Failover and 3DES

I have a pair of PIX' both are in a failover configuration, works well. However, by default the 3DES is disabled and is a free feature upgrade to the PIX. I was able to activate 3DES on the Active unit but not the rescue unit (in fact I did not receive the e-mail return of Cisco and it's been 6 days now).

My question is, the unit of failover works always with 3DES encryption even if 3DES is not active? What is the license applied to the col of Active primary unit through unity of Eve?

Yes, the unit of failover still works even if it doesn't have 3DES license yet. If a failover occurs and you actually had some features using 3DES, these elements would not work properly on the unit to sleep until that license has been upgraded. For example, if you set VPN connections to complete on your PIX with 3DES encryption. If a failover occurs to your standby PIX, these VPN clients would be unable to negotiate the cryptographic 3DES with the PIX of confirmation due to the absence of a license of 3DES. My guess is that you have added no 3DES device for your primary PIX yet then you're probably OK.

I suggest to drop an email to [email protected] / * / with the S/N of your standby PIX and explaining the situation to them. They should be able to help out you. Good luck.

Scott

Tags: Cisco Security

Similar Questions

  • Type of failover and the difference

    Hello

    I would like to know what are the different type of failover in PIX 515E with 6,3 OS.

    I want all the details of it.

    I am aware of LAN-based failover and failover with cable to failover.

    Why the failover cable is use and it is important.

    can any 1 give me details.

    Kind regards

    Riahi

    Hello

    hope this link helps.

    http://Cisco.com/en/us/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a008017278a.html

    regds

  • The virtual machine failover and restart with vSphere HA time

    Hello

    What factors would affect the time required for vSphere HA to computers failover virtual to a host failed to another active host in the cluster? It would be important how much space drive by using virtual machine is or how big it is? Or who should not matter?

    Thank you

    It should not matter. HA initiates the failover and the powers on the virtual machine regardless of size. Note, however, that there could be a delay in time OS/App.

    Another parameter that can affect the failover time is the number of virtual machines being switched at some point. If you have more healthy hosts in the cluster, then VM failovers happen simultaneously reduce the failover time.

  • After doing a failover and failback - store of data replicated

    So I have a question of the State of the data store where my vms are in fact a table after failover and restore.

    I did a few VMs reocvery failover, and then made a reprotect and definitely failed virtual machines to their original location... Then when I discovered the virtual machines they are running on the original cluster before testing with SRM (as expected)

    what I didn't expect is the data store using the vms system has the prefix "follow" yet.

    I really don't think that the store of data they use is a snapshot, when I did an esxcfg-volume - l, nothing came as far as snapshots.

    So has she not only removed the prefix 'snap' or did I miss something...

    Thank you!!!

    Regarding your point about retrieved data warehouses, they actually aren't all that normal.  During the recovery process, vSphere resignatures LUN and it is this will need the LUN that makes vSphere treat it like a snapshot.  The prefix '-wink', says @memadd, is just the default agreement used by SRM for resigned handling LUN, that they are all in the recovery.  The recommended option to keep the original name works well, I've used it before datacenter migrations.

    These could help.

    VMware KB: Snapshot LUN in ESX and ESXi detection

    http://SearchVMware.TechTarget.com/Tip/Resignaturing-vmfs-volumes-the-forgotten-VMware-SRM-subject

    http://SearchVMware.TechTarget.com/tip/the-mechanics-of-VMware-site-recovery-manager-Resignaturing

  • Failover and Swithover

    Hello

    I need some clarification regarding the manual failover and the digital switchover.

    I know they are all two day before primary role transitions and also passage is in the course of planned tasks. And failover is the one that gets over sudden unexpected events.

    Also tipping can be done at any time.

    Suppose some contingencies, my primary database is down and have no upward. So I need to do a manual failover...

    My question here is, in any case I will do it manually, but why am I doing a failover? I can throw a right of passage?

    Even if I do a failover, if my database is not in the flash back mode, then I need to rebuild a new database pending...

    Why I want to get in trouble by using a failover failover insttead.

    Kind regards

    Mohammed

    If your primary database is down so that you can not make a permutation. As the permutation is launched from the primary database. So in this case, you must do a failover only.

  • Failover and rebuild the eve

    Hello

    To verify if the standby PB works perfectly in case of failure, we go to our database before failover. Swicthover_status replied with swicthover not allowed in elementary school, I decided the procedure below:

    1. judgment of the primary DB.

    2. turn the main eve

    3 perform dml on new primary, when the work is done, the new principal will not be necessary.

    Now my task is, if I'm doing a cold backup of db pending before making primary, can I replace the backup to cold after the task so that it behaves like db Eve as it was before? In this case, I don't need to recreate the standby db.

    Kind regards

    Hello;

    Probably not. You have several questions. This method is likely to worse instead of better. If you want to test failover to bring flashback working on the primaries and the sides of the day before.

    After a failover, you want to retrieve primary school, the old primary as new secondary. Once it is functional, you get two SYNCHRONIZED servers and perform a failover and primary school and the day before are back the way they should be.

    I test short notes here:

    http://www.Visi.com/~mseberg/data_guard/Data_Guard_Failover_Test_using_SQL.PDF

    Update

    What you might consider is the method of cold backup is a false test. This isn't how he'll get into the real world. In my view, that the test should align as closely to what could happen in production as possible.

    Failover is also something you should give a lot of thought to. I have databases where if the power failure is about 5 minutes or less the failover is more trouble and more risk than its worth. I have other where they need to be in place 24/7. Ask yourself if you can make a move to the square. What are your other options? Its great to have a failover plan and be prepared, but less use you it the better I say.

    Best regards

    mseberg

    Published by: mseberg on March 27, 2013 07:15

  • Problem with Oracle fail safe 4.1.1 on W2k8 R2 Cluster Failover and Oracle 11.2.0.4 database

    Hi all

    I'm doing some tests on a Windows 2008 (64-bit) R2 two-node failover Cluster.

    I installed and configured successfully bone and the Failover Cluster feature.

    So I followed Oracle Doc-ID 1916391.1 to perform the installation and configuration of Oracle 11.2.0.4 database and Oracle Fail Safe 4.1.1

    After a successful (via Fail Safe Manager) validation of cluster and group, now I'm trying to validate the stand-alone database, but I'm stuck with this error (output in verbose mode of PowerShell):

    PS C:\Users\demo > Test-OracleClusterAvailableDatabase TESTDB - SysPwd (Read-Host-AsSecureString-Prompt "SYS Password ')-verbose

    SYS password: *.

    DETAILES: FS-10915: NODE1: from verification of autonomous resources TESTDB

    DETAILES: FS-10371: NODE1: run the initialization processing

    DETAILES: FS-10371: NODE2: run the initialization processing

    DETAILES: FS-10372: NODE1: resource owner information collection

    DETAILES: FS-10372: NODE2: resource owner information collection

    DETAILES: FS-10373: NODE1: determine the owner of the TESTDB resource node

    DETAILES: FS-10374: NODE1: collection of cluster information required to perform the specified operation

    DETAILES: FS-10374: NODE2: collection of cluster information required to perform the specified operation

    DETAILES: FS-10375: NODE1: analysis of the cluster information required to perform the specified operation

    DETAILES: FS-10378: NODE1: preparation for the configuration of resource TESTDB

    TH: FS-10349: database TESTDB instance is not alive. You want to stop and restart the database instance?

    Confirmation

    Operation does?

    Running dell' operation sulla "Test-OracleClusterAvailableDatabase' likelihood 'TESTDB '.

    [S] Sì Sì [T] a [N] no [U] tutti a tutti [O] Sospendi [?] Guida (he valore predefinito e "S"):

    DETAILES: FS-10350: from the TESTDB database

    Test-OracleClusterAvailableDatabase: OCIEnvNlsCreate failed


    Riga: 1 car: 1

    + Test-OracleClusterAvailableDatabase - SysPwd TESTDB (Read-Host - AsSecureString - P...)

    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo: DeviceError: (TESTDB:ResourceDatabase) [Test-OracleClusterAvailableDatabase], PowerShell

    Exception

    + FullyQualifiedErrorId: Process, Oracle.FailSafe.PowerShell.TestOracleClusterAvailableDatabase

    Test-OracleClusterAvailableDatabase: FS-10999: an internal programming error

    Riga: 1 car: 1

    + Test-OracleClusterAvailableDatabase - SysPwd TESTDB (Read-Host - AsSecureString - P...)

    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo: DeviceError: (TESTDB:ResourceDatabase) [Test-OracleClusterAvailableDatabase], PowerShell

    Exception

    + FullyQualifiedErrorId: Process, Oracle.FailSafe.PowerShell.TestOracleClusterAvailableDatabase

    Test-OracleClusterAvailableDatabase: FS-10160: impossible to verify the Oracle of standalone TESTDB database

    Riga: 1 car: 1

    + Test-OracleClusterAvailableDatabase - SysPwd TESTDB (Read-Host - AsSecureString - P...)

    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo: DeviceError: (TESTDB:ResourceDatabase) [Test-OracleClusterAvailableDatabase], PowerShell

    Exception

    + FullyQualifiedErrorId: Process, Oracle.FailSafe.PowerShell.TestOracleClusterAvailableDatabase

    Test-OracleClusterAvailableDatabase: FS-10818: provider of resources of the database Oracle failed in preparing for

    treatment for TESTDB resource configuration

    Riga: 1 car: 1

    + Test-OracleClusterAvailableDatabase - SysPwd TESTDB (Read-Host - AsSecureString - P...)

    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo: DeviceError: (TESTDB:ResourceDatabase) [Test-OracleClusterAvailableDatabase], PowerShell

    Exception

    + FullyQualifiedErrorId: Process, Oracle.FailSafe.PowerShell.TestOracleClusterAvailableDatabase

    Test-OracleClusterAvailableDatabase: FS-10890: Oracle Services for MSCS failed during the verifyStandalone operation

    Riga: 1 car: 1

    + Test-OracleClusterAvailableDatabase - SysPwd TESTDB (Read-Host - AsSecureString - P...)

    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo: DeviceError: (TESTDB:ResourceDatabase) [Test-OracleClusterAvailableDatabase], PowerShell

    Exception

    + FullyQualifiedErrorId: Process, Oracle.FailSafe.PowerShell.TestOracleClusterAvailableDatabase

    Attached is the log of the OFS Cluster Dump (no error in my opinion).

    I surfed around but I can't find anything to solve the problem.

    I think something about the language of the (Italian) OS and Oracle NLS settings (AMERICAN. AMERICA), but obviolsly I'm not sure about this.

    Thanks in advance for any suggestion,

    Alessandro

    Message modificato da 1d457339-524e-4aa5-94aa-fd7d1ae98732 updated: attached is also output trace of the fss.

    Hello Alessandro.

    Solution to the issue is:

    Patch 20744940: 4.1.1.1: ORACLE FAIL SAFE VERSION 4.1.1 PATCH SET 1

  • The order of failover and load balancing

    Hello

    I have the following scenario. An ESXi with 4 Gbps vmnic. The questions are:

    (1) if I have a group of ports configured for 'Route based on the original virtual Port code' in the policy of balancing load, and for the same port group I the option button 'Override switch failover command"checked, where I set up 3 of the active adapters vmnic, as well as the other vmic remaining as unused adapter, the ESXi uses the policy that I have configured (in this case 'Route based on the original port code') between the three vmnic load balancing marked as active? Or he uses them in the order that they appear in the section active cards?

    (2) Suppossed, I configured the four physical switch ports in an etherchannel group to use 'Route based on the IP hash' load balancing policy. In this situation, then I configured for a certain group of port to only used two active adapters and two others as unused? In this case, ESXi should balance the load using the method hash IP but only in two active adapters? Or it is a misconfigiuration and I should not configure my nic teaming in this way?

    (3) the official setup guide says "NOTICE on IP requires the physical switch be configured with etherchannel. For all other options, etherchannel must be disabled. ». How can I I configured my virtual network, if I have a few groups of political ports based on the hash of the IP to use load balancing and another uses 'Route based on the original port code. This is the case when I for example have two management ports using the same vSwitch with four vmnic (where they are configured as an Etherchannel in the physical switch). I would port one or several groups for virtual machines that use the IP of the hash method of balancing the load and vmkernel ports por management uses only a single adapter active with no back and as "based on the source port ID" load balancing as best practices said.

    Now, the four vmnic is the same for all traffic. The physical switch ports must be configured in an etherchannel group because certain groups of ports will use the method of IP hash, but others are not. The configuration guide I said SHOULD NOT use etherchannel if I won't use the hash IP method, but I'LL use it, but only in groups of one or more ports.

    Maybe I do not share the same vmnic from this situation.

    Finally, it's a philosophical question. What is the difference between 'The route based on the source port ID' and the 'road based on the source MAC Hash' load balancing policy? What is the purpose of the second? It is assumed that if I had two different MAC address in a virtual machine, it would be because I had two different virtual cards inside the virtual machine, which would be connected to two different port ID in the vSwitch, I can use the first strategy (based on the original port code). In other words, which would be the case where I had the traffic entering the same vSwitch but port ID with different source MAC address, so I should chose the method to distinguish the Source MAC address load balancing traffic?

    Thank you.

    Guido.

    (1) as long as you override vmnic only and don't change the policy for this group of ports, he uses the policy configured at level vSwitch and use the selected interface 3 with this policy

    (2) it should work, I don't think it's a problem for the switch receive packets on a subset of the aggregation. I do not think that Etherchannel is supported (IIRC, it is a Cisco proprietary protocol, VMware only supports LACP passive, which corresponds to the Port channel world Cisco.) Trouble me if I'm wrong!)

    (3) I think that's all right, as I have explained in 2), there is no special negotiations with the consolidation of VMware, the important thing only I know is to configure the port on the side of the switch channel if you decide to use the IP hash (that will lead to important questions)

    4) (self labeled) I think it may differ in some cases individuals, as when the operating system use the same MAC address for both NICs (aggregation in-vm) or if you advertise several MAC address for the same network card (ESX in a VM for example would make for its VM). Such cases differently affect this setting.

    That is the right question, and I'm curious to know if someone wants to develop on it!

  • the backup database must be restored after failover and flashback 11

    I tried a failover with 11g r2 and RAC. Failover worked. I have flashed then return of the database (old primary) according to this http://docs.oracle.com/cd/E11882_01/server.112/e17022/scenarios.htm#i1049997, and now is the archiveurs application again.

    The problem is in the broker, it says this

    DGMGRL> show configuration;
    
    Configuration - DG_Config
    
      Protection Mode: MaxPerformance
      Databases:
        DB11G_STBY - Primary database
        DB11G      - Physical standby database (disabled)
          ORA-16661: the standby database needs to be reinstated
    
    Fast-Start Failover: DISABLED
    
    Configuration Status:
    SUCCESS
    I tried deactivating and reactivating the configuration, but still the same. Any other ideas?

    Here's a link [url http://nikolayivankin.wordpress.com/2012/02/14/dgmgrl-reinstating-ex-primary-to-standby-by-flashback-database-feature/] a demo, your theme

  • failover and failback on the physics of the standby database.

    Hi all

    I use the EE 10.2.0.4.I oracle version have a configuration database and named prim and Everelief. I tried the method of failover. I liquidated low primary eve and convert to the new primary database.


    •Arretez repeat applies.
    Run the following SQL statement on the database waiting for target:
    SQL > ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;
    Standing by applying all the data received to redo.
    In this we give indication to the standby database primary database is no more.

    SQL > ALTER DATABASE RECOVER MANAGED STANDBY DATABASE FINISH;
    Once the order of FINISH is completed, the mode of protection of the primary database is lowered to optimum performance, regardless of its original protection mode. This is done because the new primary can be activated with on a standby
    SQL > select protection_mode, protection_level from database v$
    Level of Protection for the protection Mode
    ——————– ——————–
    PERFORMANCE WITHOUT PROTECTION

    •Check that the standby database target is ready to become a primary database.

    Query column SWITCHOVER_STATUS of the view V$ DATABASE on the database waiting for target.
    •If the physical database ensures the main role.
    SQL > ALTER DATABASE COMMIT to THE MOVE to THE PRIMARY WITH the STOP of the SESSION;
    •Open the new primary database
    SQL > ALTER DATABASE OPEN;
    •At this point the level of protection is passed to Max Performance "Unprotected".
    Circuits the new primary database.



    How can I see this previous situation?

    Hello;

    I can share my test notes (Oracle 11) should work even in 10:

    http://www.Visi.com/~mseberg/Data_Guard_Failover_Test_using_SQL.PDF

    Best regards

    mseberg

  • Failover and LMD

    DB version: 10.2.0.4
    Platform: Solaris 5.10
    NŒUD 2 RAC

    I have two questions on failover operations and

    1. an UPDATE (or any DML as DELETE or INSERT)
    TAF is configured in a node RAC 2 and an UPDATE started Instance1, it has updated 1,000 records and another 1,000 records to go. Instance1 breaks down. This UPDATE statement will continue to Instance2 after failover?



    2. a SELECT statement
    TAF is configured in a node 2 CARS and a SELECT statement is issued in Instance1, he recovered 1,000 records and another 1,000 records to go. Instance1 breaks down. This SELECT statement will continue in Instance2 after failover?

    1.) No. (unless your application responds to the REMINDER and reruns the insert (s).)
    2.) Yes. (Except if the selection is based on session context then it probably won't, since the session context is lost).

    Concerning
    Sebastian

  • Allocation of partition before and after the failover and recovery

    Hello

    I could probably write a test for my question but I thought it would be quicker to ask here first :-)

    Say I have a cluster with 126 storage nodes and the scores of 1891 - so each node has about 65 partitions

    If I lose a partition storage node backup 65 distributed on other members will become primary partitions and some new backups will be created on other nodes. At this point there will also be others dragging walls between the remaining nodes in addition to the creation of backup?

    If I now restore the lost node, it will be allocated a few partitions. These will be the same scores he had originally or is it a random set of partitions, so we get a new round of brewing of the partition? I suspect the answer is that it not necessarily answer scores, he had originally.

    The reason that I ask is that we have a system which, due to certain triggers with some fireworks and association key card support we have two caches on the same node that contain a reference to the same binary value (mapped to other keys). This means that the cache actually takes less space that the size of the units of the two caches beause they both the same reference value. On the other hand, backup partitions will have two copies of the value, and will decide on the amount expected memory.

    -Failover backups become primary and create us backups more if suddenly the primary now uses more memory than the original primary (i.e. it will use the size of the units said it does) so for us a loss of node can result in a larger than normal jump in the use of memory on the remaining nodes, because we have now four copies of the value instead of three.

    If we now have to recover the failed node, there will be some shuffling more partitions. Now, if the node recovered back his original were leaving they would take space ore that they have done it before and the rest of the cluster would be tantamount to the use of memory it had before. If the recovered node gets allocated to the different partitions and then the recovered node will use more memory and other members who now have primary partitions from the failed node will use more space.

    Hopefull everyone can follow that. Basically, I think that, if we lose a node, we will see a bigger jump in memory would be a normal cluster and on the recovery of the node we will always use more memory than we were before because the recovered node did not return the partitions available.

    See you soon,.
    JK

    Jonathan,

    Yes, all your assumptions are fundamentally good (I'm not surprised that you did...). There is no guarantee that partitions move back to the original node if a node comes back again.

    The only thing I could suggest is to "remake" the "artifice of support card' that the partition is transferred or promoted. In the earphone of backingmap you will be able to determine that a new entry is inserted because of the movement of the partition and use it as the signal to make converge the support the cards on a single binary value. You may still temporarily more memory you want, but you would correct as partition movement happens.

    / Christer

  • Several VLANS, 2 WAN - balancing load, Failover, and NAT - Oh my

    I am bashing my head here to try to understand something that is really not as hard as I do must in my opinion.

    I have 3 VLAN (router on a stick configuration) and WAN 2 interfaces on an single router.

    VLAN1-> ISPS1

    VLAN2, VLAN3-> ISP2

    How can I set this up so that VLAN1 uses isps1 as the primary internet connection?

    How can I set this up so that VLAN2 and VLAN3 use ISP2 as their primary internet connection?

    How can I configure it so that VLAN1 will use ISP2 if isps1 fails?

    How can I set this up so that VLAN2, VLAN3 uses isps1 if ISP2 fails?

    I came across problems before with problems due to NAT - when you try to use applets IP SLA and event to simply update the commands route map.  Has not horribly.  So I think I'll send this to the community because I am at a loss and I need to have another set of eyes look at that - if its even something possible using only a single router.

    Hello

    Here's a way you can do:

    VL1_TRAFFIC extended IP access list

    ip permit 192.168.1.0 0.0.0.255 any

    VL23_TRAFFIC extended IP access list

    permit ip 192.168.2.0 0.0.0.255 any

    ip licensing 192.168.3.0 0.0.0.255 any

    ALS IP 1

    8.8.8.8 ICMP echo source s1/0 interface

    frequency 4

    Timeout 2000

    ALS IP 23

    ICMP-echo 8.8.8.8 source s1/1 interface

    frequency 4

    Timeout 2000

    Annex to sla IP 1 start now lives forever

    calendar of sla IP 23 now start life forever

    track 1 ip sla 1

    follow the 23 23 ip sla

    (1) vLan 1---> isps1 (primary), ISP2 (secondary)

    VL1_TRAFFIC allowed 10 route map

    corresponds to the IP VL1_ACL

    set ip x.x.x.x jump following check accessibility track 1 # next hop isps1

    set ip next-hop x.x.x.x # ISP2 next hop

    interface f0/0.1

    NAT IP in

    route VL1_TRAFFIC card intellectual property policy

    (2) vLan 2.3---> ISP2 (primary), isps1 (secondary)

    VL1_TRAFFIC allowed 10 route map

    corresponds to the IP VL23_ACL

    track check accessibility ip x.x.x.x next 23 value next hop #ISP2 hop

    set ip next-hop x.x.x.x # next hop isps1

    interface f0/0.2

    NAT IP in

    route VL23_TRAFFIC card intellectual property policy

    interface f/0.3

    NAT IP in

    route VL23_TRAFFIC card intellectual property policy

    (3) the overload of NAT:

    NAT_VL1 allowed 10 route map

    corresponds to the IP VL1_TRAFFIC

    football game interface s1/0

    NAT_VL23 allowed 10 route map

    corresponds to the IP VL23_TRAFFIC

    match s1/1 interface

    IP nat inside source map route NAT_VL1 interface s1/0 #ISP1

    IP nat inside source map route NAT_VL23 interface s1/1 #ISP2

    Kind regards.

    Alain

    Remember messages useful rate.

  • Best practices with failover and clustering of VMware

    I have 4 servers 3 5.0 and a 5.1

    HA and FT and DRS are 3 Techniques.

    For HA check this http://www.yellow-bricks.com/vmware-high-availability-deepdiv/

    For FT check this http://www.vmware.com/products/datacenter-virtualization/vsphere/fault-tolerance.html

    Refer to this to DRS http://www.vmware.com/files/pdf/VMware-Distributed-Resource-Scheduler-DRS-DS-EN.pdf

  • Oracle RAC - VIP failover and listeners

    I have a question about a 2 node RAC cluster. Tell if the network cable is out of node1 and IP of VIP is reinstalled to node2 appearing on one of the interface cards, the problem is that the listener on Node2 is not listening for connections to the node1-vip ip address, it is only listening for connection on its own address of node2-vip. This makes me wonder about to change the ip address if there is nothing on Node2 to listen connections to it. No explanation for this would be appreciated.

    Published by: alanrw on Sep 4, 2008 14:47

    Failure on VIP does not service requests. He just quickly rejects requests so that the client does not need to wait for a TCP timeout.
    Once demand for the vip failed is rejected the client will try another address.

Maybe you are looking for