The two units are running in active/passive, meaning the secondary unit is *only* listening to the heartbeat traffic and taking config replication.
You will not be able to access the secondary unit at all unless it fails over and becomes the primary, at which point it assumes the same IP's, MACs, etc. That means no SNMP, no ICMP, no ssh... If you use the OIDs from the ASA MIBs, you can actually collect statistics from the secondary unit off the primary (at a minimum -- is it up, is it actively behaving as secondary, etc).
Even though you put a secondary IP and such on the passive unit, it won't actually take any traffic on those layer 3 interfaces as it is not really active.
When failover occurs (ie, the primary fails to respond to 3 heartbeats on the failover link), the secondary will ARP the virtual MAC addresses that were active on the primary unit before it failed. You then have some ARP convergence required on the network for traffic to flow effectively. Something neat to know -- if the secondary unit comes up before your first unit, it will use the burned-in local MAC addresses on the interfaces for the virtual MACs, and will replace them once it learns the virtuals from the primary when it comes back up.
