Installing Lan-Based Failover - Cisco PIX 501 Hardware Installation Manual

Installing LAN-Based Failover

Caution Do not turn the power on until the units are connected and the primary unit is configured completely.
Step 7 Use the power switch at the back of the units to power the primary unit on and then power the standby
unit on.
Within a few seconds, the active unit automatically downloads its configuration to the standby unit.
If the primary unit fails, the secondary unit automatically becomes active.
Installing LAN-Based Failover
LAN-based failover supports failover between two units connected over a dedicated Ethernet interface.
LAN-based failover eliminates the need for a special failover cable and overcomes the distance
limitations imposed by the failover cable.
For information on configuring a LAN-based failover, refer to the
Configuration Guide.
Note Both PIX Firewall units must be the same model number, have the same amount of RAM, Flash memory,
number and type of interfaces, and be running the same software version.
Complete these steps to set up a LAN-based failover connection:
Disconnect both the PIX Firewall units, so that there is no traffic flow between them. If the Failover cable
Step 1
is connected to the PIX Firewall, disconnect it.
Step 2 Configure the PIX Firewall units. For information on configuring the PIX Firewall, refer to "
the LAN-Based
and VPN Configuration Guide.
Step 3 Power off both the units.
Step 4 Connect the LAN failover interfaces to the dedicated switch/hub, as shown in
Note
Cisco PIX Firewall Hardware Installation Guide
5-8
Failover," section in Chapter 10 "Using PIX Firewall Failover" in the Cisco PIX Firewall
A dedicated LAN interface and a dedicated switch (or VLAN) is required to implement
LAN-based failover. You cannot use a crossover Ethernet cable to connect the two PIX
Firewalls.
Chapter 5
Cisco PIX Firewall and VPN
Configuring
Figure 5-10.
78-15170-01
PIX 520