Solved

Pix Failover issue

Posted on 2007-11-16
5
252 Views
Last Modified: 2010-05-18
I have two pix firewalls... one primary, one secondary.... the failover was working as I had both pix's plugged into a switch that the rest of the lan was plugged into...

i now have the pix plugged into a 3560 using that port as the "routing" port. it's working just fine... but if the pix failed over, it would break the network because even though the secondary pix would assume the default gateway IP address of the primary, the secondary pix would still be plugged into a regular port, not the routing port on the 3560.

how do i regain my failover capability? Can the 3560 have more than one routing port? plz help. Thanks!
0
Comment
Question by:jaysonfranklin
  • 4
5 Comments
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 20300880
>>how do i regain my failover capability?

You need to make sure that all of your primary PIX interfaces plug into the same subnet as all of the corresponding interfaces on the secondary PIX plug into.  If you're using VLAN's then for every PIX interface that you have, you will need 2 ports in that VLAN.  

For example, let's say you have inside, outside and dmz interfaces (for a total of 3) on your primary PIX that you are using.  Let's also say that the inside interface is VLAN ID 5, the outside is VLAN ID 10, and the dmz is VLAN ID 15.  You will need two ports on the 3560 in VLAN 5, two in VLAN 10 and two more in VLAN 15.  Make sense?  Please clarify if you're using VLAN's or if you're using physical segmentation of your subnets.

>>Can the 3560 have more than one routing port?

If you mean can you have more than one layer 3 port that has an IP address attached to it, then yes.  Since the 3560 is a L3 switch (and not what cisco classifies as a "router"), then you would create VLAN interfaces and assign IP addresses to them and the switch would then be able to route between those subnets associated with the VLAN interfaces.
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20301207
Well, actually the Pix doesn't know anything about the VLANs. it just routes 192.168.0.0 /16 to the inside interface which lets say is 192.168.10.1 which is connected to the 3560 routing port at 192.168.10.10.

Then on the 3560 there are vlans int's are 100.1 101.1 102.1 etc.

Do i make a Vlan for the routing port ? and add the routing port to that vlan? then just add another port to the same vlan where the secondary pix is plugged in? and im assuming on that port i will have to specify 'no switchport' command? How will it not know to only route to the one if the other is down?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20313889
Ok, while people were out this weekend, i had a chance to play with this....

recap on current config, pix is plugged directly into the 3560 which is doing the routing. there is one port that is set up as the routing port with the 'no switchport' command. that interface has an IP address of 10.10. the default gateway of the switch is 10.1 which is the inside interface of the pix. the switch has a bunch of vlans starting at 101.1 thru lets say 110.1... the pix has a statement that says route 192.168.0.0 255.255.0.0 to the inside interface.

I can make the vlan for the 10.0 network which is pretty much the gateway network to get out to the internet or whatever....but when i try to apply that vlan to the routing interface, it says "Command Rejected; not a switching port"

To make this work, do i have to move the routing to the Pix? I really don't want to do that.... is there a way to keep the 3560 routing between the vlans and still get the Pix to failover?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20314760
Can I get another comment?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20316093
No comment all day... should I post another question? i need to get this fixed..
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

We've been using the Cisco/Linksys RV042 for years as: - an internet Gateway - a site-to-site VPN device - a leased line site-to-site subnet-to-subnet interface (And, here I'm assuming that any RV0xx behaves the same way as an RV042.  So that's …
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now