Cisco PIX 525 Especificaciones descargar pdf (Pagina 141)

11-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 11 Configuring Failover

Understanding Failover

Active/Active Failover

This section describes Active/Active failover. This section includes the following topics:

• Active/Active Failover Overview, page 11-9

• Primary/Secondary Status and Active/Standby Status, page 11-9

• Device Initialization and Configuration Synchronization, page 11-10

• Command Replication, page 11-10

• Failover Triggers, page 11-11

• Failover Actions, page 11-11

Active/Active Failover Overview

Active/Active failover is only available to security appliances in multiple context mode. In an

Active/Active failover configuration, both security appliances can pass network traffic.

In Active/Active failover, you divide the security contexts on the security appliance into failover groups.

A failover group is simply a logical group of one or more security contexts. You can create a maximum

of two failover groups on the security appliance. The admin context is always a member of failover

group 1, and any unassigned security contexts are also members of failover group 1 by default.

The failover group forms the base unit for failover in Active/Active failover. Interface failure monitoring,

failover, and active/standby status are all attributes of a failover group, rather than the unit. When an

active failover group fails, it changes to the standby state while the standby failover group becomes

active. The interfaces in the failover group that becomes active assume the MAC and IP addresses of the

interfaces in the failover group that failed. The interfaces in the failover group that is now in the standby

state take over the standby MAC and IP addresses.

Note A failover group failing on a unit does not mean that the unit has failed. The unit may still have another

failover group passing traffic on it.

When creating the failover groups, you should create them on the unit that will have failover group 1 in

the active state.

Note Active/Active failover generates virtual MAC addresses for the interfaces in each failover group. If you

have more than one Active/Active failover pair on the same network, it is possible to have the same

default virtual MAC addresses assigned to the interfaces on one pair as are assigned to the interfaces of

the other pairs because of the way the default virtual MAC addresses are determined. To avoid having

duplicate MAC addresses on your network, make sure you assign each physical interface a virtual active

and standby MAC address.

Primary/Secondary Status and Active/Standby Status

As in Active/Standby failover, one unit in an Active/Active failover pair is designated the primary unit,

and the other unit the secondary unit. Unlike Active/Standby failover, this designation does not indicate

which unit becomes active when both units start simultaneously. Instead, the primary/secondary

designation determines which unit provides the running configuration to the pair and on which unit each

failover group appears in the active state when both start simultaneously.

1 2 ... 136 137 138 139 140 141 142 143 144 145 146 ... 603 604

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 141