Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We need to replace a hardware firewall (cisco pix) and have a spare that we will use (temporarily). The firewall sits in front of a couple of web-servers colocated at a data-centre.

The replacement will be configured with identical settings (external/internal IP addresses, configured ports etc.).

When we swap the firewalls over, will this work immediately or will the old Pix's mac address be cached and the new firewall not be seen until the cache is cleared? (What is it though that is caching the address? Is it just the switch/router that our pix is connected to?)

Reason for asking is a few years ago I had a smoothwall firewall in front of a lone server (the external IP of the smoothwall was also the external IP of the web-server). When I replaced the smoothwall with a pix, the IP address of the web-server stayed the same but it now had to be reached via the new firewall on a different IP. It took about 2-4 hours before the rest of the world could see that web-server again. I'm hoping for less downtime this time!

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Mac address are indeed cached, but the lifetime of an entry is quite short (few minutes).

I think that when you changed the smoothwall by a pix, it took some time more because of some dns caching that arp caching.

As you're not changing IPs on your setup, it should work without any delay.

share|improve this answer
    
I don't think it was DNS caching when we replaced the smoothwall because if I remember rightly accessing the IP address wasn't working –  Dan Jan 2 '11 at 9:43
    
But this time the swapout was fine... once we made sure the pix's were cabled correctly. –  Dan Jan 2 '11 at 9:43

Have your hosting company clear the arp cache.

share|improve this answer
    
We checked but the mac addresses weren't present in the cache. –  Dan Jan 2 '11 at 9:46

Both, it is cached AND it has a protocol that makes sure it will be recognized pretty much immediately. The firewall will run some announcements via ARP protocol on every port "coming up".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.