topic BGP in cluster FTD in Network Security

BGP in cluster FTD

DavideRanalli76560 — Fri, 05 Feb 2021 17:34:23 GMT

Hi all, shortly have to RUN BGP a couple of FTD 4115 in HA, managed by a 1600 FMC, it's all on premises. I was wondering about the BGP sessions if they have to be established according to which of the following cases:

1) one router peers with both active and passive FTD.

2) router peering is as per image below

3) router peering is as per image below

Any insight would be very much appreciated

Davide

Re: BGP in cluster FTD

Rob Ingram — Fri, 05 Feb 2021 17:41:36 GMT

Hi @DavideRanalli76560

Option 3 would be correct.

Only the Active unit listens on TCP port 179 for BGP connections from peers. The Standby unit does not participate in BGP peering, and hence does not listen on TCP port 179 and does not maintain the BGP tables. BGP route additions and deletions are replicated from the Active to the Standby unit. Upon failover, the new Active unit listens on TCP port 179 and initiates the BGP adjacency establishment with peers.

Re: BGP in cluster FTD

DavideRanalli76560 — Fri, 05 Feb 2021 18:32:16 GMT

from this documentation (Page 38) looks like is not like this

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/BRKSEC-3032.pdf

Each member forms independent adjacencies in Individual mode
• Same protocols as in Spanned Etherchannel, but multicast data is centralized
• Higher overall processing impact from maintaining separate routing tables
• Slower external convergence on any member failure

Re: BGP in cluster FTD

Rob Ingram — Fri, 05 Feb 2021 18:51:48 GMT

Sorry I assumed when you meant HA that you were referring to Active/Standby, not clustering.

In which case each FTD member establishes adjacencies, as you've noted from that CL doc.

Re: BGP in cluster FTD

DavideRanalli76560 — Fri, 05 Feb 2021 19:05:42 GMT

My bad, I didn't get the document right, actually I should apologize, I am doing HA, your first answer answered perfectly what I first asked.

Thanks very much for your precious help

Davide