Active-Active

Sunday, 18 May 2008 13:25

Firewalls - Cisco - PIX

To enable active-active 2 security contexts on both PIXs will need to be created. One context being active and one stand by.

Create a stateful link

hostname(config)#failover link if_name phy_if
hostname(config)#failover interface ip if_name ip_addr mask standby ip_addr
hostname(config)#interface phy_if
hostname(config-if)#no shutdown

Create Groups

hostname(config)#failover group 1
hostname(config-fover-group)#primary
hostname(config-fover-group)#exit
hostname(config)#failover group 2
hostname(config-fover-group)#secondary
hostname(config-fover-group)#exit

The admin context is always a member of failover group 1

hostname(config)#context context_name
hostname(config-context)#join-failover-group {1 | 2}
hostname(config-context)#exit

Enable on Primary device first

hostname(config)#failover

For further details please see :

http://www.cisco.com