topic Re: FTD HA Packet-Tracer Output in Network Security

FTD HA Packet-Tracer Output

mumbles202 — Wed, 14 Oct 2020 06:03:52 GMT

Working on a pair of 2130s running 6.2.3.12 and setup in HA. Having some issues with traffic passing from 1 interface to another even though the policies look correct. At present the secondary unit is the Active unit in the pair. If i go into advanced troubleshooting on the secondary (Active) unit and go through packet-tracer I get this result:

Result:
input-interface: Inside
input-status: up
input-line-status: up
output-interface: Device_Management
output-status: up
output-line-status: up
Action: drop
Drop-reason: (fo-standby) Dropped by standby unit

However if I run through the same packet-tracer on the primary (now Standby unit) I get this:

Result:
input-interface: Inside
input-status: up
input-line-status: up
output-interface: Device_Management
output-status: up
output-line-status: up
Action: allow

I'll have access to some equipment tomorrow to actually get a packet capture for review but was curious as to why I'm seeing the results I am in packet-tracer. I saw a bug (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf72068/?rfs=iqvred) but that applies to different devices and these units aren't in transparent mode.

Re: FTD HA Packet-Tracer Output

Aref Alsouqi — Wed, 14 Oct 2020 08:14:28 GMT

Never came across this before, but it looks like a bug to me. Based on my experience, the FTD 6.2.3.x is not stable and has a bunch of bugs. I would raise a TAC if upgrading it is not an option.

Re: FTD HA Packet-Tracer Output

Marius Gunnerud — Wed, 14 Oct 2020 09:10:44 GMT

Could you issue show failover on the standby (active) unit just to verify the failover status. Also, Could you check the connected switch ARP table to verify that the standby FTD MAC address has been associated with the Active unit IP.

Also, you say that the bug you posted applies to different devices, which devices do you have installed?

Re: FTD HA Packet-Tracer Output

mumbles202 — Wed, 14 Oct 2020 13:10:55 GMT

Thanks for the reply. Going directly to the FTDs the Primary unit was in fact the Active and the FMC was wrong. Forcing the re-sync corrected the status.