| 13.2 |  | Serial Cable Failover Configuration |
| 13.2.3 |  | Additional failover commands |

| This section will examine a number of miscellaneous commands that are useful when configuring a network to support PIX Security Appliance failover. For more information on the syntax of each of these commands, please see the Command Reference cited at the end of this section.

Stateful failover of HTTP connections
Earlier in this module, students learned that stateful failover allows for uninterrupted connections in the event of the failure of the primary PIX Security Appliance. With regard to hypertext transfer protocol (HTTP) connections however, an additional command is needed in order to ensure that failover is transparent to the end user. The failover replicate http command enables the stateful replication of HTTP sessions in a stateful failover environment. The no form of this command disables HTTP replication in a stateful failover configuration. When HTTP replication is enabled, the show failover command displays the failover replicate HTTP configuration.

Manually writing a configuration to the standby firewall
Section 13.1.3 stated that the there are three ways in which a primary firewall can transfer its configuration to the secondary firewall. The first two methods occur automatically, either when the standby firewall completes its initial bootup process, or when commands are entered on the active firewall.

However, it is also possible to write a configuration to the standby firewall manually. This is done using the write standby command. This command writes the configuration stored in RAM on the active failover firewall to the RAM on the standby firewall. When the secondary firewall boots, the primary firewall automatically writes the configuration to the secondary firewall. This command would be used if the administrator discovered that the configurations of the primary and secondary firewalls contained different information.

Resetting firewalls to a normal state
If one or both of the firewalls are in a failed state, it is possible to manually force the PIX Security Appliance from the failed to standby state with the failover reset command. If the transition triggers another failure, the unit will fail again.

It is important to note that a PIX Security Appliance in the failed state cannot switch into active state. The failover reset command can be entered from either firewall, but it is best to always enter commands at the active firewall.

Configuring a virtual MAC address
The failover mac address command enables the administrator to configure a virtual MAC address for a PIX Security Appliance failover pair. It can be removed with the no failover mac address command.

The failover mac address command sets the PIX Security Appliance to use the virtual MAC address stored in the PIX Security Appliance configuration after failover, instead of assuming the MAC address of its failover peer. This enables the PIX Security Appliance failover pair to maintain the correct MAC addresses after failover. If a virtual MAC address is not specified, the PIX Security Appliance failover pair uses the burned in NIC address as the MAC address.