topic Re: Firepower 2100 HA differences Active/Active vs Active/Passive in Network Security

Firepower 2100 HA differences Active/Active vs Active/Passive

jfigueroa8 — Fri, 21 Feb 2020 14:59:43 GMT

I'm about to implement two Firepower 2100 on my company. I would like to know about the differences about HA Schemes, Is there any services that can work differently on each scheme? which one is the most recommended and why?

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

andre.ortega — Thu, 21 Dec 2017 18:33:46 GMT

Hi jfigueroa8,

In general I don't see necessity to use Active/Active.
Active/Standby works pretty well, and it is simpler to implement/operate.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

mmassa — Thu, 07 Feb 2019 14:01:16 GMT

Hey ¿whats about the IPS licences? ¿We need to buy two licences (one for each 2100) or only one for the active device?

Thanks a lot

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

andre.ortega — Thu, 07 Feb 2019 14:19:15 GMT

From IPS point of view both are active (ready to forward traffic), so you will need two licenses independently of your deploy (active/active, active/standby).

I hope Cisco change it soon... but for now you need two licenses.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Marvin Rhoads — Fri, 08 Feb 2019 03:06:35 GMT

The Firepower appliances running FTD there is no Active/Active HA per se since that was a construct from ASA software that relied on multiple contexts. Straight HA on FTD uses an Active/Standby scheme.

You can run a 2-unit cluster which is sort of like Active-Active but very few customers bother to do that.

In any case, separate licenses (IPS subscription, URL Filtering and or Malware (AMP)) are required for each physical appliance.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

osmankhawaja2 — Thu, 30 May 2019 19:06:09 GMT

Hi Marvin,

How can you configure this?

'You can run a 2-unit cluster which is sort of like Active-Active but very few customers bother to do that.' Is this supported on the 2100?

Thanks

Osman

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Marvin Rhoads — Fri, 31 May 2019 01:16:25 GMT

Clustering for FTD is currently (as of release 6.4) only supported on the 4100 and 9300 series appliances.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/clustering_for_the_firepower_threat_defense.html#reference_tqc_31t_r2b

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

osmankhawaja2 — Fri, 31 May 2019 08:03:20 GMT

So is there currently no way to have an active/active set up with FTD?

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Marvin Rhoads — Fri, 31 May 2019 12:09:46 GMT

This is not currently possible if you have 2100 series appliances.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Filip Po — Fri, 03 Apr 2020 13:31:00 GMT

No solution till now. So in Active/Standy on FPR2120 and I have to buy 2 TAMC licences.

I am sorry, for that purpose there is a demand to have active/active or to by second HA lic. for nothing.

That is a solution.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

dijeshkeloth — Fri, 26 Jun 2020 09:04:43 GMT

Hi, is it still the case that 2130 FTD does not support active/active scenario?

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Marvin Rhoads — Fri, 26 Jun 2020 10:39:50 GMT

It does not. (And there are no near term plans to change that.)

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

dijeshkeloth — Sat, 27 Jun 2020 06:25:24 GMT

Thanks for your help Marvin

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

joshua.ellison@perficient.com — Thu, 15 Apr 2021 15:36:23 GMT

I am having an issue with 2120, when I create an HA the secondary also comes up active. Is there a way to resolve this?

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Marvin Rhoads — Fri, 16 Apr 2021 19:39:52 GMT

Joshua,

Please share the output of "show failover" and "show failover history" from both devices.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Syed Farhan Ali — Thu, 11 Nov 2021 06:21:16 GMT

Hi Marvin,

I have a customer having Two ISP links which he needs to terminate on the FPR21xx Firewall. He needs to have both the links work actively since both carry different network traffic. Does the Cisco Firewpower 21xx Series support this functionality ?

Regards,

Farhan.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

jiami — Mon, 22 Aug 2022 05:22:13 GMT

Pleease what does 2-unit cluster means? how to achieving 2-unit clustering? Please any link may refer to 2-unit clustering.

Thank you for your advise.

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

Marvin Rhoads — Mon, 22 Aug 2022 08:10:42 GMT

@jiami A link was already provided earlier in this thread.

Version 7.2 has added clustering for the new 3100 series but is otherwise very similar to what was described for 6.4. Reference:

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/device-ops-cluster-sec-fw-3100.html

Re: Firepower 2100 HA differences Active/Active vs Active/Passive

jiami — Tue, 30 Aug 2022 10:19:36 GMT

Hi Marvin

Thank you so much for your information. Get❤

Regards

Jia