Table of Contents

Group 2 State: Standby Ready
Active time: 0 (sec)
slot 0: ASA5540 hw/sw rev (2.0/8.0(4)) status (Up Sys)
admin Interface management (192.168.1.1): No Link (Waiting)
GAD-Tech Interface outside (10.10.10.1): Link Down (Waiting)
GAD-Tech Interface inside (0.0.0.0): Link Down (Waiting)
Test Interface outside (10.10.10.21): Link Down (Waiting)
Test Interface inside (0.0.0.0): Link Down (Waiting)
slot 1: empty
Other host: Secondary
Group 1 State: Standby Ready
Active time: 2008 (sec)
Group 2 State: Active
Active time: 2101 (sec)
slot 0: ASA5540 hw/sw rev (2.0/8.0(4)) status (Up Sys)
admin Interface management (0.0.0.0): No Link (Waiting)
GAD-Tech Interface outside (10.10.10.2): Link Down (Waiting)
GAD-Tech Interface inside (0.0.0.0): Link Down (Waiting)
Test Interface outside (10.10.10.20): Link Down (Waiting)
Test Interface inside (0.0.0.0): Link Down (Waiting)
slot 1: empty
Stateful Failover Logical Update Statistics
Link : Unconfigured.
Notice that even though interfaces may be allocated to contexts, their status is not
shown within the group information in the show failover command output. Do not
look at the interface section of the output to get a context’s status. This makes sense if
you think about it. In this case, interface G0/0 is allocated to both the GAD-Tech and
Test contexts, yet GAD-Tech (group 1) is active on the primary ASA and Test (group
2) is active on the secondary ASA. The interfaces are not group-specific, but the contexts
are.
NAT
Network Address Translation (NAT) is technically what Cisco refers to as translating
one IP address to another. The majority of installations, including most home networks,
translate many IP addresses to a single address. This is actually called Port Address
Translation (PAT). PAT has also been called NAT Overload in IOS.
To complicate matters, in the ASA, NAT is used in a number of ways that may not
seem obvious. For example, you may have to use a nat statement to allow packets from
one interface to another, even though they both have public IP addresses and would
normally require no translation.
NAT | 501