Cisco pix 515 and 2960 redundent

Hi All,

I want my cisco pix 515e to work as failover firewall and want to connect them with two switch to provide redundency. please see my configutation like this below:
Can someone assist me with the configuration? I have got some idea but I need the full proof solution.

Who is Participating?
nodiscoConnect With a Mentor Commented:
You can't actually connect the PIX to 2 switches as the PIX can only have 1 default gateway for outbound.  

In terms of failover though this shouldn't be a problem.


switch 1 connects to pix 1
switch 2 connects to pix 2
pix 1 is primary.
If switch 1 fails, then the port on pix1 that connects to switch 1 goes into fail state and the pix 1 fails over so that pix2 is now the primary.  traffic then flows from pix2 and switch 2.
To configure the PIXs you will need the required licensing on the firewalls first (Unrestricted/failover)

there are 2 options for failover config, cable based and Lan based.  Have a look at this URL for configuration details:

Just an FYI in case - you can't load balance over PIX firewalls - they only work as a 1 active, 1 standby.

Prashant0906Author Commented:
Thanks for your solution. I am more concerned about cisco 2960 failover. Have no idea how that works. can you please help?
The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

what do you want to put in a solution - HSRP?
Prashant0906Author Commented:
Thanks for the reply and sory for delays at my end. Yes I want to use HSRP.
configuring HSRP is simple enough, essentially you will have 2 hard coded gateway addresses that share the same virtual ip address.  You stipulate which is the primary device and it acts accordingly until it goes down in which case the secondary device takes over as the gateway.

I am not sure its supported on 2960 switches though - have a look at this link for the commands and more detail:

Just something to mention too - you are teaming 2 nics in the example above.  Note that in a HSRP example, it provides redundancy - not load balancing.  You may want to look at GLBP instead.  As your server connects to both switches individually, only 1 network card will actually function at a time.  The 2960s would need to connect to each other also, if you want to use both network cards to talk to the same virtual gateway for hsrp
Prashant0906Author Commented:
Thanks for the solution. I think I am almost there. now the question arise that i will be connecting one cisco firewall to two switches. In case switch fails then firewall shoud still be able to forward the traffic using its second adapter connected to other switch. how this can be achieved? can I do failover on the network port on the pix 515e firewall?
Prashant0906Author Commented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.