Hello Joel, You're hitting the following known cosmetic defect: http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtq96332 You can either wait until the next maintenance release or open a TAC case to obtain the interim image that would contain the fix. Andrew ... View more

Hello Chiara, The outcome depends on the interface health information exchange. The peers exchange the lists of their data interfaces and the results of failover interface monitoring. If standby has more "healthy" (as determined by failover interface monitoring) interfaces, it becomes active while the active transitions to standby. In case of a tie, both peers retain their previous states. In any case, failover gets disabled after this one time exchange and until the failover control communication is restored. Andrew ... View more

Hello, ASA failover operation critically depends on the failover control link. When failover control communication is interrupted, the ASA will attempt to exchange data interface status with its failover peer over all of the available interfaces. If such communication cannot be established (i.e. there is not a single data interfaces which the failover peers can communicate on), the ASA will transition to the active state. Hence, you will likely end up with a dual-active situation in the first scenario (again, provided that no communication between the ASAs is possible). In the second scenario, the ASAs should be able to exhange interface monitoring information over an available data interface and gracefully settle the condition without going dual-active. Andrew ... View more

Hello Patrick, In ASA 8.3 and later software, you should be able to terminate an L2L tunnel with IPv6 outside addressing and pass IPv4 traffic through it. Here are the currently supported scenarios: http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_site2site.html#wp1055829 Hope this helps. Andrew ... View more