erface outside (10.10.10.1): Link Down (Waiting) GAD-Tech Interface inside (0.0.0.0): Link Down (Waiting) Test Interface outside (10.10.10.21) Link Down (Waiting) Test Interface inside (0.0.0.0) Link Down (Waiting) slot 1: empty Other host: Secondary Group 1 State: Standby Ready Active time: 2008 (sec) Group 2 State: Active Active time: 2101 (sec) slot 0: ASA5540 hw/sw rev (2.0/8.0(4)) status (Up Sys) admin Interface management (0.0.0.0) No Link (Waiting) GAD-Tech Interface outside (10.10.10.2): Link Down (Waiting) GAD-Tech Interface inside (0.0.0.0): Link Down (Waiting) Test Interface outside (10.10.10.20) Link Down (Waiting) Test Interface inside (0.0.0.0): Link Down (Waiting) slot 1: empty Stateful Failover Logical Update Statistics Link : Unconfigured. Notice that even though interfaces may be allocated to contexts, their status is not shown within the group information in the show failover command output. Do not look at the interface section of the output to get a context's status. This makes sense if you think about it. In this case, interface G0/0 is allocated to both the GAD-Tech and Test contexts, yet GAD-Tech (group 1) is active on the primary ASA and Test (group 2) is active on the secondary ASA. The interfaces are not group-specific, but the contexts Network Address Translation (NAT) is technically what Cisco refers to as translating one IP address to another. The majority of installations, including most home networks, translate many IP addresses to a single address. This is actually called Port Address Translation (PAT). PAT has also been called NAT Overload in IOS. To complicate matters, in the ASA, NAT is used in a number of ways that may not seem obvious. For example, you may have to use a nat statement to allow packets from one interface to another, even though they both have public IP addresses and would normally require no translation. NAT Commands A few commands are used to configure the majority of NAT scenarios. Some, such as the nat command, have many options that aren't listed here. The s