all Figure 28-14. Activelactive failover in my dreams This is not how active/active mode works with ASAs. For an ASA to be configured in active/active mode, it must first be placed in multicontext mode. The reason for this is that some contexts can be active on one side and some can be active on the other side. You cannot configure a multicontext ASA to have all contexts active on both sides. In fact, you cannot configure an ASA to have any contexts active on both sides. Active/active failover means that some contexts are active on the primary ASA, and some are active on the standby ASA. Think of it more like the setup shown in Fig- ure 28-15. Primary ASA Firewall Secondary ASA Firewall Figure 28-15. The reality of active/active failover Chapter 28: ASA Firewall Configuration Be careful of this method of operation, as it carries with it some pretty severe caveats. For example, if you execute the command write standby on the primary ASA's system context (assuming the admin context is active on the primary side), contexts that are in the active state on the standby ASA will have all of their connections broken. Here is the Cisco documentation snippet for this limitation: If you enter the write standby command in the system execution space, the system con- figuration and the configurations for all of the security contexts on the adaptive security appliance [are] written to the peer unit. This includes configuration information for se- curity contexts that are in the standby state. You must enter the command in the system execution space on the unit that has failover group 1 in the active state. Note If there are security contexts in the active state on the peer unit, the write standby command causes active connections through those contexts to be terminated. Use the failover active command on the unit providing the configuration to make sure all contexts are active on that unit before entering the write standby command. If you enter the write standby command in a security context, only the configuration for the secu