| 13.1 |  | Understanding Failover |
| 13.1.5 |  | Failover interface tests |

| In order for the failover process to be effective, it is important that both PIX Security Appliances be able to communicate with one another. This section will look at how the communication process works. Initially, the primary and secondary PIX Security Appliances send special failover hello packets to each other over all network interfaces and the failover cable to make sure that everything is working. This occurs every fifteen seconds. When a failure occurs in the active PIX Security Appliance, and it is not the result of a loss of power in the standby PIX Security Appliance, it triggers a series of tests to determine which PIX Security Appliance has failed. The purpose of these tests is to generate network traffic to determine which, or if either, PIX Security Appliance has failed.

At the start of each test, each firewall clears its received packet count for its interfaces. At the conclusion of each test, each PIX Security Appliance looks to see if it has received any traffic. If it has, the interface is considered operational. If one PIX Security Appliance receives traffic for a test and the other PIX Security Appliance does not, the PIX Security Appliance that did not receive traffic is considered failed. If neither PIX Security Appliance has received traffic, the tests continue.

The following are the four different tests used to test for failover:

1. LinkUp/Down is a test of the NIC itself. If an interface card is not plugged in to an operational network, it is considered failed. For example, if the hub or switch has failed, has a failed port, or a cable is unplugged, it would result in the firewall being labeled as failed. If this test does not find anything, the network activity test begins.
2. Network Activity is a received network activity test. The PIX Security Appliance counts all received packets for up to five seconds. If any packets are received at any time during this interval, the interface is considered operational and testing stops. If no traffic is received, the Address Resolution Protocol (ARP) test begins.
3. The ARP test consists of reading the PIX Security Appliance ARP cache for the ten most recently acquired entries. The PIX Security Appliance sends ARP requests one at a time to these machines, attempting to stimulate network traffic. After each request, the PIX Firewall counts all received traffic for up to five seconds. If traffic is received, the interface is considered operational. If no traffic is received, an ARP request is sent to the next machine. If at the end of the list no traffic has been received, the ping test begins.
4. The ping test consists of sending out a broadcast ping request. The PIX Security Appliance then counts all received packets for up to five seconds. If any packets are received at any time during this interval, the interface is considered operational and testing stops. If no traffic is received, the testing begins again with the ARP test.