standby IP address stays with the secondary unit.
c. Enable the interface:
hostname(config)# interface phy_if
hostname(config-if)# no shutdown
Step 5
Configure the failover groups. You can have at most two failover groups. The failover group command
creates the specified failover group if it does not exist and enters the failover group configuration mode.