WEBVTT

1
00:00:00.050 --> 00:00:08.050
We will switch the active Cisco firewall and verify that traffic uses its replacement.

2
00:00:08.150 --> 00:00:16.650
Two firewalls connect the inside and outside networks, with a separate failover link between them.

3
00:00:39.000 --> 00:00:46.500
The primary unit is active, and the secondary unit is ready on standby.

4
00:00:54.200 --> 00:01:02.200
The source can reach one destination, while the selected policy blocks its sibling address.

5
00:01:06.000 --> 00:01:15.000
A standby address is available for management, but it must not act as a transit gateway.

6
00:01:18.550 --> 00:01:26.050
Keep the source route pointed at the active address before requesting the switchover.

7
00:01:33.050 --> 00:01:41.050
On the standby firewall, enter enable, then failover active to make this unit active.

8
00:02:05.850 --> 00:02:15.350
Check both roles and the interface addresses again: the active address now belongs to the secondary unit.

9
00:02:22.000 --> 00:02:30.400
Repeat both traffic checks: the permitted destination answers, and the selected deny remains enforced.

10
00:02:37.150 --> 00:02:46.650
On the secondary unit, enter enable, then no failover active to return traffic to the ready primary.

11
00:03:04.900 --> 00:03:12.400
Verify the roles and both traffic results again after returning the active role.

12
00:03:14.250 --> 00:03:24.850
These checks demonstrate new packet forwarding after a manual switchover; established session replication needs separate verification.