apprised of PIX firewall failover events. Configuring Failover Both PIX firewalls in a failover pair must have the same operating system version, or they will not synchronize their configurations. They should be the same models with the same hardware as well. The first step in configuring failover is to enable the feature with the failover command: PIX(config)# failover Each interface you wish to include (usually all of them) needs to have a failover IP address assigned to it. It's a good idea to assign pairs of IP addresses for firewalls when designing IP networks, even when you're only installing a single PIX. For example, if the inside IP address on your firewall would normally be 192.168.1.1, reserve 192.168.1.2 as well. This way, if you expand your firewall to include another PIX for failover, the IP address for failover will already be there. To illustrate failover configuration, in this section, I'll build a pair of PIX firewalls to support the network shown in Figure 26-4. Outside 10.0.0.0/24 Primary Secondary Failover 192.168.255.0/24 Inside 192.168.1.0/24 Figure 26-4. Sample PIX failover design Chapter 26: PIX Firewall Configuration The interface configuration for the primary PIX is as follows: nameif etherneto outside security0 nameif ethernet1 inside security100 nameif ethernet2 intf2 security4 nameif ethernet3 intf3 security6 nameif ethernet4 intf4 security8 nameif ethernet5 Failover security0 ip address outside 10.0.0.1 255.255.255.0 ip address inside 192.168.1.1 255.255.255.0 no ip address intf2 no ip address intf3 no ip address intf4 ip address Failover 192.168.255.1 255.255.255.0 The firewalls I'm using for these examples are PIX 515s with six Ethernet interfaces each. There are two onboard interfaces (EO and E1), and a four-port interface card (E2-E5). I'm using E0 and E1 in their default outside and inside roles, and I've assigned interface E5 as the stateful failover interface. Each interface must be configured with a failover IP address to be used on the sec- ondary PIX. These commands are en