A hospital is pairing two Threat Defense appliances in active/standby mode for its network core. The design must keep established TCP and UDP sessions alive through a failover, force a unit switch when the outside uplink fails, and keep heartbeat traffic separate from the replicated session state. Which failover link and trigger design meets all three requirements?

In active and standby failover, the failover link carries the hello packets that prove each unit is alive, so the pair can tell a rebooted box from a healthy one, while the state link carries replicated connection records that let the standby keep serving flows that were already open. Interface monitoring adds a trigger that watches the uplink itself, which matters because a dead external path leaves both units perfectly healthy and still exchanging hellos. A design leaning only on heartbeat loss never notices that external path failing, so production traffic blackholes while the pair reports itself stable. A design that merges heartbeats and session replication onto one link cannot separate control traffic from bulk state when the link saturates, and failover timing suffers. A design that keeps session state local simply drops every established flow at switchover, which defeats stateful failover. Exam caveat: missing hellos over the failover link are a classic trigger, but interface monitoring is what catches a broken uplink. Practical check: open the high availability status for the pair on the Management Center and confirm the outside interface is listed as monitored before you pull a cable.