PIX Firewall version 6.2 introduces support for LAN-based
failover, eliminating the need for the Failover serial cable to connect the
primary and secondary units. LAN-based failover overcomes the six-foot distance
limitations of the Failover cable.
A dedicated LAN interface and a dedicated switch/hub (or VLAN) is
required to implement LAN-based failover. An Ethernet crossover cable can’t be
used to connect the two PIX Firewalls.
Because failover messages might be transmitted over Ethernet
connections that are relatively less secure than the dedicated Failover serial
cable, PIX Firewall version 6.2 provides message encryption and authentication
using a manual preshared key.
The four command mode failover
lan commands include the following syntax. Each uses the no form of the
command to remove the feature.
Pix(config)# failover lan unit {primary | secondary}
Pix(config)# failover lan interface if_name Pix(config)# failover lan key key_secret
Pix(config)# failover
lan enable
The basic configuration of the active firewall doesn’t change and
won’t be restated here. The LAN-based failover does require some configuration
on the standby unit and those commands are addressed here. If properly
configured, the LAN-based failover configurations for the two units will be
different, reflecting which is primary and which is secondary. To configure
LAN-based failover, follow these steps:
-
Don’t connect the failover LAN interfaces until told to do
so.
-
Configure the primary PIX Firewall unit as previously
discussed.
-
Still on the primary unit, connect the LAN failover
interface to the network and add the following lines to configure the LAN-based
failover. Lanlink is the interface (Ethernet4) used for
the failover connection, while 1234567 is the key used for
encrypting traffic over the LAN failover link.
Pix(config)# no failover
Pix(config)# failover lan unit primary
Pix(config)# failover lan interface lanlink
Pix(config)# failover lan key 1234567
Pix(config)# failover lan enable
Pix(config)# failover
-
Use the write memory command to save the
primary unit configuration to Flash.
-
Power on the secondary unit without the LAN-based failover
interface connected. The following commands are necessary for the secondary unit
to connect to the primary unit using the LAN-based failover interface. Once this
connection is established, the rest of the primary unit configuration is
replicated over the failover connection.
Pix2(config)# nameif ethernet4 lanlink security20
Pix2(config)# interface ethernet4 100full
Pix2(config)# ip address lanlink 192.168.3.1 255.255.255.0
Pix2(config)# failover ip address lanlink 192.168.3.2
Pix2(config)# failover lan unit secondary (optional)
Pix2(config)# failover lan interface lanlink
Pix2(config)# failover lan key 1234567
Pix2(config)# failover lan enable
Pix2(config)# failover
-
Use the write memory command to save the
secondary unit configuration to Flash.
-
Reboot both units and connect the LAN-based failover
interfaces to the designated failover switch, hub, or VLAN.
-
If any of the failover lan command needs
to be changed, you need to disconnect the LAN-based failover interface and
repeat the preceding steps.
Sections
Comments (0 posted)
Syndication
