| 13.1 |  | Understanding Failover |
| 13.1.2 |  | IP addresses for failover |

| When actively functioning, the primary firewall uses system IP addresses and media access control (MAC) addresses. When on standby, the secondary PIX Security Appliance uses a set of failover IP addresses and MAC addresses. When the primary PIX Security Appliance fails and the secondary PIX becomes active, the secondary PIX assumes the system IP addresses and MAC addresses of the primary PIX. The primary PIX Security Appliance, functioning in standby, then assumes the failover IP addresses and MAC addresses of the secondary PIX.

The PIX Security Appliance can be configured to use a virtual MAC address instead of assuming the MAC address of its failover peer. This enables the PIX Security Appliance failover pair to maintain the correct MAC addresses after failover. If a virtual MAC address is not specified, the PIX Security Appliance failover pair uses the burned in network interface card (NIC) address as the MAC address.