Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Users might experience few discrepancies in Search results. We are working on this on our side. We apologize for the inconvenience it may have caused.
New Member

Cisco Pix Active/standby Failover Problem

Hello there,

Good Day,

I recently installed 2 Cisco Pix 525 in Active/Standby failover mechanism. Both appliances are connected via serial cable to exchange a "Hello" messages to each other. I applied the configuration successfully and everthing worked so fine for 6 months. The "inside" failover interfaces are connected to 3Com 4060 Switch.

Suddenly, i noticed that both appliances were active and the internet connectivity hanged and when i tried to ping the inside interfaces , it gave me request timed out. I checked the failover history but it gave me no accurate reason for this problem. I did restart the primary (active) failover and then everything came back to life and i can ping as well as accessing the internet.

I read about specific vulnerabilities regarding Cisco PIX failover and i knew that there are Dos attacks targeting the failover process whether by ARP spoofing since the secondary (standby) unit sends ARP requests to the primary for testing purposes before failover happens.

But i really want to push away the propability of the Dos attacks since the inside failover interfaces are in different VLAN in the 3Com switch away from other users VLANs. In addition, i did a port security on the inside failover interfaces by adding their MAC addresses manualy in the switch's CAM table. I also increased the failover timer to 75 seconds to give the standby unit the chance to not failover so soon.

This is the configuration:

Pixfirewall#configure terminal

Pixfirewall(Config)#interface ethernet0

Pixfirewall(Config-if)#description Outside public network

Pixfirewall(Config-if)#speed 100

Pixfirewall(Config-if)#duplex full

Pixfirewall(Config-if)#nameif outside

Pixfirewall(Config-if)#security-level 0

Pixfirewall(Config-if)# ip address x.x.x.x 255.255.255.0 standby x.x.x.x

Pixfirewall(Config-if)#exit

Pixfirewall(Config)#interface ethernet1

Pixfirewall(Config-if)# description Inside private network

Pixfirewall(Config-if)#speed 100

Pixfirewall(Config-if)#duplex full

Pixfirewall(Config-if)#nameif inside

Pixfirewall(Config-if)#security-level 100

Pixfirewall(Config-if)# ip address x.x.x.x 255.0.0.0 standby x.x.x.x

Pixfirewall(Config-if)#exit

Pixfirewall(Config)#interface ethernet2

Pixfirewall(Config-if)# description Statful failover connection

Pixfirewall(Config-if)#speed 100

Pixfirewall(Config-if)#duplex full

Pixfirewall(Config-if)#failover interface ip stateful 11.x.x.1 255.255.0.0 standby 11.x.0.2

Pixfirewall(Config-if)#exit

Pixfirewall(config)#failover link stateful ethernet2

Pixfirewall(config)#failover replication http

Pixfirewall(config)#failover polltime unit msec 500 holdtime 5

Pixfirewall(config)#failover

Pixfirewall(config)#exit

Pixfirewall#write mem

Please i want to know what are the reasons that makes the active/standby failover hangs and i want your advice if my configuration is missing something.

Thanks in advance

Kind Regards,

Turbo

3 REPLIES

Re: Cisco Pix Active/standby Failover Problem

Hi,

Can you post the config and "sh failover" output? Any log pertaining to the failure or failover process to start active on the standby unit?

BTW, sharing an interface for both stateful and failover link is only meant for LAN-based failover, but not recommended. But failover serial cable is not required.

http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_chapter09186a008045247e.html#wp1051759

Rgds,

AK

Silver

Re: Cisco Pix Active/standby Failover Problem

Turbo,

You better be careful with this:

"i did a port security on the inside failover interfaces by adding their MAC addresses manualy in the switch's CAM table"

here's why:

<http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/config/failover.htm>

"When failover occurs, each unit changes state. The unit that activates assumes the IP and MAC addresses of the previously active unit and begins accepting traffic. The new standby unit assumes the failover IP and MAC addresses of the unit that was previously the active unit. Because network devices see no change in these addresses, no ARP entries change or time out anywhere on the network."

hth,

Ajaz Nawaz

New Member

Re: Cisco Pix Active/standby Failover Problem

Hello Ajaz,

Good Day,

Thank you guys for the fast response regarding my problem and i'd like to inform you that i solved the problem. Yes, i did disable the port security since it was the first part of the problem. The second important part was that the standby (secondary) unit didn't take over of the active role when the primary failed. In other words, when the active (primary) failed, the standby (secondary) unit was still in standby so when you ping the active unit addresses it gave me request timed out and no internet access. The cause of the problem was from the interface policy. I noticed that the previous security engineer did a "failover interface-policy 3" command that hanged everything. I really read about this command but i didn't understand it well. It something like you apply a policy for how many failed interfaces that standby will test before taking the active role but i think it took so long to test those interfaces so i disabled this command :)

Thanks in advance.

Regards,

Turbo

444
Views
0
Helpful
3
Replies
CreatePlease to create content