er failover group configuration polltime Configure failover interface polling interval preempt Allow preemption of lower priority active unit primary Primary unit has higher priority replication Configure the replication option secondary Secondary unit has higher priority The default behavior for a group is to be primary, SO if you issue the primary command, it will not show up in the configuration. Call me crazy, but I like the primary group to be group 1 and the secondary group to be group 2: ASA 5540 (config)# failover group 1 -5540(config-fover-group) primary ASA-5540(config-fover-group)# preempt ASA-5540(config-fover-group)# exit SA-5540(config)# failover group 2 SA-5540(config-fover-group)# secondary ASA-5540(config-fover-group)# exit Once the groups are created, configure the contexts SO they fall into one of the two groups with the join-failover-group group# context command. In this case, any con- text configured into group 1 will be active on the primary ASA, and any context con- figured into group 2 will be active on the secondary ASA: context GAD-Tech join-failover-group 1 context Test join-failover-group 2 You can show the status of failover for all contexts from the system context with the show failover command. Be careful with this command, because the output can be confusing. The group-specific information is in bold: ASA-5540# sho failover Failover On Failover unit Primary Failover LAN Interface: Failover GigabitEtherneto/3 (up) Unit Poll frequency 1 seconds, holdtime 15 seconds Interface Poll frequency 5 seconds, holdtime 25 seconds Interface Policy 1 Monitored Interfaces 5 of 250 maximum Version: Ours 8.0(4), Mate 8.0(4) Group 1 last failover at: 07:33:09 UTC Jun 29 2010 Group 2 last failover at: 07:32:57 UTC Jun 29 2010 This host: Primary Group 1 State: Active Active time: 92 (sec) Chapter 28: ASA Firewall Configuration Group 2 State: Standby Ready Active time: 0 (sec) slot 0: ASA5540 hw/sw rev (2.0/8.0(4)) status (Up Sys) admin Interface management (192.168.1.1): No Link (Waiting) GAD-Tech Int