Failover Configuration with Failover Cable

Use the clear xlate command after changing the interface command.

Use the ip address command to assign IP addresses to each interface. The following output shows examples of the commands so far.

Use the failover command statement to enable the failover feature. The no failover command will disable the failover feature.

The related failover active command on the standby unit triggers a failover switch, causing that unit to become the active unit. The no failover active command from the active unit triggers a failover switch to make the standby unit become the active unit. This command is used to force an active unit offline for maintenance and to return a updated unit to service.

Pix# clock set 14:27:0 jun 1 2004
Pix# config t
Pix(config)# nameif ethernet2 intf2 sec50
Pix(config)# ip address outside 10.1.1.1 255.255.255.0
Pix(config)# ip address inside 192.168.1.1 255.255.255.0
Pix(config)# ip address intf2 192.168.2.1 255.255.255.252
Pix(config)# interface e0 100full
Pix(config)# interface e1 100full
Pix(config)# interface e2 100full
Pix(config)# mtu intf2 1500
Pix(config)# clear xlate
Pix(config)# failover

Use the show ip address command to see the addresses. The Current IP Addresses is the same as the System IP Addresses on the failover active unit.

Pix(config)# show ip address
System IP Addresses:
     ip address outside 10.1.1.1 255.255.255.0
     ip address inside 192.168.1.1 255.255.255.0
     ip address intf2 192.168.2.1 255.255.255.252
Current IP Addresses:
     ip address outside 10.1.1.1 255.255.255.0
     ip address inside 192.168.1.1 255.255.255.0
     ip address intf2 192.168.2.1 255.255.255.252

Use the failover IP address int_name ip_addr command to define the standby unit’s interface addresses. The IP addresses for the standby unit are different from the active unit’s addresses, but in the same subnet for each interface. The standby unit needn’t be powered up for this command to work correctly.

Without setting, the failover IP addresses failover won’t work, the show failover command will display 0.0.0.0 for the IP address, and monitoring of the interfaces will remain in the “waiting” state.

Pix(config)# failover ip address inside 192.168.1.2
Pix(config)# failover ip address outside 10.1.1.2
Pix(config)# failover ip address intf2 192.168.2.2

Pix(config)# show failover
Failover On
Cable status: Other side powered off
Reconnect timeout 0:00:00
Poll frequency 15 seconds
        This host: primary - Active
                Active time: 740 (sec)
                Interface intf2 (192.168.2.1): Normal (Waiting)
                Interface outside (10.1.1.1): Normal (Waiting)
                Interface inside (192.168.1.1): Normal (Waiting)
    Other host: secondary - Standby
                Active time: 0 (sec)
                Interface intf2 (192.168.2.2): Unknown (Waiting)
                Interface outside (10.1.1.2): Unknown (Waiting)
                Interface inside (192.168.1.2): Unknown (Waiting)

13. If necessary, use the failover poll seconds command to set a hello interval shorter than 15 seconds (range 3 to 15).

Power up the secondary unit. The primary unit will detect it and start synchronizing the configurations. The messages “Sync Started” and “Sync Completed” will appear.

If any other changes are made to the active unit configuration, use the write memory command to save the configuration and to synchronize the standby unit.