walls I'm using for these examples are ASA 5540s with four Gigabit Ethernet interfaces each. I'm using G0/0 and G0/1 in outside and inside roles, and I've assigned interface G0/3 as the stateful failover interface. The description for the failover interface will be added by the system. Outside 10.0.0.0/24 Primary Secondary Failover 192.168.255.0/24 Inside 192.168.1.0/24 Figure 28-12. Sample ASA failover design Each interface must be configured with a failover IP address to be used on the secondary ASA. These commands are entered on the primary ASA. The IP addresses following the standby keyword in the preceding output indicate the failover IP addresses for each interface. No IP address is assigned to the failover interface. To configure the failover interface to be used for stateful failover, use the following commands on the primary ASA: failover lan unit primary failover lan interface Failover GigabitEtherneto/3 failover link Failover GigabitEtherneto/3 failover interface ip Failover 192.168.255.1 255.255.255.0 standby 192.168.255.2 The failover lan interface command makes G0/3 the failover interface. The failover link command makes the interface the stateful failover link. We are using the same interface for both needs, which is supported. You can split them if you want, and you can assign them to VLANs as well. Where possible, I like to dedicate an entire physical interface to failover. To make the connection across a switched network, the failover interface must be con- figured on the secondary ASA as well. In this example, the following commands are needed: failover lan unit secondary failover lan interface Failover GigabitEtherneto/3 failover interface ip Failover 192.168.255.1 255.255.255.0 standby 192.168.255.2 Failover Once failover is successfully configured, enable it with the failover command. If all is well, you should be rewarded with the following output: ASA-5540#failover ASA-5540# Beginning configuration replication: Sending to mate. End Configuration Replication to mate Interfaces that are not 