When two firewalls are interconnected for failover, replication of the RAM configuration file ( running config ) occurs, keeping the standby firewall in sync with the primary firewall. The following lists the methods by which the primary replicates its running configuration file across to the secondary firewall:
One important item to note is that replication sends only the running configuration to the standby's RAM; the startup configuration is not sent to flash. Therefore, to save configuration on the standby to flash, you must issue the write memory command. Replication of Stateful FailoverIn non-stateful failover configuration, only one cable is used to replicate the running configuration file. Conversely, in stateful failover, two cables are necessary ”one for the normal running configuration file replication and another for the xlate table and other such stateful information. The following is a list of what is replicated across in a stateful failover configuration:
However, not all stateful information is sent across. This list of items is not replicated and, as such, is lost when failover occurs:
Lastly, the following list shows what is sent across the serial or LAN-based failover cables:
Together both cables help keep the firewall in sync to provide failover fault tolerance. |