topic Re: Firepower HA Design in Network Security

Firepower HA Design

JonMoss61263 — Wed, 03 Feb 2021 16:24:19 GMT

Hi all, i'm looking for some clarification. We have two firepower 1120 which we want to deploy in HA active/standby configuration.

I have been reading up on my options around interface redundancy, and as far as I can tell we cannot operate with redundant interfaces unless we also have the FMC in the solution.

Please see the attached diagram for reference, is there any other way of achieving the design on the right without an FMC?

Thanks

Re: Firepower HA Design

Rob Ingram — Wed, 03 Feb 2021 16:39:40 GMT

Hi @JonMoss61263

Correct, you cannot configured redundant interfaces as of FDM 6.7 without an FMC.

What switches are you connecting the FTD's to? Etherchannel is supported on FDM, so if the switches were VSS, VPC of VSW you could use etherchannel.

Re: Firepower HA Design

balaji.bandi — Wed, 03 Feb 2021 16:51:58 GMT

Most my deployment are using FMC, but reading the document with FDM is feasible, check this out. ( i have not got chance to play wit FDM)

https://docs.defenseorchestrator.com/Configuration_Guides/Firepower_Threat_Defense_High_Availability/0010_Firepower_Threat_Defense_High_Availability_Pair_Requirements

https://www.youtube.com/watch?v=myE8aIgFFeE

Re: Firepower HA Design

JonMoss61263 — Wed, 03 Feb 2021 17:35:09 GMT

Thanks for the reply Rob, switches are Meraki MS series, stack of two - I believe they do support LACP