| 13.3 |  | LAN-Based Failover |
| 13.3.3 |  | Steps 5 – 10: preparing the secondary PIX Security Appliance |

| Now that students have learned how to prepare the primary PIX Security Appliance for LAN-based failover has been prepared, they will learn how to configure the secondary PIX Security Appliance for the same purpose LAN-based failover will be prepared. Steps 5 through Step 10 examine how to prepare the secondary PIX Security Appliance:

5. Power on the secondary PIX Security Appliance.
6. Complete the following sub-steps on the secondary PIX Security Appliance:
   - Specify the name and security level of the failover interface using the nameif command.
   - Enable the failover interface and set its connection speed using the interface command.
   - Specify the IP address of the failover interface using the ip address command.
   - Specify the failover IP address of the failover interface using the failover ip address command.
   - Designate this firewall as the secondary firewall using the optional failover lan unit command.
   - Specify the name of the failover interface using the failover lan interface command.
   - Enter the secret key shared with the primary firewall using the failover lan key command.
   - Enable LAN-based failover using the failover lan enable command.
   - Enable failover using the failover command.

Notice that all the failover lan commands, except the failover lan unit command, are entered on the secondary PIX Security Appliance exactly as they are entered on the primary. For a more detailed explanation of the process, please see the Demonstration Activity associated with this section.

Figure illustrates that on both firewalls, Ethernet 3 is designated as the failover interface and is configured with the following parameters:

- Name - MYFAILOVER
- Security level - 55
- Speed and duplex - 100full
- IP address - 172.17.0.1
- Netmask - 255.255.255.0
- Failover IP address - 172.17.0.7
- Failover LAN key - 1234567

7. Use the write memory command to save the configuration to Flash memory.
8. Connect the failover interface of the secondary firewall to the network .
9. Use the reload command to reboot the secondary PIX Security Appliance.
10. Finally, use the show failover command to verify that both the primary and secondary PIX Security Appliances have been configured correctly for failover.

The Command Reference provides more information about the show failover command and its syntax, as well as sample outputs from the command.

| Media Activity Demonstration Activity: Configuring the Secondary PIX Security Appliance to Support LAN-Based Failover In this activity, students will learn about configuring the secondary PIX Security Appliance to support LAN-based failover.

| Lab Activity Lab Exercise: Configure LAN-Based Failover (OPTIONAL) In this lab exercise, the student will complete the following tasks:

- Configure the primary PIX Security Appliance for LAN-based stateful failover to the secondary PIX Security Appliance.
- Configure the secondary PIX Security Appliance for LAN-based failover.
- Test LAN-based stateful failover.
- Make the primary PIX Security Appliance active.