| 8.2 |  | The Cisco PIX Security Appliance |
| 8.2.5 |  | Failover |

| Failover provides a mechanism for PIX Security Appliance redundancy by allowing two identical firewalls to serve the same function. The active firewall performs normal security functions while the standby firewall monitors network events. The standby firewall is ready to take control should the active firewall fail.

Each firewall device must stay informed of the status of the other device, in order to know when to assume the load because the other unit has failed. PIX Security Appliances can use a serial cable for short-distance failover, or an Ethernet cable for long-distance or LAN-based failover. In both of these scenarios, the PIX Security Appliance can be configured for stateful failover. Stateful failover allows active connections to remain open when failover occurs. Stateful failover is invisible to the end-users on the network.

In order for a failover to succeed, the two firewalls must be identical in the following respects:

- Hardware model
- Interfaces
- Software version
- Activation key type
- Amount of Flash memory
- Amount of RAM

Assuming that this is the case, configuration replication, which is the transfer of the configuration from the active to the standby PIX, will occur under the following two circumstances:

1. When a secondary firewall completes its initial bootup, the primary firewall replicates its entire configuration to it.
2. When an administrator enters the write standby command on the primary firewall, it forces the entire configuration to the secondary firewall.

Because configuration replication is automatic from the active firewall to the standby firewall, configurations should be modified only on the active firewall.

When failover occurs, Syslog messages are generated indicating the cause of failure. Failover detection occurs within 30 to 45 seconds. Figure illustrates the failover topology.