In active/active failover mode, both the primary and secondary ASAs can contain active contexts. Standby A standby ASA or context is one that is not inspecting packets. It uses the failover IP address configured for each interface. Should the active ASA or context fail, the standby ASA or context will take over and become active. This is a logical desig- nation; either the primary or the secondary ASA can be the standby ASA or contain standby contexts. In active/active failover mode, both the primary and secondary ASA can contain standby contexts. Stateful failover When an active ASA or context fails and the standby ASA or context takes over, by default, all conversations that were active through the active side at the time of the failure are lost. To prevent these connections from being lost, you can use a dedicated Ethernet link between the active and standby ASAs to exchange the state of each conversation. With stateful failover configured, the standby ASA or context is constantly updated SO that no connections are lost when a failover occurs. Understanding Failover The primary and secondary ASAs communicate over the configured failover interface. ASAs do not support a serial failover cable like PIX firewalls do. Each ASA monitors the failover, power, and interface status of the other ASA. At regular intervals, each ASA sends a hello across the failover link and each active interface. If a hello is not received on an interface on either ASA for two consecutive intervals, the ASA puts that interface into testing mode. If the standby ASA does not receive a hello from the active ASA on the failover link for two consecutive intervals, the standby ASA initiates a failover. The ASA platform is very flexible, SO I won't cover all possible failover scenarios here. The underlying principles are the same for them all: if one ASA determines that the other is unavailable, it assumes that ASA has failed. In multicontext mode, the same idea applies, but failure can be contained within a single context (within certain limi- 