配置PIX Failover----系统需求

ear xlate命令.

　　第八步　正确配置接口的IP地址。配置完后可以使用show ip address命令查看：

show ip address
System IP Addresses:
ip address outside 192.168.1.1 255.255.255.0
ip address inside 10.1.1.1 255.255.255.0
ip address intf2 192.168.2.1 255.255.255.0
ip address intf3 192.168.3.1 255.255.255.0
ip address 4th 172.16.1.1 255.255.255.0
Current IP Addresses:
ip address outside 192.168.1.1 255.255.255.0
ip address inside 10.1.1.1 255.255.255.0
ip address intf2 192.168.2.1 255.255.255.0
ip address intf3 192.168.3.1 255.255.255.0
ip address 4th 172.16.1.1 255.255.255.0

　　当主PIX处于活动状态时，Current IP Addresses和System IP Addresses相同，当主PIX得失效状态时，Current IP Addresses会变成备用PIX的IP地址.

　　第九步　在主PIX上使用failover命令启用Failover。

　　第十步　使用show failover验证状态，输出如下：

show failover
Failover On
Cable status: Other side powered off
Reconnect timeout 0:00:00
Poll frequency 15 seconds
This host: primary - Active
Active time: 225 (sec)
Interface 4th (172.16.1.1): Normal (Waiting)
Interface intf3 (192.168.3.1): Normal (Waiting)
Interface intf2 (192.168.2.1): Normal (Waiting)
Interface outside (192.168.1.1): Normal (Waiting)
Interface inside (10.1.1.1): Normal (Waiting)
Other host: secondary - Standby
Active time: 0 (sec)
Interface 4th (0.0.0.0): Unknown (Waiting)
Interface intf3 (0.0.0.0): Unknown (Waiting)
Interface intf2 (0.0.0.0): Unknown (Waiting)
Interface outside (0.0.0.0): Unknown (Waiting)
Interface inside (0.0.0.0): Unknown (Waiting)

show failover命令输出的cable状态可能有如下值:

My side not connected-标志着在使用show failover命令时failover电缆未正确连接。 Normal-标志主从pix都操作正常. Other side is not connected-标志对端未正确连接failover电缆。 Other side powered off-标志对端没开电。

　　在接口IP地址右边的标志有如下类型：

Failed-接口失效. Link Down-接口链路层协议 Normal-正常 Shut Down-该接口被手工停用了（在interfac命令中使用了shutown参数） Unknown-该接口未配置IP地 Waiting-还没有开始监视对端的接口状态。

　　第十一步　使用failover ip address命令声明备用PIX的每一个接口的地址，只需要在主pix上配置，该地址不能和主PIX的地址相当，但每一个接口的地址都可以在同一个子网内。如下例年示：

failover ip address inside 10.1.1.2
failover ip address outside 192.168.1.2
failover ip address intf2 192.168.2.2
failover ip address intf3 192.168.3.2
failover ip address 4th 172.16.1.2

　　配置后，再show failover的输出如下：

show failover
Failover On
Cable status: Other side powered off
Reconnect timeout 0:00:00
Poll frequency 15 seconds
This host: primary - Active
Active time: 510 (sec)
Interface 4th (172.16.1.1): Normal (Waiting)
Interface intf3 (192.168.3.1): Normal (Waiting)
Interface intf2 (192.168.2.1): Normal (Waiting)
Interface outside (192.168.1.1): Normal (Waiting)
Interface inside (10.1.1.1): Normal (Waiting)
Other host: secondary - Standby
Active time: 0 (sec)
Interface 4th (172.16.1.2): Unknown (Waiting)
Interface intf3 (192.168.3.2): Unknown (Waiting)
Interface intf2 (192.168.2.2): Unknown (Waiting)
Interface outside (192.168.1.2): Unknown (Waiting)
Interface inside (10.1.1.2): Unknown (Waiting)

　　第十二步　如果要配置Stateful Failover,使用failover link命令来定义要使用哪一个接口来传输状态信息，在本例中使用4th，命令如下：

　　failover link 4th

　　第十三步　启用Stateful Failover,show failover命令的输出如下：

show failover

Failover On
Cable status: Other side powered off
Reconnect timeout 0:00:00
Poll frequency 15 seconds
This host: primary - Active
Active time: 510 (sec)
Interface 4th (172.16.1.1): Normal (Waiting)
Interface intf3 (192.168.3.1): Normal (Waiting)
Interface intf2 (192.168.2.1): Normal (Waiting)
Interface outside (192.168.1.1): Normal (Waiting)
Interface inside (10.1.1.1): Normal (Waiting)
Other host: secondary - Standby
Active time: 0 (sec)
Interface 4th (172.16.1.2): Unknown (Waiting)
Interface intf3 (192.168.3.2): Unknown (Waiting)
Interface intf2 (192.168.2.2): Unknown (Waiting)
Interface outside (192.168.1.2): Unknown (Waiting)
Interface inside (10.1.1.2): Unknown (Waiting)
Stateful Failover Logical Update Statistics
Link : 4th
Stateful Obj xmit xerr rcv rerr
General 0 0 0 0
sys cmd 0 0 0 0
up time 0 0 0 0
xlate 0 0 0 0
tcp conn 0 0 0 0
udp conn 0 0 0 0
ARP tbl 0 0 0 0
RIP Tbl 0 0 0 0
Logical Update Queue Information
Cur Max Total
Recv Q: 0 0 0
Xmit Q: 0 0 0