Always use a switch and not a cross over cable. The reason being, what if the port on one unit goes bad? Due to the fact that the two ends are connected via the cross over cable both ends may show down.
When you use a crossover cable for the LAN failover link, if the LAN interface fails, the link is brought down on both peers. This condition may hamper troubleshooting efforts because you cannot easily determine which interface failed and caused the link to come down.
OK - I wouldn't argue against using two switches either.
That does lead back to the point I made about cost though - i.e. there is a big difference between two crossover cables and two switches (with 6 patch cables - 3 for failover and 3 for stateful failover).
You pay more of your money and take your choice.
Seriously though, I agree - two switches would be the best solution.
It will depend entirely on which ASA model you have, how your pair is configured, i.e. active/active with multiple contexts, transparent vs routed, etc. In the simplest configuration, you absolutely can use two switches and the ASA pair for a redundant configuration. You could use two switches, either trunked, or stacked (as in Cat3750/60's). Create a vlan, or use an existing vlan already assigned to your inside network, assign the vlan to a switch port on each switch, and plug your primary ASA into one switch and the secondary into the other. As the switches are trunking, you don't need to worry about the ASA's supporting spanning-tree. however, you can set up an ASA interface as a trunking port, with version 7.2 and higher (I think.) See the configuration guide for details:
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :