Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 361)

10-7

Cisco PIX Firewall and VPN

78-15033-01

Chapter 10 Using PIX Firewall Failover

Understanding Failover

Configuration replication from the active unit to the standby unit occurs in the following ways:

• When the standby unit completes its initial startup, it clears its running configuration using the clear

configure all command (except for the LAN-based failover commands that are not replicated), and

the active unit sends its entire configuration to the standby unit.

• As commands are entered on the active unit, they are sent across the failover link to the standby unit.

You do not have to save the active configuration to Flash memory to replicate the commands.

• If you enter the write standby command on the active unit, the standby unit clears its running

configuration using the clear configure all command (except for the LAN-based failover commands

that are not replicated), and the active unit sends its entire configuration to the standby unit.

Note Changes made on the standby unit are not replicated to the active unit.

When you use a serial failover cable, the replication can take a long time to complete with a large

configuration.

When the replication starts, the PIX Firewall console displays the message “Sync Started,” and when

complete, displays the message “Sync Completed.” During the replication, information cannot be

entered on the PIX

Firewall console.

Failover Triggers

If the active unit fails, the standby unit takes over. The following situations cause a failover to occur if

they affect the active unit, but not the standby unit:

• Network failure

• PIX Firewall hardware failure

• Power loss or reload

For power loss or reload using cable-based failover, the standby unit learns almost immediately if the

active unit loses power or is reset. The other conditions listed previously are sensed when a given

interface does not receive hello packets for two consecutive poll intervals. The poll interval is user

configurable. The interface is then tested to determine which unit is at fault.

Initially, the PIX Firewall runs the Link Up/Down test, which is a test of the Ethernet card. If an interface

card is not plugged into an operational network, it is also considered to be failed (for example, the

upstream switch failed, has a failed port, or a cable is unplugged).

If the Link Up/Down test indicates that the Ethernet card is operational, then the firewall performs

network tests. The purpose of these tests is to generate network traffic to determine which (if either) unit

has failed. At the start of each test, each unit clears its received packet count for its interfaces. At the

conclusion of each test, each unit looks to see if it has received any traffic. If it has, the interface is

considered operational. If one unit receives traffic for a test and the other unit does not, the unit that

received no traffic is considered failed. If neither unit has received traffic, then the next test is used.

The PIX Firewall performs the following network tests:

1. Network Activity test—A received network activity test. The unit counts all received packets for up

to 5 seconds. If any packets are received at any time during this interval, the interface is considered

operational and testing stops. If no traffic is received, the ARP test begins.

2. ARP test—Reading the unit’s ARP cache for the 10 most recently acquired entries. One at a time,

the unit sends ARP requests to these machines attempting to stimulate network traffic. After each

request, the unit counts all received traffic for up to 5

seconds. If traffic is received, the interface is

considered operational. If no traffic is received, an ARP request is sent to the next machine. If at the

end of the list no traffic has been received, the ping test begins.

1 2 ... 356 357 358 359 360 361 362 363 364 365 366 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 361

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525