tandby The standby PIX is the firewall that is not inspecting packets. It uses the failover IP address configured for each interface. Should the active PIX fail, the standby PIX will take over and become active. This is a logical designation; either the primary or the secondary PIX can be the standby PIX. Stateful failover When the active PIX fails, and the standby PIX takes over, by default, all conver- sations that were active through the active PIX at the time of the failure are lost. To prevent these connections from being lost, a dedicated Ethernet link between the active and standby PIX firewalls can be used to exchange the state of each conversation. With stateful failover configured, the standby PIX is constantly updated SO that no connections are lost when a failover occurs. Understanding Failover The primary and secondary PIX communicate over the failover cable or the config- ured failover interface. The failover cable is a modified RS232 cable that connects the two PIX firewalls together. In PIX software release 6.2, failover can be configured without a failover cable. Ethernet can be used instead to overcome the distance limitations of the failover cable. Each PIX monitors the failover, power, and interface status of the other PIX. At regular intervals, each PIX sends a hello across the failover cable and each active interface. If a hello is not received on an interface on either PIX for two consecutive intervals, the PIX puts that interface into testing mode. If the standby PIX does not receive a hello from the active PIX on the failover cable for two consecutive intervals, the standby PIX initiates a failover. Chapter 26: PIX Firewall Configuration The PIX platform is very flexible, SO I won't cover all possible failover scenarios here. The underlying principles are the same for them all: if one PIX determines that the other is unavailable, it assumes that PIX has failed. For failover to work, each PIX must be able to reach the other on each interface con- figured for failover. Usually, a pair of sw