Configuring Lan-Based Active/Active Failover - Cisco PIX 500 Series Configuration Manual

Chapter 14 Configuring Failover
For each failover group, you need to specify whether the failover group has primary or secondary
preference using the primary or secondary command. You can assign the same preference to both
failover groups. For load balancing configurations, you should assign each failover group a different unit
preference.
The following example assigns failover group 1 a primary preference and failover group 2 a secondary
preference:
hostname(config)# failover group 1
hostname(config-fover-group)# primary
hostname(config-fover-group)# exit
hostname(config)# failover group 2
hostname(config-fover-group)# secondary
hostname(config-fover-group)# exit
Assign each user context to a failover group using the join-failover-group command in context
Step 6
configuration mode.
Any unassigned contexts are automatically assigned to failover group 1. The admin context is always a
member of failover group 1.
Enter the following commands to assign each context to a failover group:
hostname(config)# context context_name
hostname(config-context)# join-failover-group {1 | 2}
hostname(config-context)# exit
Step 7 Enable failover:
hostname(config)# failover
Power on the secondary unit and enable failover on the unit if it is not already enabled:
Step 8
hostname(config)# failover
The active unit sends the configuration in running memory to the standby unit. As the configuration
synchronizes, the messages "Beginning configuration replication: Sending to mate" and "End
Configuration Replication to mate" appear on the primary console.
Save the configuration to Flash memory on the Primary unit. Because the commands entered on the
Step 9
primary unit are replicated to the secondary unit, the secondary unit also saves its configuration to Flash
memory.
hostname(config)# copy running-config startup-config
If necessary, force any failover group that is active on the primary to the active state on the secondary.
Step 10
To force a failover group to become active on the secondary unit, issue the following command in the
system execution space on the primary unit:
hostname# no failover active group group_id
The group_id argument specifies the group you want to become active on the secondary unit.

Configuring LAN-Based Active/Active Failover

This section describes how to configure Active/Active failover using an Ethernet failover link. When
configuring LAN-based failover, you must bootstrap the secondary device to recognize the failover link
before the secondary device can obtain the running configuration from the primary device.
This section includes the following topics:
OL-12172-03
Cisco Security Appliance Command Line Configuration Guide
Configuring Failover
14-29