Hello jkay18041,
>> Do I need a secondary IP on all of those interfaces or just on the lan failover?
the two ASA in failover mode requires two IP addresses for each interface. This means you cannot use /30 IP subnets you need at least /29 subnets on each segment.
The configuration is performed on the Active ASA using commands like
interface "LAN"
ip address 172.16.20.1 255.255.255.0 standby 172.16.20.2 255.255.255.0
for each interface.
Edit:
for the state failover I would expect it to use a different interface dedicated to this purpose because it can use a lot of traffic because state failover means synchronization of session data between active and standby ( current flows, current NAT entries) to make the standby able to be operational as soon as possible in case of switchover.
The failover cable should be used only to keep in sync the configuration. This requires far less traffic as only config changes are sent over it and it is used as an heartbeat to know if the other unit is alive.
What ASA model are you using and what SW version ? I guess you are using ASDM GUI to configure it.
Edit 2:
I have seen in another thread that you have opened that you have ASA 5515 with 9.12 SW and ASDM 7.12
see the following chapter from configuration guide about failover config on the CLI
https://www.cisco.com/c/en/us/td/docs/security/asa/asa912/configuration/general/asa-912-general-config/ha-failover.html#ID-2107-00000060
and the corresponding chapter for ASDM 7.12
https://www.cisco.com/c/en/us/td/docs/security/asa/asa912/asdm712/general/asdm-712-general-config/ha-failover.html
I would recommend to use a dedicated link for stateful failover. Connect the two units directly as traffic is sent in clear text over the failover and stateful failover cables.
Hope to help
Giuseppe
