Debugging Failover Activity
|
Table 8-1. debug Commands Relevant to Firewall Failover Operation |
|
|
Command |
Display Function |
|
debug fover cable |
Failover cable status |
|
debug fover {rx | tx} |
Failover messages parsed or sent (serial cable only) |
|
debug fover {rxip | txip} |
Failover hello messages received or sent on all interfaces |
|
debug fover fmsg |
Stateful failover memory activity |
|
debug fover {get | put} |
Stateful failover packets received from or sent to the other unit (not available in PIX 7.x) |
|
debug fover sync |
Configuration command replication |
|
debug fover switch |
Health monitoring activity |
|
debug fover ifc |
Interface health polling |
Commands using the debug keyword produce real-time output for troubleshooting purposes. To see these messages, you must first enable logging output to the firewall console (logging console), to a Telnet or SSH session (logging monitor), to a logging buffer (logging buffered), or to a Syslog server (logging host). The debug output also must be sent to the Syslog destination with the logging debug-trace configuration command. See Chapter 10, "Firewall Logging," for more information.
Monitoring Stateful Failover
As soon as stateful failover is enabled, you should make sure your stateful failover interface is not being overrun with stateful information packets. In other words, verify that the stateful interface bandwidth is sufficient for the load. Otherwise, information about some active connections will not be passed from the active to the standby firewall. If a failover occurs, these unknown connections are terminated.
In single-context mode, you can make a quick manual estimate by using the show traffic command. Unfortunately, this command shows only cumulative values collected since the traffic counters were last cleared. For the packets-per-second and bytes-per-second values, a running average is computed since the counters were last cleared.
However, you can issue the clear traffic command on the active firewall to clear the counters, wait 10 seconds, and issue the show traffic command. You should do this during a peak load time so that you see a snapshot of the busiest stateful information exchange. The following example shows how this is done:
Firewall# clear traffic [wait 10 seconds] Firewall# show traffic stateful:
received (in 9.050 secs):
3 packets 395 bytes
0 pkts/sec 43 bytes/sec transmitted (in 9.050 secs):
84 packets 98682 bytes
9 pkts/sec 10904 bytes/sec
[output deleted]
In multiple-context mode (active-active failover), things get a little more difficult. The interface used for stateful failover is defined and configured only in the system execution space, where there is no show traffic command. (That command is available in each security context; however, the stateful failover interface is not!)
To gauge the stateful failover interface usage, you can use the show interface command instead. Issue that command and note the number of bytes shown. (This is a cumulative total, not a bytes-per-second rate.) Then, wait 10 seconds and issue the command again. Note the new byte count, subtract the two, and divide by 10. This gives you an estimate of the bytes per second being sent and received over the stateful interface.
You can also use ASDM to generate statistics or a utilization graph of a stateful LAN interface. Running the graph over a period of time shows you the maximum bit rate that has been used to transfer stateful information. Figure 8-9 shows a sample ASDM graph.
Figure 8-9. Using ASDM to Gauge Stateful Failover Traffic i^heiu Grflph
Grapn | Tabts \ Inion nee stittefiil, Eh Rnios
Continue reading here: A i i p w M V v v
Was this article helpful?