fir3net
PPS-Firenetbanner-780.5x190-30-03-17

Configuring HA Failover on a PIX Firewall

Below shows you how to configure stateful LAN based failover.

Primary

(config)#interface eth0
(config-if)#nameif inside
(config-if)#ip add 10.1.1.10 255.255.255.0 standby 10.1.1.20

(config)#interface eth1
(config-if)#no nameif
(config-if)#no shut

(config)#interface eth2
(config-if)#no nameif
(config-if)#no shut

(config)#failover
(config)#failover lan unit primary
(config)#failover lan interface failover eth1
(config)#failover lan enable
(config)#failover key <key>
(config)#failover link state eth2
(config)#failover interface ip failover 172.16.50.10 255.255.255.0 standby 172.16.50.20
(config)#failover interface ip state 172.16.51.10 255.255.255.0 standby 172.16.51.20

Secondary

(config)#failover
(config)#failover lan unit secondary
(config)#failover lan interface failover eth2
(config)#failover lan enable
(config)#failover key <key>
(config)#failover interface ip failover 172.16.50.10 255.255.255.0 standby 172.16.50.20

Useful Commands

sh failover state
sh failover interface
sh monitor-interface
monitor-interface
no failover active
failover active

Further information can be found here

About the Author

RDonato

R Donato

Rick Donato is the Founder and Chief Editor of Fir3net.com. He currently works as a Principal Network Security Engineer and has a keen interest in automation and the cloud.

You can find Rick on Twitter @f3lix001