Still trying to understand how PIX replication works

spfister336 · ‎10-27-2008

I've got a pair of PIX 525s on active/standby. Recently, the primary one failed over

to the secondary unit. I'm trying to understand what kind of state

they're now in,

especially the primary. The secondary unit now has the ip addresses

from the primary unit

and is handling traffic like you would expect. The primary unit seems

to know what addresses

it and the secondary are supposed to have now ("show fail"), But, if

you do 'show

interface', the interfaces all still show up with the original

addresses (which are now being

used by the secondary). I've connect to the console of both and both

configs seem to be

the same (all recent changes are on the primary, too). The primary PIX

isn't reachable

from the network any longer. I have tried reloading the primary PIX, but nothing has changed.

- is this normal behavior for failover?

- if I try and make the primary active again, will this fix things?

Thanks!

Mo'ath Al Rawashdeh · ‎10-27-2008

Hi,

When you configure an ip address on a firewall interface, you use the command below:

IP address x.x.x.1 mask.mask.mask.mask standby x.x.x.2

So, the firewall that is always active takes the x.x.x.1. While the standby firewall always takes the x.x.x.2.

"- is this normal behavior for failover?"

yes thats normal.

"- if I try and make the primary active again, will this fix things?"

Do a "show failover" command, and from the output, if the primary is in "standby ready" state, then yes, use the command "no failover active" command which will make the secondary firewall give away the active role back to the primary.

Else, if the primary is in "failed" state, then you will lose the connection to the internet.

(While logged on to the current active firewall, you should see the line below in the output of the "show failover" if the primary firewall is ready to take the active role again)

Other host: Primary - Standby Ready

Cheers