Configuring Firewall Failover

To configure failover on a pair of Cisco firewalls, you can use the configuration steps listed in this section. Before failover is configured and enabled, you need to enter the configuration commands on each firewall. After failover is enabled, all configuration commands should be entered only on the active firewall. This is because the active unit replicates the configuration commands to the standby unit automatically. The only exception is any command related to failover itself.

For active-active failover, all failover configuration commands must be entered on the system execution space of the firewall that is currently active for failover group 1. This is because the failover for the system space is always handled by failover group 1. The failover IP addresses and interface monitoring must be configured in the individual security contexts.

1. Identify the primary and secondary firewall units.

Failover communication depends on each firewall having a distinct role. The primary unit must have an "Unrestricted" license, and the secondary unit can have an "Unrestricted," "Failover Only," or "Active-Active Failover Only" license.

If both units have an "Unrestricted" license, the roles can be chosen arbitrarily.

You need to assign the primary and secondary roles in one of two ways:

- By connecting labeled ends of a failover cable (see Step 2)

- By configuring the roles in LAN-based failover (see Step 3 a)

2. (Optional) Connect the firewalls with the serial failover cable.

By default, the serial failover cable is expected to connect two PIX firewalls before failover can be used. If you intend to use this method of failover communication, connect the cable connector labeled "Primary" to the nine-pin failover connector on the primary unit. Then connect the "Secondary" end to the secondary unit.

From this point on, the two units communicate failover "hello," configuration changes, and stateful update messages over the serial cable.

To bring up failover mode, you must use either the serial failover cable described here or LAN-based failover, configured in the next step.

3. (Optional) Connect the firewalls over a LAN for LAN-based failover.

A LAN connection can be used to carry failover communication much more efficiently than the serial failover cable. It can also be used if the two firewalls must be geographically separated.

You should use a Fast Ethernet or Gigabit Ethernet connection that is dedicated to failover traffic. The connection between firewalls should be on an isolated virtual LAN (VLAN), configured for full duplex and fast convergence so that the connection is highly available.

Do not use a crossover Ethernet cable or a fiber-optic patch cable to directly connect the two failover LAN interfaces if the firewalls are located close to each other. Instead, each interface should connect to a switch port so that the link status is always up to one firewall interface if the other firewall interface fails. Otherwise, both units sense a link-down condition and assume that their own interfaces have a failure.

You should also prepare the switch ports where the LAN-based failover interfaces connect so that failover communication can begin almost immediately. You should enable Spanning Tree Protocol PortFast and disable trunking and EtherChannel negotiation. You can use the following IOS Software commands to configure the switch ports:

Switch# configure terminal Switch(config)# interface type mod/num ! Enable PortFast for immediate traffic forwarding Switch(config-if)# spanning-tree portfast ! Disable trunking by making it an access switch port Switch(config-if)# switchport mode access ! Disable EtherChannel negotiation Switch(config-if)# no channel-group

Configuration Steps 3a through 3e should be used to configure the primary unit. Be sure to use the failover lan unit primary command described in Step 3a.

Then, connect to the secondary unit and repeat the same commands to configure LAN-based failover on it. The commands should be identical, except for the failover lan unit secondary command described in Step 3a. Otherwise, do not try to exchange the IP addresses between primary and secondary units in the other commands. The failover pair sorts out the IP addresses according to their roles.

a. Identify the primary and secondary units:

Related Posts

• Detecting a Firewall Failure
• How Failover Works - Firewall Config
• Configuring Active Standby Failover on the Cisco ASA
• Configuring Firewall Policies
• Debugging Failover Activity
• Csm Fwlb Configuration - Firewall Config
• Free Hosting for Your Website
• Entrepreneurship Guides
• Study Material For Cisco Students
• Project Management Templates
• Profitable Online Blogging

Readers' Questions

• MACKENZIE

  What administrative activities can help balance firewall failover?

  4 months ago

  • Reply

1. Automate firewall change management processes to ensure that configurations are properly archived and tested.
2. Monitor logs to identify threats and ensure that firewall rules are up to date.
3. Implement a network access control (NAC) system to ensure that only authorized users can access the network.
4. Build redundancy into the system by configuring multiple firewalls.
5. Perform regular penetration tests to identify vulnerabilities and patch them quickly.
6. Implement policies to control the flow of traffic between different segments of the network.
7. Implement IDS/IPS solutions to detect attempts to bypass the firewall and prevent any malicious activity from entering the network.
8. Establish backup power solutions to ensure continuous availability of the network in the event of a power outage.

Continue reading here: Asa Iwe

Was this article helpful?

0 0