Solved

Pix Failover issue

Posted on 2007-11-16
5
256 Views
Last Modified: 2010-05-18
I have two pix firewalls... one primary, one secondary.... the failover was working as I had both pix's plugged into a switch that the rest of the lan was plugged into...

i now have the pix plugged into a 3560 using that port as the "routing" port. it's working just fine... but if the pix failed over, it would break the network because even though the secondary pix would assume the default gateway IP address of the primary, the secondary pix would still be plugged into a regular port, not the routing port on the 3560.

how do i regain my failover capability? Can the 3560 have more than one routing port? plz help. Thanks!
0
Comment
Question by:jaysonfranklin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
5 Comments
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 20300880
>>how do i regain my failover capability?

You need to make sure that all of your primary PIX interfaces plug into the same subnet as all of the corresponding interfaces on the secondary PIX plug into.  If you're using VLAN's then for every PIX interface that you have, you will need 2 ports in that VLAN.  

For example, let's say you have inside, outside and dmz interfaces (for a total of 3) on your primary PIX that you are using.  Let's also say that the inside interface is VLAN ID 5, the outside is VLAN ID 10, and the dmz is VLAN ID 15.  You will need two ports on the 3560 in VLAN 5, two in VLAN 10 and two more in VLAN 15.  Make sense?  Please clarify if you're using VLAN's or if you're using physical segmentation of your subnets.

>>Can the 3560 have more than one routing port?

If you mean can you have more than one layer 3 port that has an IP address attached to it, then yes.  Since the 3560 is a L3 switch (and not what cisco classifies as a "router"), then you would create VLAN interfaces and assign IP addresses to them and the switch would then be able to route between those subnets associated with the VLAN interfaces.
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20301207
Well, actually the Pix doesn't know anything about the VLANs. it just routes 192.168.0.0 /16 to the inside interface which lets say is 192.168.10.1 which is connected to the 3560 routing port at 192.168.10.10.

Then on the 3560 there are vlans int's are 100.1 101.1 102.1 etc.

Do i make a Vlan for the routing port ? and add the routing port to that vlan? then just add another port to the same vlan where the secondary pix is plugged in? and im assuming on that port i will have to specify 'no switchport' command? How will it not know to only route to the one if the other is down?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20313889
Ok, while people were out this weekend, i had a chance to play with this....

recap on current config, pix is plugged directly into the 3560 which is doing the routing. there is one port that is set up as the routing port with the 'no switchport' command. that interface has an IP address of 10.10. the default gateway of the switch is 10.1 which is the inside interface of the pix. the switch has a bunch of vlans starting at 101.1 thru lets say 110.1... the pix has a statement that says route 192.168.0.0 255.255.0.0 to the inside interface.

I can make the vlan for the 10.0 network which is pretty much the gateway network to get out to the internet or whatever....but when i try to apply that vlan to the routing interface, it says "Command Rejected; not a switching port"

To make this work, do i have to move the routing to the Pix? I really don't want to do that.... is there a way to keep the 3560 routing between the vlans and still get the Pix to failover?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20314760
Can I get another comment?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20316093
No comment all day... should I post another question? i need to get this fixed..
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question