A logistics firm is pairing two identical Secure Firewall Threat Defense appliances in active and standby roles at its data center edge. Failover and state traffic must stay off the production links, established sessions must survive a switch, and the standby must take over when the active appliance dies or a monitored WAN port fails. Which active and standby failover design meets those requirements?

A dedicated failover link carries the hello messages that prove each unit is alive plus the replicated session and NAT state the standby needs, so a switchover hands over an existing connection table instead of an empty one. Switching happens at two levels: the pair takes over when the active unit stops answering hellos, and it also switches when a monitored data interface on the active unit fails past its threshold, which covers a healthy appliance with a dead WAN path. A link described as carrying only hellos and configuration sync leaves out the replicated connection state, so session continuity is lost and the standby must rebuild every flow from scratch. Carrying hello and state traffic over an inside data interface mixes failover packets with production traffic, so it fails the requirement to keep that traffic off the production links. Appliance failure as the only trigger is the unit-only detection model, and it ignores a port failure that leaves the box running while the uplink is dead. Exam caveat: a failover link that fails during operation is marked as failed rather than causing a switch, so link loss by itself is not a trigger. Practical check: run show failover from the diagnostic CLI on both units and confirm the failover, state and monitored interfaces before you pull a cable.