61-3
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter61 Information About High Availability
Failover and Stateful Failover Links
Failover and Stateful Failover Links
This section describes the failover and the Stateful Failover links, which are dedicated connections
between the two units in a failover configuration. This section includes the following topics:
•Failover Link, page61-3
•Stateful Failover Link, page61-4
•Avoiding Interrupted Failover Links, page61-5

Failover Link

The two units in a failover pair constantly communicate over a failover link to determine the operating
status of each unit. The following information is communicated over the failover link:
•The unit state (active or standby)
•Hello messages (keep-alives)
•Network link status
•MAC address exchange
•Configuration replication and synchronization
Caution All information sent over the failover and Stateful Failover links is sent in clear text unless you secure
the communication with a failover key. If the ASA is used to terminate VPN tunnels, this information
includes any usernames, passwords and preshared keys used for establishing the tunnels. Transmitting
this sensitive data in clear text could pose a significant security risk. We recommend securing the failover
communication with a failover key if you are using the ASA to terminate VPN tunnels.
You can use any unused interface on the device as the failover link; however, you cannot specify an
interface that is currently configured with a name. The failover link interface is not configured as a
normal networking interface; it exists for failover communication only. This interface should only be
used for the failover link (and optionally for the Stateful Failover link).
Connect the failover link in one of the following two ways:
•Using a switch, with no other device on the same network segment (broadcast domain or VLAN) as
the failover interfaces of the ASA.
•Using a crossover Ethernet cable to connect the appliances directly, without the need for an external
switch.
Note When you use a crossover cable for the failover link, if the interface fails, the link is brought down on
both peers. This condition may hamper troubleshooting efforts because you cannot easily determine
which interface failed and caused the link to come down.
Note The ASA supports Auto-MDI/MDIX on its copper Ethernet ports, so you can either use a crossover cable
or a straight-through cable. If you use a straight-through cable, the interface automatically detects the
cable and swaps one of the transmit/receive pairs to MDIX.