As the virtual wire is essentially connecting these two VLANs together, did you use crossover cables cables on one of the sides from PA to the switch? As fixing the port speed/duplex disables Auto-MDIX... I need to do this for a similar scenario, but I have a Cisco router one side and a Cisco ASA on the other. Without the isolate VLAN the ASAs fail to form a resilient pair as with the ASA directly cabled to the PAN the standby ASA has one of its interfaces link-down so the Secondary is shown as failed. So I will have:- ASA <---> Isolate VLAN <---> PAN Untrust <-> PAN Trust <-x-> Data Centre VLAN <---> Router This is so I can have the PAN in the traffic path performing web-filtering etc but use the ASA for L3 functions. I have valid reasons for this topology, testing the failover of both the ASA and PAN independantly should be interesting! Cheers
... View more