Hi

Failover lets you connect a second PIX Firewall unit to your network to protect your network should the first unit go off line. If you use Stateful Failover, you can maintain operating state for the TCP connection during the failover from the primary unit to the standby unit.

When failover occurs, each unit changes state. The unit that activates assumes the IP and MAC addresses of the previously active unit and begins accepting traffic. The new standby unit assumes the failover IP and MAC addresses of the unit that was previously the active unit. Because network devices see no change in these addresses, no ARP entries change or time out anywhere on the network.

Once you configure the primary unit and attach the necessary cabling, the primary unit automatically copies the configuration over to the standby unit.

The ACT indicator light on the front of the PIX 515, PIX 525, and PIX 535 is on when the unit is the active failover unit. If failover is not enabled, this light is on. If failover is present, the light is on when the unit is the active unit and off when the unit is the standby unit.

Failover works with all Ethernet interfaces. However, the Stateful Failover interface must be 100 Mbps or Gigabit Ethernet.

Cabling the two PIX Firewall units together requires a high-speed serial cable when using cable-based failover, or a dedicated Ethernet connection to a dedicate switch/hub (or VLAN) when using LAN-based failover. If you are using Stateful Failover, a separate dedicate full-duplex 100 Mbps or Gigabit Ethernet connection is required when running cable-based failover and is recommended when running LAN-based failover.

The failover feature causes the PIX Firewall to ARP for itself every 15 seconds (depending on the time set with the failover poll command). This ARPing can only be stopped by disabling failover.

HTH

Regards MJ