 with stateful failover active, you may experience a failover without knowing it. This command will show you if your primary PIX has failed. If the primary PIX is the standby PIX, the original primary has failed at some point: PIX ((config)# sho failover I include host This host: Primary - Standby Other host: Secondary - Active If the active PIX fails, the standby PIX takes over. If the failed PIX comes back online, it does not automatically resume its role as the active PIX. Cisco's documentation states that there is "no reason to switch active and standby roles" in this circum- stance. While I would have preferred a preempt ability similar to that used in HSRP, unfortunately, Cisco didn't invite me to write the failover code. Chapter 26: PIX Firewall Configuration To force a standby PIX to become active, issue the no failover active command on the active PIX, or the failover active command on the standby PIX: PIX(config)# failover active 104001: (Primary) Switching to ACTIVE - set by the CI config cmd. Assuming a successful failover, the primary PIX should now be the active PIX once again. When you force a failover, don't be impatient about checking the status. The CLI will pause for a few seconds (exactly how long depends on the model of PIX in use), and if you check the status too soon, you may see some odd results: 'IX(config)# sho failover I include host This host: Primary - Active Other host: Secondary - Active If you see this after initiating a failover, take a deep breath, wait a second or two more, and try again: X(config)# sho failover I include host This host: Primary - Active Other host: Secondary - Standby Version 7.0 and later releases of the PIX os can be configured in an active/active state. This is an advanced topic not covered in this book. Network Address Translation (NAT) is technically what Cisco refers to as translating one IP address to another. The majority of installations, including most home net- works, translate many IP addresses to a single address. This is actually called Port Addre