Advanced Configurations

Failover is supported only between identical PIX Firewall models running the same software version. For example, failover is not supported between a PIX10000 and a PIX 520.

Failover IP addresses must be configured on each interface card. The Active unit of the failover pair uses the system IP addresses and the Primary unit's MAC address, while the Standby unit uses the failover IP addresses and the secondary unit's MAC address. The system IP addresses and the failover IP addresses must be on the same subnet with no router between them.

When a failover occurs, each unit changes state. The newly Active unit assumes the IP and MAC addresses of the previously Active unit and begins accepting traffic. The new Standby unit assumes the failover IP and MAC addresses of the unit that was previously the Active unit. Because network devices see no change in these addresses, no ARP entries change or timeout anywhere on the network.

Both PIX Firewall units in a failover pair must have the same configuration. To accomplish this, always enter configuration changes on the Active unit in a PIX Firewall failover configuration. Use the write memory command on the Active unit to save configuration changes to Flash memory (non-volatile memory) on both the active and Standby units. Changes made on the Standby unit are not replicated on the Active unit.

Both units in a failover pair communicate through the failover cable. The two units send special failover "hello" packets to each other over all network interfaces and the failover cable every 15 seconds. The failover feature in PIX Firewall monitors failover communication, the power status of the other unit, and hello packets received at each interface. If two consecutive hello packets are not received within a time determined by the failover feature, failover starts testing the interfaces to determine which unit has failed, and transfers active control to the Standby unit.

The Standby unit does not maintain the state information of each connection. This means that all active connections will be dropped when failover occurs. Client systems must reestablish connections. Additionally, no RIP information is available on the newly Active unit. The newly active PIX Firewall must wait for up to 30 seconds to learn the routing information from the network.

When a failover occurs, syslog messages are generated indicating what happened.

Failover works by passing control to the Standby unit should the Active unit fail. For Ethernet, failover detection should occur within 30 seconds. Token Ring requires additional time for failover.

SYSLOG messages indicate whether the primary or secondary unit failed. Use the show failover command to verify which unit is active.

---

Note Keep the configuration diskette in a safe place. The PIX Firewall version 4.1 configuration is required if a downgrade is ever necessary.

---

Step 3 Remove the failover and network cables from the Standby unit. Do not remove the console cable.

Step 4 Insert the PIX Firewall version 4.2 diskette into the Standby unit and use the reload command to reboot the unit.

Step 5 After the the Standby unit comes up, check the configuration and use the write memory command to store the configuration in flash memory.

Step 6 Plug in the failover and network cables into the Standby unit. Look for link lights on the network interface.

Step 7 On the Standby unit, enter the show interface command to ensure that traffic is moving through the PIX Firewall.

Step 8 Power off the Primary unit to force failover to the Standby unit.

Step 9 Enter the show conn command on the Standby unit to see if traffic is passing through the PIX Firewall.

Step 10 Disconnect the failover and network cables from the Primary unit which is now inactive.

Step 11 Insert the PIX Firewall version 4.2 diskette into the Primary unit.

Step 12 Check the configuration and use the write memory command to store the configuration in flash memory.

Step 13 Plug in the failover and network cables. Look for link lights on the network interface.

Step 14 On the Primary unit, use the failover active command to restart failover.

Step 15 Enter the show conn command on the Primary unit to see if traffic is passing through the PIX Firewall.

This completes the upgrade procedure.

• The unit that has the cable end labeled "primary" becomes the default Primary unit.

• Configure a failover IP address for each interface on the Active unit using the ip address command. From the Active unit, configure a failover IP address for each interface on the Standby unit using the failover ip address command.

• Use the write standby command to save configuration change to the Standby unit. Saving the configuration changes to memory also saves the changes to Flash memory on the Standby unit.

Fault detection is based on the following:

• Failover hello packets are received on each interface. If hello packets are not heard for two consecutive 15 second intervals, the interface will be tested to determine which unit is at fault.

• Cable errors. The cable is wired so that each unit can distinguish between a power failure in the other unit, and an unplugged cable. If the Standby unit detects that the Active unit is powered down (or resets) it will take active control. If the cable is unplugged, a SYSLOG is generated but no switching occurs. An exception to this is at boot-up, at which point an unplugged cable will force the unit active. If both units are powered on without the failover cable installed they will both become active creating a duplicate IP address conflict on your network. The failover cable must be installed for failover to work correctly.

• Failover communication. The two units share information every 15 seconds. If the Standby unit does not hear from the Active unit in two communication attempts (and the cable status is OK) the Standby unit will take over as active.

• How long does it take to detect a failure?

  • Network errors are detected within 30 seconds (two consecutive 15-second intervals).

  • Power failure (and cable failure) is detected within 15 seconds.

  • Failover communications errors are detected within 30 seconds (two consecutive 15-second intervals).

• What maintenance is required?

SYSLOG messages will be generated when any errors or switches occur. Evaluate the failed unit and fix or replace it.

The purpose of these tests is to generate network traffic in order to determine which (if either) unit has failed. At the start of each test, each unit clears its received packet count for its interfaces. At the conclusion of each test, each unit looks to see if it has received any traffic. If it has, the interface is considered operational. If one unit receives traffic for a test and the other unit does not, the unit that received no traffic is considered failed. If neither unit has received traffic, then go to the next test.

• Link Up/Down test---This is a test of the NIC card itself. If an interface card is not plugged into an operational network, it is considered failed (for example, the hub or switch is failed, has a failed port, or a cable is unplugged).

• Network Activity test---This is a received network activity test. The unit will count all received packets for up to 5 seconds. If any packets are received at any time during this interval the interface is considered operational and testing stops. If no traffic is received, the ARP test begins.

• ARP test---The ARP test consists of reading the unit's ARP cache for the 10 most recently acquired entries. One at a time the unit sends ARP requests to these machines attempting to stimulate network traffic. After each request the unit counts all received traffic for up to 5 seconds. If traffic is received, the interface is considered operational. If no traffic is received, an ARP request is sent to the next machine. If at the end of the list no traffic has been received, the ping test begins.

• Broadcast Ping test---The ping test consists of sending out a broadcast ping request. The unit then counts all received packets for up to 5 seconds. If any packets are received at any time during this interval the interface is considered operational and testing stops. If no traffic is received the testing starts over again with the ARP test.

To configure the PIX Firewall to use WebSENSE:

Step 1 Specify the interface and IP address of the WebSENSE server with the url-sever command as shown in this example:

url-server (dmz) host 192.168.1.42 timeout 10
 

In this example, the WebSENSE host is on the dmz interface at IP address 192.168.1.42. A timeout value of 10 seconds is specified as maximum allowed idle time before the PIX Firewall switches to the next WebSENSE server.

Step 2 Use the filter url http command to tell the PIX Firewall how to filter requests. For example, to filter requests for all hosts, use:

filter url http 0 0 0 0 allow

---

Note The allow option in the filter command is crucial to the use of PIX Firewall URL filtering feature. If you use the allow option and the WebSENSE server goes offline, the PIX Firewall lets all Web requests continue without filtering. If the allow option is not specified, all port 80 Web requests are stopped until the server is back online.

---

Step 3 If you want to disable URL filtering, use the no filter url command.

To send traps to an SNMP management station:

Step 1 Identify the IP address of the SNMP management station with the snmp-server host command.

Step 2 Set the snmp-server options for location, contact, and the community password as required.

Step 3 Add an snmp-server enable traps command statement.

Step 4 Set the logging level with the logging trap command; for example:

logging trap debugging
 

Cisco recommends that you use the debugging level during initial set up and during testing. Thereafter, set the level from debugging to a lower value for production use.

Step 5 Start sending syslog traps to the server with the logging on command.

Using SNMP, you can monitor system events on the PIX Firewall. SNMP events can be read, but information on the PIX Firewall cannot be changed with SNMP.

The PIX Firewall SNMP traps available to an SNMP management station are:

Use CiscoWorks for Windows (Product Number CWPC-2.0-WIN) or any other SNMP V1, MIB-II compliant browser to receive SNMP traps and browse a MIB. SNMP traps occur at UDP port 162.

You can get the Cisco MIB files on the Web from:

Step 2 Start SNMPc.

Step 3 Select Config>Compile MIB.

Step 4 Scroll to the bottom of the list, and select the last entry.

Step 5 Click the Add button.

Step 6 Find the file CISCO-SMI.my and click OK.

Step 7 Scroll to the bottom of the list, and select the last entry.

Step 8 Click the Add button again.

Step 9 Find the file CISCO-SYSLOG-MIB.my and click OK.

Step 10 Click Load All.

Step 11 If there are no errors, restart SNMPc.

These instructions are only for SNMPc (CiscoWorks for Windows).

Specify the link command once for each key you want to specify; for example, if you want seven keys, enter the link command in the configuration seven times.

At least two PIX Firewall units are required to use Private Link and each system must have the same hardware and software versions.

If you use the link command to change the interface on which a Private Link tunnel terminates, you must reboot the PIX Firewall on which you made the change. For example, if the Private Link tunnel terminates on the perimeter interface of the foreign PIX Firewall and you change it to terminate on the inside interface of the foreign PIX Firewall, you must reboot the local PIX Firewall on which you changed the configuration.

You can manage remote PIX Firewall units through the Private Link interface.

You can use the linkpath 0.0.0.0 0.0.0.0 foreign_external_ip command to route all outbound traffic on a foreign PIX Firewall to a central PIX Firewall. However, this use has two caveats: there can be only one central PIX Firewall and the other PIX Firewall units must be satellites to it. This implies that the satellites only relay connections to the central and do not communicate among themselves. The second caveat is that the linkpath 0 0 command overrides the default route on the outside interface of the satellite PIX Firewall causing all outbound traffic to flow over Private Link to the central PIX Firewall unit. One use of this feature is when access to the Internet is controlled through one PIX Firewall and the other PIX Firewall units feed their Internet traffic to this one site. This could occur when a central processing facility wants to manage all the Internet IP addresses, let the internal networks use any IP numbering scheme, and have local PIX Firewall units protecting individual departments or sites.

Before configuring Private Link, you would initially configure the systems using the standard commands.

When you configure a Private Link, follow these steps:

Step 2 Use the link command to create an encrypted link for each key you want to specify.

Step 3 Use the linkpath command to specify the IP address of the network on the inside of the remote firewall.

	link 192.168.37.1 1 fadebacfadebac
	link 192.168.37.1 2 bacfadefadebac
	link 192.168.37.1 3 baabaaafadebac
	link 192.168.37.1 4 beebeeefadebac
linkpath 10.3.0.0 255.255.255.0 192.168.37.1

Step 5 On PIX Firewall B, enter these commands:

	link 192.168.35.1 1 fadebacfadebac
	link 192.168.35.1 2 bacfadefadebac
	link 192.168.35.1 3 baabaaafadebac
	link 192.168.35.1 4 beebeeefadebac
linkpath 10.1.0.0 255.255.255.0 192.168.35.1

---

Note Use random keys, not the ones shown in this guide.

---

Step 6 Test the connection to each foreign PIX Firewall with the ping command.

Step 7 After configuring the link and linkpath commands, if a ping inside command to the inside address of the remote PIX Firewall does not work, enter the show link command and look at packets in and out. If both are at 0 that means the link is up, but traffic is not being routed to the inside interface of the local PIX Firewall.

Step 8 Proceed to the router closest to the PIX Firewall on the inside, and look at the routing table. If there is not a route to the remote PIX Firewall network, add a static route, or turn RIP on at the PIX Firewall.

When you Telnet to the PIX Firewall, and perform a ping inside, the packet is not simply generated from the inside address of the PIX Firewall and forwarded across the bus to the outside address and out the encrypted tunnel. Instead the ICMP packet is placed on the inside network, picked up by the closest router, and retransmitted to the PIX Firewall, where it is then picked up, encrypted and sent across the link to the remote box.

Step 1 Create a link with the associated key(s).

Step 2 Specify the md5 option.

For example:

link (inside) 192.150.49.133 1 123abc
link (inside) 192.150.49.133 2 123abc456
link (inside) 192.150.49.133 md5
 

The first link command statement creates an encrypted path from the current Private Link-equipped PIX Firewall to the remote PIX Firewall at 192.150.49.133. The encryption key is in the first (of 7) keys and has the value 123abc. The second link command statement creates a second key of 123abc456. The third link command statement specifies that MD5 authentication will be required for this link.