Hi Collin,

Thanks for the info, but do you think that the statefull en Lan link are also monitored ? There is certainly no option to monitor them.

And what if switch would fail ? Will both asa's become active ?

You typically attach each ASA to a different switch for full redundancy. The failover link is inherently monitored because that link is where the majority of failover communications occur. If that link fails, then each ASA thinks it's primary.

Assume:

a:

2 ASA connected via 2 failover interfaces in active/standby configuration. The secondary ASA goes down.

What happens ?

b: Same scenario but the primary goes down.

c: They both go down and come back up again,but the secondary is first. How will te switches mac-address tables and the routers handle their arp table ?

a. Nothing really. The primary still thinks it's primary and continues to pass traffic.

b. Once the heartbeat fails (2 times I believe) the secondary becomes primary and starts passing traffic.

c. The ARP tables will be empty because of the ASA outage so when the ASAs come back up, the switch will populate their ARP tables as normal. Since the 2nd ASA comes up first, it will be primary.

but the failover interfaces are monitored, so if I put the threshold on 1 no ASA will be active.

They both think they are active. They both want to be active. The active keeps telling the secondary to 'stand down, I'm in charge right now.' The standby keeps waiting and wanting to be in charge. As soon as it doesn't here from the one in charge, it takes over and assumes the role.