For the Pix or any other ipsec device to achieve statefull failover of the IPSec session would mean that they would have to share either the Session keys or the Diffie-hellman seed values. These are at the center of the ipsec algorithm and must be protected at all costs. If they share any of these values and they get compromised, the data can then be decrypted. I would rather give up statefull failover of the IPSec session than risk compromising the confidentiality of the data. Use Ike keep-alives, at least you will get fail-over, albiet not statefull.
Just my two cents worth.
