15-3
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
OL-6392-01
Chapter 15 Using Failover
Understanding Failover
The state information passed to the standby module includes the following data:
–
NAT translation table
–
TCP connection states
–
UDP connection states (for connections lasting at least 15 seconds)
–
HTTP connection states (Optional)
–
H.323, SIP, and MGCP UDP media connections
–
ARP table
–
(Transparent firewall mode only) MAC address table
Failover and State Links
This section describes the failover link and, for stateful failover, the state link, and it includes the
following topics:
• Failover Link, page 15-3
• State Link, page 15-3
Failover Link
The two modules constantly communicate over a failover link to determine the operating status of each
module. Communications over the failover link include the following data:
• The module state (active or standby).
• Hello messages (also sent on all other interfaces).
• Configuration synchronization between the two modules. (See the “Configuration Replication”
section on page 15-10 section for more information.)
The failover link uses a special VLAN interface that you do not configure as a normal networking
interface; rather, it exists only for failover communications. This VLAN should only be used for the
failover link (and optionally for the state link).
For multiple context mode, the failover link resides in the system configuration. This interface (and the
state link, if used) is the only configurable interface in the system configuration.
Note The IP address and MAC address for the failover link do not change at failover.
State Link
To use stateful failover, configure a state link to pass all state information. This link can be the same as
the failover link, but we recommend that you assign a separate VLAN and IP address for the state link.
The state traffic can be large, and performance is improved with separate links.
In multiple context mode, the state link resides in the system configuration. This interface and the
failover interface are the only interfaces in the system configuration.
Note The IP address and MAC address for the state link do not change at failover.