PIX Failover and HW.

Hi all,
I have some more question about HW and PIX failover.
What happens when I connect two PIXs..
one UR license and one FO license and my
FO PIX takes activity over and my PIX with UR license will be corrupted so that I will need to disconnect it completely to repair it? I know that when someone wants to use FO PIX standalone than PIX reboots per 24 hours cycle. How PIX determines that it is not used standalone? I think that when I switch off first PIX in pair so second PIX in pair with FO license will function standalone.
Could you give me some explanation?
BR
jl

I guess you won't take magic as an answer? ;-)
I am assuming you are using Serial Failover, no?
So, when the PIX pair powers up, both units detect each other. If you then later remove the UR PIX from the mix, the FO will remain up and actively passing traffic indefinately. (Or almost so. At least until the next power outage). The licensing restriction only kicks in if the FO unit does not detect a UR unit at boot.
If this answers your question (I believe it does) please check the box so we can see one of those nice red checks :-)
Sincerely,
David.

Similar Messages

Pix Failover

Im trying to build out a new network and im looking for the most redundancy as possible :)
If you look at the attachment everything from my knowledge will work just peachy if I just connect the blue lines...The only problem is if the main top switch failed (not a link failure but a total shut off) I will need to make sure the main pix fails over to the secondary.
What I would much rather like is when the main switch failed I didnt have to have the pixs failover that there would be another link to handle this. Thats where the green lines come in..
Can someone get me on the right path here, ive looked into the tracking features on the pix but it seems to only work with two seperate ISPs etc.
thanks guys and gals

You should have some kind of redundancy. Unfortunately, there's no way that you can configure pix to be able to detect whether the switch behind it is dead or not and be able to route the traffic to another back up switch when the primary switch is dead. But you can configure redundancy for the pix itself by configuring the pix for failover. That way, when the primary pix goes down it will failover to the secondary pix. Please refer to the following URL for more details.
How Failover Works on the Cisco Secure PIX Firewall:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094ea7.shtml
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

Pix Failover Configuration with 1 Public

Have 1 PIX 515e (6.3(3)) in production that is currently assigned ip 1.1.1.2 w/ a 255.255.255.248 mask. All of my remaining publically assigned ips are being used so I don't have a free ip for the standby ip on the outside interface. Can I just do the standbys on the inside, failover and stateful link and not worry about having the standby for the outside? I'll be using lan-based failover w/ a few ports vlan'd out on my 3560 for the failover and stateful links.

Hello David,
The Pix firewall is getting to end of life this month, on version 6.3 I don't think this is supported or what will be the behavior on this scenario, on version 7.0 and higher you can use the command:
no monitor-interface if_name
http://www.cisco.com/en/US/docs/security/asa/asa70/command/reference/mr.html#wp1582411
And just monitor the other interfaces.
I hope this helps.
Regards,
Felipe.

Connection failover and transaction failover

Connection failover and transaction failover
I need to know more about a behavior in a RAC cluster. When a node goes down that is executing one of my transaction through JDBC , does the connection and transaction failover to a new node without me needing to restart tran or reconnect ?
Please provide some insight
Thanks

Transactions are NOT automatically rolled back. The application must do this otherwise the session will get disconnected.
If you code TAF, all sessions will failover to the backup connection. You can specify that select statements are automatically re-executed after the failover. Insert/update/delete transactions must be explicitly rolled back and resubmitted by the application.
IF you are using an ORacle Connection pool, the connection pool will automatically cleanup connections to the failed instance, abort inflight transactions. The application will either retry or it will propagate the error to the end user.
See the whitepaper on the OTN RAC page (otn.oracle.com/rac) Workload Management with Oracle RAC for more information.

Phase 2 tunnel is not going up between PIX 525 and Watchguard

Hi Folks,
Can you please help me in knowing where is the problem liying, currently I am trying to establish a VPN tunnel between PIX firewall and Watchguard , all the parameters of both devices are the same though Phase two tunnel is not coming up.
here is the debug :
crypto_isakmp_process_block:src:212.37.17.43, dest:212.118.128.233 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP (0:0): Detected NAT-D payload
ISAKMP (0:0): NAT does not match MINE hash
hash received: b3 8f bb 0 93 3b 65 e8 35 6f 54 6 c4 6f 59 cc
my nat hash : dd 70 9 ac 35 58 40 da 3b 5b fc 1b 4c 87 d2 11
ISAKMP (0:0): Detected NAT-D payload
ISAKMP (0:0): NAT does not match HIS hash
hash received: ba 72 c5 e 5b fb 88 f0 1e f7 8a ba c9 c6 c1 cc
his nat hash : c 4c 89 a5 66 c1 dd 80 76 48 3f a5 b0 f0 56 ed
ISAKMP (0:0): constructed HIS NAT-D
ISAKMP (0:0): constructed MINE NAT-D
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:212.37.17.43, dest:212.118.128.233 spt:4500 dpt:4500
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
ISAKMP: Created a peer struct for 212.37.17.43, peer port 37905
ISAKMP: Locking UDP_ENC struct 0x3cbb634 from crypto_ikmp_udp_enc_ike_init, count 1
ISAKMP (0): ID payload
next-payload : 8
type : 2
protocol : 17
port : 0
length : 23
ISAKMP (0): Total payload length: 27
return status is IKMP_NO_ERROR
ISAKMP (0): sending INITIAL_CONTACT notify
ISAKMP (0): sending NOTIFY message 24578 protocol 1
VPN Peer: ISAKMP: Added new peer: ip:212.37.17.43/4500 Total VPN Peers:16
VPN Peer: ISAKMP: Peer ip:212.37.17.43/4500 Ref cnt incremented to:1 Total VPN Peers:16
crypto_isakmp_process_block:src:212.37.17.43, dest:212.118.128.233 spt:4500 dpt:4500
ISAKMP (0): processing NOTIFY payload 24578 protocol 1
spi 0, message ID = 3168983470
ISAKMP (0): processing notify INITIAL_CONTACT
return status is IKMP_NO_ERR_NO_TRANS
crypto_isakmp_process_block:src:212.37.17.43, dest:212.118.128.233 spt:4500 dpt:4500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 484086886
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP: attributes in transform:
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (basic) of 28800
ISAKMP: SA life type in kilobytes
ISAKMP: SA life duration (basic) of 32000
ISAKMP: encaps is 61433
ISAKMP: authenticator is HMAC-MD5
ISAKMP (0): atts not acceptable. Next payload is 0
ISAKMP (0): SA not acceptable!
ISAKMP (0): sending NOTIFY message 14 protocol 0
return status is IKMP_ERR_NO_RETRANS
crypto_isakmp_process_block:src:212.37.17.43, dest:212.118.128.233 spt:4500 dpt:4500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
ISAKMP (0:0): sending NAT-T vendor ID - rev 2 & 3
crypto_isakmp_process_block:src:212.37.17.43, dest:212.118.128.233 spt:4500 dpt:4500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:213.210.211.82, dest:212.118.128.233 spt:500 dpt:500
ISAKMP (0): processing NOTIFY payload 36136 protocol 1
spi 0, message ID = 287560609
ISAMKP (0): received DPD_R_U_THERE from peer 213.210.211.82
ISAKMP (0): sending NOTIFY message 36137 protocol 1
return status is IKMP_NO_ERR_NO_TRANSdebug
ISAKMP (0): retransmitting phase 1 (0)...
Thanks,
Ismail

Hi Kanishka,
The Phase 2 Parameters are the same also PFS is disabled !
There are some curious things in the debug msg, could you please throw some light on them
ISAKMP (0): Checking ISAKMP transform 1 against priority 1 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash MD5
ISAKMP: auth pre-share
ISAKMP: life type in seconds
ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
ISAKMP: default group 1
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): processing vendor id payload
ISAKMP (0:0): vendor ID is NAT-T
ISAKMP (0): processing vendor id payload
what does the vendor ID is NAT-T above mean ? Is it say that both sides are using Nat traversal.
Also in ecryption its says encryption 3DES-CBC
i am not sure if this CBC is the culprit. Because thats what watchgaurd uses only it does not have an option for only 3DES.
strange enought that Phase 1 is getting up, I am also questioning myself about the following message appearing in Phase 1:
ISAKMP (0:0): Detected NAT-D payload
ISAKMP (0:0): NAT does not match MINE hash
hash received: b3 8f bb 0 93 3b 65 e8 35 6f 54 6 c4 6f 59 cc
my nat hash : dd 70 9 ac 35 58 40 da 3b 5b fc 1b 4c 87 d2 11
ISAKMP (0:0): Detected NAT-D payload
ISAKMP (0:0): NAT does not match HIS hash
hash received: ba 72 c5 e 5b fb 88 f0 1e f7 8a ba c9 c6 c1 cc
his nat hash : c 4c 89 a5 66 c1 dd 80 76 48 3f a5 b0 f0 56 ed
ISAKMP (0:0): constructed HIS NAT-D
ISAKMP (0:0): constructed MINE NAT-D
return status is IKMP_NO_ERROR
how come Phase 1 is coming up though the PIX is claiming that his HASH is not the same as HIS HASH :(
the log messages on WATCH GUARD states that there is no proposal chosen!
why both firewalls are not friends?
I appreciate any input

Cisco pix 525 and 515 cannot archieve configuration in LMS 3.0.1

Hi,
we have several cisco pix 525 and 515 cannot archieve configuration in LMS 3.0.1
Any help would be greatly appriciated.
Thanks in advance
Samir

Hi,
Here is the output.
*** Device Details for ***
Protocol ==> Unknown / Not Applicable
Selected Protocols with order ==> TFTP,SSH,HTTPS
Execution Result:
RUNNING
CM0151 PRIMARY RUNNING Config fetch failed for ********* Cause: SSH: Failed to establish SSH connection to 10.192.18.10 - Cause: Authentication failed on device 3 times.
Action: Check if protocol is supported by device and required device package is installed. Check device credentials. Increase timeout value, if required.
But when I do mangement station to Device it gives me following results:
Interface Found: 10.192.18.10
Status: UP
Test Results
UDP     Failed
      sent: 5 recvd: 0 min: 0 max: 0 avg: 0 timeout: 2 size: 64 protocol: udp port: 7
TCP     Failed
      sent: 0 recvd: 0 min: 0 max: 0 avg: 0 timeout: 0 size: 0 protocol: tcp port: 7
HTTP     Failed
      sent: 0 recvd: 0 min: 0 max: 0 avg: 0 timeout: 2 size: 33 protocol: http port: 80
TFTP     Failed
      sent: 5 recvd: 0 min: 0 max: 0 avg: 0 timeout: 2 size: 25 protocol: tftp port: 69
SNMPRv2c(Read)     Okay
     sent: 5 recvd: 5 min: 0 max: 0 avg: 0 timeout: 2 min_size: 1472 protocol: snmpv3_get port: 0
SNMPWv2c(Write)     Failed
      sent: 5 recvd: 0 min: 0 max: 0 avg: 0 timeout: 2 min_size: 1472 protocol: snmpv3_set port: 0
SSHv2     Failed
TELNET     Okay
Waiting for your reply.
Samir

Load balancing, failover and fallback in Non-Clustered WebLogic environment

hi,
Has anyone implemented WebLogic 10.3.3 (or 10.3.4) in a Non-Clustered environment, but also got load balancing, failover and fallback work?
We were successful in getting failover working using t3://server1:7001,server2:7002 provider URL, but not load balancing or fallback.
The fallback is working when it was connecting to server2 and if we kill server2, then it switches to server1, but not when server2 is still running while server1 comes back.
All we need to find a way to enforce fallback to primary site, even if secondary which the client connected is still up and running and primary site comes back.
Any help appreciated.
Thanks.
Best regards,
Bala

hi,
Has anyone implemented WebLogic 10.3.3 (or 10.3.4) in a Non-Clustered environment, but also got load balancing, failover and fallback work?
We were successful in getting failover working using t3://server1:7001,server2:7002 provider URL, but not load balancing or fallback.
The fallback is working when it was connecting to server2 and if we kill server2, then it switches to server1, but not when server2 is still running while server1 comes back.
All we need to find a way to enforce fallback to primary site, even if secondary which the client connected is still up and running and primary site comes back.
Any help appreciated.
Thanks.
Best regards,
Bala

Agent Failover and AD Integration in Operations Manager

Hi
I got some queries around SCOM agent failover and AD Integration:
Does the discovery wizard differentiates between domain-joined and workgroup systems in terms of deploying agent on them?
Why do we ever need Active Directory Integration with Operations Manager as described here
http://technet.microsoft.com/en-us/library/hh212922.aspx
- is it required for non-domain joined Windows systems or any other systems? All the other documents I read are saying that Windows agents can failover to other available MS in resource pool if their currently assigned MS fails and fails back automatically
as soon as it comes back online.
Is the automatic failover applicable to agents installed using client push (Discovery Wizard) Or it applies to agents installed manually using MOMAgent.msi?
Also referred to this article
http://blogs.technet.com/b/meamcs/archive/2013/05/10/is-ad-integration-or-manual-scom-agents-required-to-allow-automatic-windows-agent-failover-between-multiple-scom-management-servers.aspx
but doesn’t seems to be having grip on it so far. Request some details on the above points.
Thanks
Taranjeet Singh
zamn

Hi,
For the first question, I don't think we can use discovery wizard to install agent on non-domain joined computers. Please refer to the below links for how to deploy SCOM agent to non-domain computers:
http://blogs.technet.com/b/quenguyen/archive/2011/07/13/monitoring-non-domain-servers-using-scom.aspx
http://blogs.technet.com/b/stefan_stranger/archive/2012/04/17/monitoring-non-domain-members-with-om-2012.aspx
For the second question, as we can read from the below link:
http://blogs.technet.com/b/meamcs/archive/2013/05/10/is-ad-integration-or-manual-scom-agents-required-to-allow-automatic-windows-agent-failover-between-multiple-scom-management-servers.aspx
SCOM windows agents automatic failover does not require AD integration or PowerShell scripting or Configuration Manager or manual agents installation specially for small to medium environment and agents distribution between different SCOM management servers
can be accomplished through push agents wizard, and windows agents failover can be simply verified from event viewer.
Regards,
Yan Li
Regards, Yan Li

Always On - async mode - Failover and failback check list

Hi All,
Our production is configured with Always On in Async mode with DR.
We are planning to do a failover and failback on the Availability Groups in weekend.
Apart from the time consuming to do a failover and failback, does anyone having complete checklist on what all has to be checked at the time of failover and failback?
Thanks in advance!

Hi MvKalyan,
In AlwaysOn Avaliability Groups, when availability replicas are configured for asynchronous-commit mode, it supports only the manual failover mode. For more details, please review this article:
Failover and Failover Modes (AlwaysOn Availability Groups).
Before performing a failover of SQL Server AlwaysOn Avaliability Group, there are several things should be considering, such as data loss, connectivity problems and so on. For more information, you can review this online blog:
Before You Fail Over a SQL Server AlwaysOn Availability Group.
Thanks,
Lydia Zhang

DATAGUARD FAILOVER AND SQITCHOVER TESTING

I AM GOING TO TEST FAILOVER AND SWITCHOVER FOR BOTH PRIMARY AND STANDBY.
I AM STARTING FROM SCRATCH .
DOES SOMEBODY HAVE ANY DOCUMENTATION, NOTE ID'S OR ANY LINKS FOR THE SAME
THANKS LOT IN ADVANCE
JAGMOHAN

First test switchover ... does that work? The commands are well documented all over the net including on my website "MorgansLibrary.org"
If switchover works then the next question is have you configured for failover? If so how? In what version? etc. etc. etc.
We need details to be able to provide advice.

Failover and Switchover

Hi ,
I needs some clarifications regarding the manual failover and Swithover.
As i know these both are role transitions from primary to standby and also switchover is done during Planned tasks. And fail over is the one which is done during sudden unplanned events.
Also switchover can be done at any point of time.
Assume do to some unexpected events , my primary database is down and failed to Up. so i need to do a manual failover....
My question here is , Anyway i am going to do manually, but why i need to do a failover? I can initiate a switchover right?
Even if i do a failover , if my database is not in the flash back mode , then i need to rebuild a new standby database....
Why i want to make myself in trouble by using failover insttead of a switchover.
Regards,
Mohammed

How do I ask a question on the forums?
https://forums.oracle.com/message/9362002#9362002

PO for LAN failover and stateful failover link?

Hi.. We have 2 x ASA 5520s running ver 9.0. We plan to aggregate the 2 interfaces used for LAN failover and stateful failover into a lacp PO. So both the ASAs are connected to each other directly using these 2 interfaces and then we logically make it a one PO. We then assign the PO intface an ip. Is this supported?

You can use any unused interface (physical, redundant, or EtherChannel) as the failover link. (Source)
That said, It would be an uncommon implementation. I almost always see them on separate physical interfaces.

How does failover and load distribution work in Operations Manager resource pools?

Hello everyone,
I have a couple of questions in regard to failover and load distribution in resource pools.
What is the criteria for an x-plat or network device to initiate a failover?
How is load distributed in a resource pool - Is it round-robin, performance based or something completely different?
In case more than two management servers are in the same pool, and a management server becomes unavailable, how is load distributed among the remaining resource pool members?
Any help is appreciated.
Thx,
Claus

Hi,
Resource Pools are a collection of Health Services working together to manage instances assigned to the pool.
Workflows targeted to the instances are loaded by the Health Service in the Resource Pool that ends up managing that instance.
If one of the Health Services in the Resource pool were to fail, the other Health Services in the pool will pick up the work that the failed member was running.
And I would like to share this article with you. Hope it helps.
http://www.systemcentercentral.com/how-does-the-failover-process-work-in-opsmgr-2012-scom-sysctr/
Niki Han
TechNet Community Support

Software for managing SNMP Pix failover traps

Hi, we need to monitor pix failover with snmp. Going through the pix readme shows as example how to do with Cisco Works for WIndows. Is this the only cisco product that can manage this? We are using LMS, is there a way with LMS to monitor failover events?
Kurtis Durrett

Thanks!
The command originally didn't work by itself, but after come changes to the other SNMP configurations the traps were then received.
SNMP configurations below:
Switch#show run | inc snmp
snmp-server community (removed) RW 5
snmp-server trap-source Vlan411
snmp-server chassis-id (Removed)
snmp-server enable traps fru-ctrl
snmp-server enable traps entity
snmp-server enable traps envmon fan temperature
snmp-server host *.*.*.* (Removed) fru-ctrl envmon
Logging:
Switch#show run | inc log
service timestamps log datetime localtime
logging buffered 16384
logging trap notifications

PIX 501 and Linksys VPN Router (WRV200)

I have inherited a job where we have a Cisco PIX 501 firewall at one site, and Linksys WRV200 VPN Router on two other
sites. I have been asked to connect these Linksys routers to the PIX firewall via VPN.
I believe the Linksys vpn routers can only connect via IPSec VPN, so i am looking for help on configuring the PIX 501 to allow the linksys to connect with the following parameters, if possible.
Key Exchange Method: Auto (IKE)
Encryption: Auto, 3DES, AES128, AES192, AES256
Authentication: MD5
Pre-Shared Key: xxx
PFS: Enabled/Disabled
ISAKMP Key Lifetime: 28800
IPSec Key Lifetime: 3600
On the PIX i have the PDM installed and i have tried using the VPN Wizard to no avail.
I chose the following settings when doing the VPN Wizard:
Type of VPN: Remote Access VPN
Interface: Outside
Type of VPN Client Device used: Cisco VPN Client
(can choose Cisco VPN 3000 Client, MS Windows Client using PPTP, MS Windows client using L2TP)
VPN Client Group
Group Name: RabyEstates
Pre Shared Key: rabytest
Extended Client Authentication: Disabled
Address Pool
Pool Name: VPN-LAN
Range Start: 192.168.2.200
Range End: 192.168.2.250
DNS/WINS/Default Domain: None
IKE Policy
Encryption: 3DES
Authentication: MD5
DH Group: Group 2 (1024-bit)
Transform Set
Encryption: 3DES
Authentication: MD5
I have attached the VPN log from the Linksys VPN Router.
This is the first time i've ever worked with PIX so i'm still trying to figure the thing out, but i'm confident with CCNA level networking.
Thanks for your help!

Hi again,
I believe the pix has a 3des license because of the following parts of the "show version"
Licensed Features:
Failover: Disabled
VPN-DES: Enabled
VPN-3DES-AES: Enabled
This PIX has a Restricted (R) license.
I've tried reconnecting the VPN tunnel with debugging on the PIX and get the output as shown in the attached file "vpndebug.txt"
As for the other show commands they give:
pixfirewall# show crypto isakmp sa
Total : 0
Embryonic : 0
dst src state pending created
pixfirewall# show crypto ipsec sa
interface: outside
Crypto map tag: transam, local addr. 10.0.0.1
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.101.0/255.255.255.0/0/0)
current_peer: 10.0.0.2:0
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 10.0.0.1, remote crypto endpt.: 10.0.0.2
path mtu 1500, ipsec overhead 0, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
pixfirewall#
Thanks again Daniel, i really appreciate your help on this matter.

PIX Failover and HW.

Similar Messages

Maybe you are looking for