Cisco PIX 525 Especificaciones descargar pdf (Pagina 143)

11-11

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 11 Configuring Failover

Understanding Failover

You can use the write standby command to resynchronize configurations that have become out of sync.

For Active/Active failover, the write standby command behaves as follows:

• If you enter the write standby command in the system execution space, the system configuration

and the configurations for all of the security contexts on the security appliance is written to the peer

unit. This includes configuration information for security contexts that are in the standby state. You

must enter the command in the system execution space on the unit that has failover group 1 in the

active state.

• If you enter the write standby command in a security context, only the configuration for the security

context is written to the peer unit. You must enter the command in the security context on the unit

where the security context appears in the active state.

Replicated commands are not saved to the Flash memory when replicated to the peer unit. They are

added to the running configuration. To save replicated commands to Flash memory on both units, use

the write memory or copy running-config startup-config command on the unit that you made the

changes on. The command will be replicated to the peer unit and cause the configuration to be saved to

Flash memory on the peer unit.

Failover Triggers

In Active/Active failover, failover can be triggered at the unit level if one of the following events occurs:

• The unit has a hardware failure.

• The unit has a power failure.

• The unit has a software failure.

• The no failover active or the failover active command is entered in the system execution space.

Failover is triggered at the failover group level when one of the following events occurs:

• Too many monitored interfaces in the group fail.

• The no failover active group group_id command is entered.

You configure the failover threshold for each failover group by specifying the number or percentage of

interfaces within the failover group that must fail before the group fails. Because a failover group can

contain multiple contexts, and each context can contain multiple interfaces, it is possible for all

interfaces in a single context to fail without causing the associated failover group to fail.

See the “Failover Health Monitoring” section on page 11-14 for more information about interface and

unit monitoring.

Failover Actions

In an Active/Active failover configuration, failover occurs on a failover group basis, not a system basis.

For example, if you designate both failover groups as active on the primary unit, and failover group 1

fails, then failover group 2 remains active on the primary unit while failover group 1 becomes active on

the secondary unit.

Note When configuring Active/Active failover, make sure that the combined traffic for both units is within the

capacity of each unit.

1 2 ... 138 139 140 141 142 143 144 145 146 147 148 ... 603 604

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 143