Cisco PIX 525 Especificaciones descargar pdf (Pagina 138)

11-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 11 Configuring Failover

Understanding Failover

Active/Standby Failover Overview

Active/Standby failover lets you use a standby security appliance to take over the functionality of a failed

unit. When the active unit fails, it changes to the standby state while the standby unit changes to the

active state. The unit that becomes active assumes the IP addresses (or, for transparent firewall, the

management IP address) and MAC addresses of the failed unit and begins passing traffic. The unit that

is now in standby state takes over the standby IP addresses and MAC addresses. Because network

devices see no change in the MAC to IP address pairing, no ARP entries change or time out anywhere

on the network.

Note For multiple context mode, the security appliance can fail over the entire unit (including all contexts)

but cannot fail over individual contexts separately.

Primary/Secondary Status and Active/Standby Status

The main differences between the two units in a failover pair are related to which unit is active and which

unit is standby, namely which IP addresses to use and which unit actively passes traffic.

However, a few differences exist between the units based on which unit is primary (as specified in the

configuration) and which unit is secondary:

• The primary unit always becomes the active unit if both units start up at the same time (and are of

equal operational health).

• The primary unit MAC address is always coupled with the active IP addresses. The exception to this

rule occurs when the secondary unit is active, and cannot obtain the primary MAC address over the

failover link. In this case, the secondary MAC address is used.

Device Initialization and Configuration Synchronization

Configuration synchronization occurs when one or both devices in the failover pair boot. Configurations

are always synchronized from the active unit to the standby unit. When the standby unit completes its

initial startup, it clears its running configuration (except for the failover commands needed to

communicate with the active unit), and the active unit sends its entire configuration to the standby unit.

The active unit is determined by the following:

• If a unit boots and detects a peer already running as active, it becomes the standby unit.

• If a unit boots and does not detect a peer, it becomes the active unit.

• If both units boot simultaneously, then the primary unit becomes the active unit and the secondary

unit becomes the standby unit.

Note If the secondary unit boots without detecting the primary unit, it becomes the active unit. It uses its own

MAC addresses for the active IP addresses. However, when the primary unit becomes available, the

secondary unit changes the MAC addresses to those of the primary unit, which can cause an interruption

in your network traffic. To avoid this, configure the failover pair with virtual MAC addresses. See the

“Configuring Active/Standby Failover” section on page 11-15 for more information.

When the replication starts, the security appliance console on the active unit displays the message

“Beginning configuration replication: Sending to mate,” and when it is complete, the security appliance

displays the message “End Configuration Replication to mate.” During replication, commands entered

on the active unit may not replicate properly to the standby unit, and commands entered on the standby

1 2 ... 133 134 135 136 137 138 139 140 141 142 143 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 138

Comentarios a estos manuales