THe pix does not synchronize RSA keys. To ssh to the secondary Pix, you'll need to login into it, generate a key, and use [ca save all]. Of course, the secondary will complain when you enter config mode, but it's okay. Simply exit out and use the [write standby] again from the primary.
When failover occurs and traffic isn't passing, what does [show fail] give you?
The code you're running is over 2 years old. The failover features of the Pix have been one of the most problematic. At least upgrade to the GD version in your train 5.2(9). Personally, I don't like to touch anything below 6.x.
I had observed this problem before where the firewalls are on two different switches. Remember that the MAC address of the forwarding pix always stays the same regardless of which is Active. Switches learn and cache this MAC. If the firewalls failover but the port of the former Active firewall is still up, the switch has no reason to purge and relearn the MAC until the aging timer expires. This varies across platforms but is 300 seconds for the Catalyst. Try logging into your switches and clearing the CAM when the problem occurs. CatOS would use "clear cam dynamic" and IOS would use "clear mac-address-table". This will explain why traffic passes but not why they fail back and forth.
Do the switch ports connecting the switches and the ports for the firewall show error free? All should be locked down on both ends to full-duplex. This is a frequent source of errors. Also, enable portfast for the switch ports connected to the Pixs.
