Cisco 500 Series, Configuration Manual

Page: 255 / 1140

14-35
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 14 Configuring Failover
Configuring Failover
To change the default failover criteria for the specified failover group, enter the following commands:
hostname(config)# failover group { 1 | 2 }
hostname(config-fover-group)#
interface-policy
num [
%
]
When specifying a specific number of interfaces, the num argument can be from 1 to 250. When
specifying a percentage of interfaces, the num argument can be from 1 to 100.
Configuring Virtual MAC Addresses
Active/Active failover uses virtual MAC addresses on all interfaces. If you do not specify the virtual
MAC addresses, then they are computed as follows:
•
Active unit default MAC address: 00a0.c9 physical_port_number . failover_group_id 01.
•
Standby unit default MAC address: 00a0.c9 physical_port_number . failover_group_id 02.
Note If you have more than one Active/Active failover pair on the same network, it is possible to have the
same default virtual MAC addresses assigned to the interfaces on one pair as are assigned to the
interfaces of the other pairs because of the way the default virtual MAC addresses are determined. To
avoid having duplicate MAC addresses on your network, make sure you assign each physical interface
a virtual active and standby MAC address for all failover groups.
You can configure specific active and standby MAC addresses for an interface by entering the following
commands:
hostname(config)# failover group { 1 | 2 }
hostname(config-fover-group)# mac address phy_if active_mac standby_mac
The phy_if argument is the physical name of the interface, such as Ethernet1. The active_mac and
standby_mac arguments are MAC addresses in H.H.H format, where H is a 16-bit hexadecimal digit. For
example, the MAC address 00-0C-F1-42-4C-DE would be entered as 000C.F142.4CDE.
The active_mac address is associated with the active IP address for the interface, and the standby_mac
is associated with the standby IP address for the interface.
There are multiple ways to configure virtual MAC addresses on the security appliance. When more than
one method has been used to configure virtual MAC addresses, the security appliance uses the following
order of preference to determine which virtual MAC address is assigned to an interface:
1. The mac-address command (in interface configuration mode) address.
2.
The failover mac address command address.
3. The mac-address auto command generate address.
4.
The automatically generated failover MAC address.
Use the show interface command to display the MAC address used by an interface.
Configuring Support for Asymmetrically Routed Packets
When running in Active/Active failover, a unit may receive a return packet for a connection that
originated through its peer unit. Because the security appliance that receives the packet does not have
any connection information for the packet, the packet is dropped. This most commonly occurs when the
two security appliances in an Active/Active failover pair are connected to different service providers and
the outbound connection does not use a NAT address.