Failover PIX problem

Posted on 2007-07-29
Last Modified: 2010-04-09
Dear All,

I have failover PIX, 515e, they were working very fine, and I never touched them except for access list, opening ports, NATing...etc

yesterday I faced a problem with them, one of the ethernet cable going from one of the PIXs to the outside switch was blinkng orange and green, and all the communication was disconnecting and not stable, and I noticed that if I shut down both of the pix and start them again, they will be ok and the first one will be active for (5-15)mins, then the second pix will be the active one, and the disconnecting problem appears once the second one come active,

I dont know what to do, I shut down the second one, every thing is ok except telneting to the PIXs, and now i am in this situation because I dont need the users to feel the problem.  

Please help me
Question by:Saed80
    LVL 16

    Expert Comment

    Sounds like a normal duplex mismatch if the lights are flashing like that. Have you checked the config that the failover ports on both PIXes are set to the same setting (ideally 100/full)?
    LVL 1

    Accepted Solution

    Hi Saed,

    If your secondary PIX is taking over the failover mode then it could be related to a few possible problems.  I would not rule out the simple options first.  Check that the cables are connected correctly to your switch, and then read htrough the following article.

    You should double check that the secondary PIX has not been set to active, and that the time is syncronized on both boxes.

    Let me know how you get on.
    LVL 32

    Expert Comment

    If it is a cisco switch and the switch light goes from gree to orange and back again it could be problems with the firewall nic or the switch port. Can you post the output of the "show interface <your_firewall_interface _port>"


    Author Comment

    actually i found that the ethernet cable going from the secondary PIX to the core switch has a problem, after i changed the cable everything is great, but the port flashing still sometimes happening, but without any effect. but sure i need to solve it.

    and thank u markyzinho for that article, its really great.

    here is the output of the show interface (port):
    interface ethernet0 "outside" is up, line protocol is up
      Hardware is i82559 ethernet, address is 0012.1cc9.c217
      IP address, subnet mask
      MTU 1500 bytes, BW 100000 Kbit full duplex
            4753251 packets input, 2277700540 bytes, 0 no buffer
            Received 72 broadcasts, 3404 runts, 0 giants
            22382 input errors, 18978 CRC, 0 frame, 0 overrun, 18978 ignored, 0 abort
            3714646 packets output, 1509689664 bytes, 0 underruns
            0 output errors, 0 collisions, 0 interface resets
            0 babbles, 0 late collisions, 0 deferred
            0 lost carrier, 0 no carrier
            input queue (curr/max blocks): hardware (128/128) software (0/47)
            output queue (curr/max blocks): hardware (0/33) software (0/1)

    thanks for all of you.
    LVL 1

    Expert Comment


    No problem. You would be surprised how many times I have found a simple solution like a faulty cable after hours of debugging the firewall.  Glad I could help.

    I would suggest that you attempt some tests (during an out of hours time or maintenance window) of the failover function and switch on syslog to troubleshoot any errors that happen during the switch from one box to the other.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
    I thought I'd write this up for anyone who has a request to create an anonymous whistle-blower-type submission form created using SharePoint 2010 (this would probably work the same for 2013). It's not 100% fool-proof but it's as close as you can get…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now