being configured for failover, use the show version command: PIX# sho version I include Failover Failover: Enabled To be installed as a failover pair, each PIX firewall must have the same PIX software release installed. Each PIX in a failover pair must also have the exact same configura- tion. As a result, the hostname will be the same on both firewalls in the pair. If you attempt to configure the standby firewall, you will receive an error telling you that any changes you make will not be synchronized: PIX# conf t WARNING Configuration Replication is NOT performed from Standby unit to Active unit. Configurations are no longer synchronized. You won't actually be prevented from making the changes, though. I have stared stupidly at this message more times than I can count while making changes after working for 18 hours straight. Failover Terminology When in a failover pair, PIX firewalls are referenced by specific names, depending on their roles: Primary The primary PIX is the firewall on the primary end of the failover cable. This is a physical designation. On FWSMs, or models that do not use the failover cable, the primary PIX is configured manually using the failover lan unit primary command. The primary PIX is usually active when the pair is initialized. Once designated, it does not change. Failover Secondary The secondary PIX is the firewall on the secondary end of the failover cable, and is not usually configured directly, unless the primary PIX fails. This is a physical designation. The secondary PIX is usually the standby when the pair is initialized. Once designated, it does not change. Active The active PIX is the firewall that is inspecting packets. It controls the pair. The active PIX uses the system IP address configured for each interface. This is a logical designation; either the primary or the secondary PIX can be the active Some PIX firewall models now support active/active failover, where both physi- cal firewalls can pass traffic simultaneously. See the Cisco documentation for more information. S