Hi There

it appearred to be a routing issue, the firewalls were using eigrp to the next hop, I install a static route on them and this fixed the issue.

Carl

Hello Carl

You are right, and just to backup your answer, here is the information about stateful failover, it says that no routing table information will be passed to the secondary unit,

The information that is not passed to the standby unit when stateful       failover is enabled includes these:

• The HTTP connection table (unless HTTP replication is           enabled)

• The user authentication (uauth) table

• The routing tables

• State information for security service           modules

That would also cause extra delay when doing failover as the routing protocol would need to re-calculate the routes in order to populate the routing table

Here is the document in case you need it

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml#statef

Thanks and I am glad that you were able to solve it.

Cheers.

Mike