tations, as you'll see). Chapter 28: ASA Firewall Configuration For failover to work, each ASA must be able to reach the other on each interface con- figured for failover. Usually, a pair of switches connects the firewalls. One switch con- nects to each ASA, and the switches are connected to each other, often with trunks. An example of such a design is shown in Figure 28-11. The link that connects the two ASA firewalls directly is the stateful failover link, which should not be switched, if possible. Primary Secondary Figure 28-11. Common ASA failover design Cisco recommends that the switch ports used to connect the ASA firewalls be set to spanning-tree portfast. With normal spanning tree timers, hellos will not be received during the initial tree states. This might cause an ASA to decide that the remote ASA is not responding and to initiate a failover. ASAs can be installed in transparent mode (the normal behavior is called routed mode). In transparent mode, the ASA acts as a bridge. When it's used in this manner, the spanning tree requirements are different. Con- sult the Cisco documentation for more information on transparent mode, or better yet, don't use it at all. When a failover occurs, the standby ASA assumes the IP and MAC addresses of all interfaces configured for failover on the active ASA. This is transparent to the network. Here, you can see the different MAC addresses for int g0/0 before and after I pulled the failover link, causing a failover: ASA-5540/GAD# sho int go/o I inc MAC MAC address 0200.0000.1300, MTU 1500 ASA-5540/GAD# Failover LAN Failed ASA-5540/GAD# sho int go/o I inc MAC MAC address 1200.0000.0c00, MTU 1500 Failover ASA failover works SO well that device failures can go unnoticed. When you're using this feature, it is imperative that the appliances be managed in some way SO that failures can be resolved. I have seen occasions where a primary ASA failed and the secondary ran for months until it, too, failed. When the secondary failed without another ASA to back it up, a complete outag