topic Re: FTD high availability Standby failed in Network Security

FTD high availability Standby failed

Vishnu_RR — Fri, 05 Feb 2021 17:55:04 GMT

Hi team,

The FMC is generating the alert like below.

SECONDARY (xxxxxxxx) FAILOVER_STATE_STANDBY_FAILED (Check peer event for reason)

Both FTD 9300 are in HA over a port-channel. I have checked both port-channel physical interfaces are in matching the configuration.

The FTD1 is active and FTD2 is standby. when i checked in FTD chassis manager about HA-ROLE are as per expectations.

FTD1 Image

FTD2 image

Please help me to fix this issue.

Re: FTD high availability Standby failed

balaji.bandi — Fri, 05 Feb 2021 18:28:29 GMT

Do you see any Service effect, if yes, raise TAC case immediate responce to fix.

If not Service effected, please provide version of FTD code running along with below output form both the kits :

show failover
show failover history [ details]
show failover state
show failover statistics
show monitor-interface

Re: FTD high availability Standby failed

Marvin Rhoads — Fri, 05 Feb 2021 18:31:27 GMT

Start by checking from the FTD cli "show failover history detail".

Re: FTD high availability Standby failed

Vishnu_RR — Fri, 05 Feb 2021 19:10:03 GMT

Hi,

Please find the below config

Active FTD1

> show failover
Failover On
Failover unit Primary
Failover LAN Interface: Failover Port-channel12 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 7 of 1041 maximum
MAC Address Move Notification Interval not set
failover replication http
Version: Ours 9.12(2)33, Mate 9.12(2)33
Serial Number: Ours xxxxxxxx, Mate yyyyyyyy
Last Failover at: 16:34:53 IST Jan 28 2021
This host: Primary - Active
Active time: 718082 (sec)
slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.12(2)33) status (Up Sys)
Interface servers (10.1.1.1): Normal (Monitored)
Interface ext-mgmt (10.1.1.17): Normal (Monitored)
Interface nonprod (10.1.1.33): Normal (Monitored)
Interface prod (10.1.1.49): Normal (Monitored)
Interface mgmt (10.1.1.65): Normal (Waiting)
Interface SERVICES (10.1.10.1): Normal (Monitored)
Interface diagnostic (0.0.0.0): Normal (Waiting)
slot 1: snort rev (1.0) status (up)
slot 2: diskstatus rev (1.0) status (up)
Other host: Secondary - Standby Ready
Active time: 0 (sec)
slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.12(2)33) status (Up Sys)
Interface servers (10.1.1.2): Normal (Monitored)
Interface ext-mgmt (10.1.1.18): Normal (Monitored)
Interface nonprod (10.1.1.34): Normal (Monitored)
Interface prod (10.1.1.50): Normal (Monitored)
Interface mgmt (10.1.1.66): Normal (Waiting)
Interface SERVICES (10.1.10.2): Normal (Monitored)
Interface diagnostic (0.0.0.0): Normal (Waiting)
slot 1: snort rev (1.0) status (up)
slot 2: diskstatus rev (1.0) status (up)
Stateful Failover Logical Update Statistics
Link : Failover Port-channel12 (up)
Stateful Obj xmit xerr rcv rerr
General 12111023 9 73127 0
sys cmd 73127 0 73127 0
up time 0 0 0 0
RPC services 0 0 0 0
TCP conn 2500330 0 0 0
UDP conn 948501 0 0 0
ARP tbl 51685 0 0 0
Xlate_Timeout 0 0 0 0
IPv6 ND tbl 0 0 0 0
VPN IKEv1 SA 0 0 0 0
VPN IKEv1 P2 0 0 0 0
VPN IKEv2 SA 0 0 0 0
VPN IKEv2 P2 0 0 0 0
VPN CTCP upd 0 0 0 0
VPN SDI upd 0 0 0 0
VPN DHCP upd 0 0 0 0
SIP Session 0 0 0 0
SIP Tx 0 0 0 0
SIP Pinhole 0 0 0 0
Route Session 577 0 0 0
Router ID 0 0 0 0
User-Identity 2 0 0 0
CTS SGTNAME 0 0 0 0
CTS PAC 0 0 0 0
TrustSec-SXP 0 0 0 0
IPv6 Route 0 0 0 0
STS Table 0 0 0 0
Umbrella Device-ID 0 0 0 0
Rule DB B-Sync 2 0 0 0
Rule DB P-Sync 206 0 0 0
Rule DB Delete 4 9 0 0

Logical Update Queue Information
Cur Max Total
Recv Q: 0 10 73127
Xmit Q: 0 16 12408156
> show failover history
details Show failover switching history of Current and Peer unit
| Output modifiers
<cr>

> show failover history details
==========================================================================
From State To State Reason
==========================================================================
16:34:05 IST Jan 28 2021
Not Detected Disabled No Error

16:34:07 IST Jan 28 2021
Disabled Negotiation Set by the config command

16:34:53 IST Jan 28 2021
Negotiation Just Active No Active unit found

16:34:53 IST Jan 28 2021
Just Active Active Drain No Active unit found

16:34:53 IST Jan 28 2021
Active Drain Active Applying Config No Active unit found

16:34:53 IST Jan 28 2021
Active Applying Config Active Config Applied No Active unit found

16:34:53 IST Jan 28 2021
Active Config Applied Active No Active unit found

==========================================================================
PEER History Collected at 00:04:17 IST Feb 6 2021
===========================PEER-HISTORY===================================
From State To State Reason
===========================PEER-HISTORY===================================
23:48:49 IST Feb 5 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

23:48:54 IST Feb 5 2021
Failed Standby Ready Interface check
This host:0
Other host:0

23:51:34 IST Feb 5 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

23:51:39 IST Feb 5 2021
Failed Standby Ready Interface check
This host:0
Other host:0

23:52:34 IST Feb 5 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

23:52:39 IST Feb 5 2021
Failed Standby Ready Interface check
This host:0
Other host:0

23:57:34 IST Feb 5 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

23:57:39 IST Feb 5 2021
Failed Standby Ready Interface check
This host:0
Other host:0

23:59:04 IST Feb 5 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

23:59:09 IST Feb 5 2021
Failed Standby Ready Interface check
This host:0
Other host:0

00:00:19 IST Feb 6 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

00:00:24 IST Feb 6 2021
Failed Standby Ready Interface check
This host:0
Other host:0

00:01:04 IST Feb 6 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

00:01:09 IST Feb 6 2021
Failed Standby Ready Interface check
This host:0
Other host:0

00:01:34 IST Feb 6 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

00:01:39 IST Feb 6 2021
Failed Standby Ready Interface check
This host:0
Other host:0

00:02:49 IST Feb 6 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0

00:02:54 IST Feb 6 2021
Failed Standby Ready Interface check
This host:0
Other host:0

00:03:34 IST Feb 6 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0
00:03:39 IST Feb 6 2021
Failed Standby Ready Interface check
This host:0
Other host:0
===========================PEER-HISTORY===================================
> show failover state

State Last Failure Reason Date/Time
This host - Primary
Active Ifc Failure 19:44:35 IST Jan 30 2021
Other host - Secondary
Standby Ready Ifc Failure 00:04:19 IST Feb 6 2021
mgmt: Failed
====Configuration State===
Sync Done
====Communication State===
Mac set

> show failover statistics
tx:1664972
rx:1430881
> show monitor-interface
This host: Primary - Active
Interface servers (10.1.1.1): Normal (Monitored)
Interface ext-mgmt (10.1.1.17): Normal (Monitored)
Interface nonprod (10.1.1.33): Normal (Monitored)
Interface prod (10.1.1.49): Normal (Monitored)
Interface mgmt (10.1.1.65): Normal (Waiting)
Interface SERVICES (10.1.10.1): Normal (Monitored)
Interface diagnostic (0.0.0.0): Normal (Waiting)
Other host: Secondary - Standby Ready
Interface servers (10.1.1.2): Normal (Monitored)
Interface ext-mgmt (10.1.1.18): Normal (Monitored)
Interface nonprod (10.1.1.34): Normal (Monitored)
Interface prod (10.1.1.50): Normal (Monitored)
Interface mgmt (10.1.1.66): Normal (Waiting)
Interface SERVICES (10.1.10.2): Normal (Monitored)
Interface diagnostic (0.0.0.0): Normal (Waiting)

STANDBY FTD2

show failover
Failover On
Failover unit Secondary
Failover LAN Interface: Failover Port-channel12 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 7 of 1041 maximum
MAC Address Move Notification Interval not set
failover replication http
Version: Ours 9.12(2)33, Mate 9.12(2)33
Serial Number: Ours yyyyyyyy, Mate xxxxxxxx
Last Failover at: 05:35:23 IST Jan 1 2010
This host: Secondary - Standby Ready
Active time: 0 (sec)
slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.12(2)33) status (Up Sys)
Interface servers (10.1.1.2): Normal (Monitored)
Interface ext-mgmt (10.1.1.18): Normal (Monitored)
Interface nonprod (10.1.1.34): Normal (Monitored)
Interface prod (10.1.1.50): Normal (Monitored)
Interface mgmt (10.1.1.66): Normal (Waiting)
Interface SERVICES (10.1.10.2): Normal (Monitored)
Interface diagnostic (0.0.0.0): Normal (Waiting)
slot 1: snort rev (1.0) status (up)
slot 2: diskstatus rev (1.0) status (up)
Other host: Primary - Active
Active time: 718219 (sec)
slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.12(2)33) status (Up Sys)
Interface servers (10.1.1.1): Normal (Monitored)
Interface ext-mgmt (10.1.1.17): Normal (Monitored)
Interface nonprod (10.1.1.33): Normal (Monitored)
Interface prod (10.1.1.49): Normal (Monitored)
Interface mgmt (10.1.1.65): Normal (Waiting)
Interface SERVICES (10.1.10.1): Normal (Monitored)
Interface diagnostic (0.0.0.0): Normal (Waiting)
slot 1: snort rev (1.0) status (up)
slot 2: diskstatus rev (1.0) status (up)

Stateful Failover Logical Update Statistics
Link : Failover Port-channel12 (up)
Stateful Obj xmit xerr rcv rerr
General 73145 0 12107647 98
sys cmd 73145 0 73145 0
up time 0 0 0 0
RPC services 0 0 0 0
TCP conn 0 0 2500146 96
UDP conn 0 0 9481866 0
ARP tbl 0 0 51701 0
Xlate_Timeout 0 0 0 0
IPv6 ND tbl 0 0 0 0
VPN IKEv1 SA 0 0 0 0
VPN IKEv1 P2 0 0 0 0
VPN IKEv2 SA 0 0 0 0
VPN IKEv2 P2 0 0 0 0
VPN CTCP upd 0 0 0 0
VPN SDI upd 0 0 0 0
VPN DHCP upd 0 0 0 0
SIP Session 0 0 0 0
SIP Tx 0 0 0 0
SIP Pinhole 0 0 0 0
Route Session 0 0 575 2
Router ID 0 0 0 0
User-Identity 0 0 2 0
CTS SGTNAME 0 0 0 0
CTS PAC 0 0 0 0
TrustSec-SXP 0 0 0 0
IPv6 Route 0 0 0 0
STS Table 0 0 0 0
Umbrella Device-ID 0 0 0 0
Rule DB B-Sync 0 0 2 0
Rule DB P-Sync 0 0 206 0
Rule DB Delete 0 0 4 0

Logical Update Queue Information
Cur Max Total
Recv Q: 0 15 12404853
Xmit Q: 0 1 73145
> show failover history details
==========================================================================
From State To State Reason
==========================================================================
23:51:34 IST Feb 5 2021
Standby Ready Failed Interface check
This host:1
single_vf: mgmt
Other host:0