in use should always be placed in the shutdown state when employing ASA failover. Interfaces that are active but not cabled can trigger a failover, as the ASA will try unsuccessfully to contact the failover address if one was previously configured. Monitoring Failover The primary means of showing failover status is the show failover command: ASA-5540# sho failover Failover On Failover unit Primary Failover LAN Interface: Failover GigabitEtherneto/3 (up) Unit Poll frequency 1 seconds, holdtime 15 seconds Interface Poll frequency 5 seconds, holdtime 25 seconds Interface Policy 1 Monitored Interfaces 2 of 250 maximum Version: Ours 8. .0(4), Mate 8.0(4) Last Failover at: 14:07:24 UTC Aug 17 2010 This host: Primary - Active Active time: 1313 (sec) slot 0: ASA5540 hw/sw rev (2.0/8.0(4)) status (Up Sys) Interface outside (10.0.0.1): Link Down (Waiting) Interface inside (192.168.1.1) Link Down (Waiting) slot 1: empty Other host: Secondary - Standby Ready Active time: 457 (sec) slot 0: ASA5540 hw/sw rev (2.0/8.0(4)) status (Up Sys) Interface outside (10.0.0.2): Link Down (Waiting) Interface inside (192.168.1.2): Link Down (Waiting) slot 1: empty Stateful Failover Logical Update Statistics Failover GigabitEtherneto/3 (up) Stateful Obj General sys cmd up time RPC services TCP conn UDP conn ARP tbl Xlate Timeout VPN IKE upd VPN IPSEC upd Chapter 28: ASA Firewall Configuration VPN CTCP upd VPN SDI upd VPN DHCP upd SIP Session Logical Update Queue Information Total Recv Q: Xmit Q: This command shows you the state of both firewalls in the pair, as well as statistics for the stateful failover link. If this link is incrementing errors, you may lose connections during a failover. Remember that with stateful failover active, you may experience a failover without knowing it. This command will show you if your primary ASA has failed. If the primary ASA is the standby ASA, the original primary has failed at some point: ASA-5540# sho failover I inc host This host: Primary - Standby Ready Other host: Secondary - Active If the active ASA