e occurred. If you're not monitoring your firewalls, your network is not as secure as you might think. Using SNMP with network management software such as Cisco Works or OpenView will keep you apprised of any ASA failover events. Configuring Failover-Active/Standby Both ASAs in a failover pair must have the same major operating system version, or they will not synchronize their configurations. They really should be identical, or un- predictable results may occur. They must be the same models with the same hardware as well. Though failover may still work with minor code differences, having any dif- ferences in your ASAs is not recommended. The ASA will warn you if the code differs in your two ASAs: WARNING WARNING* WARNING Mate version 8.0(4) is not identical with ours 8.0(3) WARNING* WARNING WARNING The first step in configuring failover is to enable the feature with the fai lover command: ASA 5540(config)#failover Each interface we wish to include (usually all of them) needs to have a failover IP address assigned to it. It's a good idea to assign pairs of IP addresses for firewalls when you're designing IP networks, even when installing a single ASA. For example, if the inside IP address on your firewall would normally be 192.168.1.1, reserve 192.168.1.2 as well. This way, if you expand your firewall to include another ASA for failover, the IP address for failover will already be allocated. To illustrate failover configuration, let's build a pair of ASAs to support the network, shown in Figure 28-12. The failover link is connected through a switch or switches, and is not a crossover cable in this example. The interface configuration for the primary ASA is as follows: interface GigabitEtherneto/o nameif outside security-level - 0 ip address 10.0.0.1 255.255.255.0 standby 10.0.0.2 interface GigabitEthernet0/1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2 Chapter 28: ASA Firewall Configuration interface GigabitEtherneto/3 description LAN/STATE Failover Interface! The fire