PIX Failover - IP reachability

Unanswered Question
Jun 24th, 2007
User Badges:

In a typical Active/standby failover scenario, is it complulsory to have an IP reachability between a pair of interfaces ? For e.g DMZ interface on Primary is 192.168.55.1/24 and on secondary is 192.168.55.2/24. Can failover work normally if there is no connectivity between 192.168.55.1 and 192.168.55.1 ?


All the 4 tests i.e.

1. Link Up/Down test

2. Network Activity test

3. ARP test

4. Broadcast Ping test


can be passed without reachablity between the interface pairs.


Can somebody explain this and correct me on this?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
gaetan.allart Mon, 06/25/2007 - 02:44
User Badges:

No it cannot work.


Each of your failover cluster member sends "probes" to his mate on each monitored interface.


If it cannot join the other one, it becomes active then.


Regards,


Gaetan

Fernando_Meza Mon, 06/25/2007 - 03:55
User Badges:
  • Gold, 750 points or more

Hi .. if the status of the interface (either from layer 1 to layer 3) is not OK, then the failver is triggered. If you are tying not to monitor one interface then you can do that by adding the no monitor-interface if_name command from global config mode. Failover will work as normal but will not check the status of the interface where you entered the mentioned command. by the way the command is on code 7.0 and above


I hope it help .. please rate it if it does !!!



Actions

This Discussion