| 13.3 |  | LAN-Based Failover |
| 13.3.1 |  | LAN-based failover overview |

| In the previous section, students learned how to configure a PIX Security Appliance to support failover via using a failover serial cable. This section will now explain how to configure the second method of PIX Security Appliance failover, LAN-based failover.

LAN-based failover overcomes the distance limitations imposed by the six-foot length of the failover cable. With LAN-based failover, an Ethernet cable can be used to replicate configuration from the primary PIX Security Appliance to the secondary PIX Security Appliance. The special failover cable is not required. Instead, LAN-based failover requires a dedicated LAN interface and a dedicated switch, hub, or VLAN. A crossover Ethernet cable cannot be used to connect the two PIX Security Appliances.

The same LAN interface used for LAN-based failover can also be used for stateful failover. However, the interface needs enough capacity to handle both the LAN-based failover and stateful failover traffic. If the interface does not have the necessary capacity, two separate, dedicated interfaces can be used.

LAN-based failover allows traffic to be transmitted over Ethernet connections that are relatively less secure than the special failover cable. To secure failover transmissions, LAN-based failover provides message encryption and authentication using a manual pre-shared key.

The following steps are a summary of how LAN-based failover is configured on the PIX Security Appliance. Each of these steps will be explained in greater detail in the following pages:

1. Verify that any switch port that connects to a PIX Security Appliance interface is configured to support LAN-based failover.
2. Attach a network cable between the primary and secondary firewalls for each network interface, except the interface to be used for LAN-based failover. If the failover cable is connected to the PIX Security Appliance, disconnect it.
3. Configure the necessary parameters on the primary PIX Security Appliance and connect the necessary interfaces to the network.
4. Save the primary firewall configuration to Flash memory.
5. Power on the secondary firewall.
6. Configure the necessary parameters on the secondary PIX Security Appliance.
7. Save the secondary firewall configuration to Flash memory.
8. Connect the LAN-based failover interface to the network.
9. Reboot the secondary firewall.