It depends.  http://kerneltrap.org/node/5607 gives part of the answer...

-Steve S.

quoted text
> -----Original Message-----
> From: owner-misc@openbsd.org [mailto:owner-misc@openbsd.org] On Behalf
> Of Karsten McMinn
> Sent: Friday, April 25, 2008 7:39 PM
> To: misc@openbsd.org
> Subject: Re: OpenBSD isakmpd and pf vs Cisco PIX or ASA
>
> On Fri, Apr 11, 2008 at 9:13 AM, Matthew Dempsky <matthew@dempsky.org>
> wrote:
> >
...
quoted text
>  I've benchmarked PIX 515s running 7.2 code using stateful
> failover and the proprietary serial cable. Powering down
> the active firewall nets about 700-750ms of downtime consistently.
> How does carp fare?