The PIX can detect several types of failovers. One mechanism it uses is the hello message. This message is sent every 3 “15 seconds out every interface to test communication. The default is 15 seconds, but it can be changed with the firewall poll command.
If a firewall unit doesn't see a hello message in two updates (30 seconds), both firewalls start to initiate failover tests to determine and confirm which of the firewalls has failed. If the primary is confirmed down, the standby moves into the active role; if the secondary firewall has failed, the primary continues to operate with no failover.
Causes for Failovers
Failovers occur for many reasons. When a failover does occur, both firewalls work together to promote the standby firewall to the active state if possible. If the primary firewall detects an interface going down, it tells the secondary to move into the active state. On the other hand, the secondary promotes itself if it notices that the primary is offline. The following events cause failovers:
When using the serial cable as the failover link between the firewalls, power off detection can take place. If the primary firewall's power is turned off, the secondary firewall starts to promote itself to active state within 15 seconds. If a LAN-based cable is used, the power failure cannot be detected .
The Four Interface Tests
The PIX firewall issues four tests to determine whether the active firewall is truly faulty before promoting the secondary to active. As stated previously, hello messages are sent to detect interfaces on the opposite firewall. If two messages are missed, a series of tests is initiated to probe more deeply and help justify a failover. Table 11.3 explains the failover tests.
Table 11.3. Four Failover Tests
During the testing, if any valid frames are received from the other PIX, the testing is aborted and the systems are deemed operational. The results of each test are passed back and forth between the primary and secondary firewalls to determine which firewall is operational. For example, the primary might determine that the secondary interfaces are down and thus not promote the secondary firewall to the active state.
When a firewall is deemed as failed, it disables all its network interfaces. However, every 15 seconds the failed PIX tries to test all the interfaces and automatically moves into the standby state. If problems still exist, it fails again.
To manually move the failed firewall back into the standby state, the failover reset command can be issued. For example, if Jack unplugs an interface, the PIX moves into the failed state. After Jack plugs the interface back in, the PIX automatically moves into the standby state in 15 seconds, as long as everything else is functioning correctly. Or Jack could issue the failover reset command if he doesn't want to wait 15 seconds. If a problem still exists after the command has been issued, the PIX again moves into the failed state.