Configuring Unit Health Monitoring; Configuring Failover Communication Authentication/Encryption - Cisco PIX 500 Series Configuration Manual

Chapter 14 Configuring Failover

Configuring Unit Health Monitoring

The security appliance sends hello packets over the failover interface to monitor unit health. If the
standby unit does not receive a hello packet from the active unit for two consecutive polling periods, it
sends additional testing packets through the remaining device interfaces. If a hello packet or a response
to the interface test packets is not received within the specified hold time, the standby unit becomes
active.
You can configure the frequency of hello messages when monitoring unit health. Decreasing the poll
time allows a unit failure to be detected more quickly, but consumes more system resources.
To change the unit poll time, enter the following command in global configuration mode:
hostname(config)# failover polltime [msec] time [holdtime [msec] time ]
You can configure the polling frequency from 1 to 15 seconds or, if the optional msec keyword is used,
from 200 to 999 milliseconds. The hold time determines how long it takes from the time a hello packet
is missed to when failover occurs. The hold time must be at least 3 times the poll time. You can configure
the hold time from 1 to 45 seconds or, if the optional msec keyword is used, from 800 to 990
milliseconds.
Setting the security appliance to use the minimum poll and hold times allows it to detect and respond to
unit failures in under a second, but it also increases system resource usage and can cause false failure
detection in cases where the networks are congested or where the security appliance is running near full
capacity.

Configuring Failover Communication Authentication/Encryption

You can encrypt and authenticate the communication between failover peers by specifying a shared
secret or hexadecimal key.
On the PIX 500 series security appliance, if you are using the dedicated serial failover cable to connect
Note
the units, then communication over the failover link is not encrypted even if a failover key is configured.
The failover key only encrypts LAN-based failover communication.
Caution All information sent over the failover and Stateful Failover links is sent in clear text unless you secure
the communication with a failover key. If the security appliance is used to terminate VPN tunnels, this
information includes any usernames, passwords and preshared keys used for establishing the tunnels.
Transmitting this sensitive data in clear text could pose a significant security risk. We recommend
securing the failover communication with a failover key if you are using the security appliance to
terminate VPN tunnels.
Enter the following command on the active unit of an Active/Standby failover pair or on the unit that has
failover group 1 in the active state of an Active/Active failover pair:
hostname(config)# failover key { secret | hex key }
The secret argument specifies a shared secret that is used to generate the encryption key. It can be from
1 to 63 characters. The characters can be any combination of numbers, letters, or punctuation. The hex
key argument specifies a hexadecimal encryption key. The key must be 32 hexadecimal characters (0-9,
a-f).
OL-12172-03
Cisco Security Appliance Command Line Configuration Guide
Configuring Failover
14-39