topic Re: FTD getting remote users connected on its standby unit. in Network Security

FTD getting remote users connected on its standby unit.

sam cook — Fri, 02 Apr 2021 10:11:51 GMT

we have 2 FTD 2110 on 6.4 Version and in actif-passif high availability mode.

And yet we see some remote access anyconnect users connected on the standby unit, is it normal ?

we are going to shut the standby unit, is there any production cut risk on these users ?

thanks

Re: FTD getting remote users connected on its standby unit.

Marvin Rhoads — Fri, 02 Apr 2021 10:52:22 GMT

In an HA pair, the standby synchronizes the VPN connection state table with the primary. This is so that, in the event of a failover, the users don't have to re-establish a VPN connection.

Shutdown or disconnection of the standby unit will not have any effect on these users' session to the primary unit.

Re: FTD getting remote users connected on its standby unit.

sam cook — Fri, 02 Apr 2021 13:54:31 GMT

Hi Marvin,

Thank you, but the strange thing is that i see users connected on the standby unit but i can not see them on the primary one.

If it was simply VPN connection state table synchronization, i should have seen same users on both appliances but still it's not the case.

Re: FTD getting remote users connected on its standby unit.

Marvin Rhoads — Sat, 03 Apr 2021 14:53:35 GMT

That is odd. Does "show vpn-sessiondb anyconnect detail" show the users as active? Do those users show up on the active unit at all? Could you contact one of them personally and inquire about their status from their perspective? If you force a logoff for that user from the FTD side do they reconnect to the active unit?

Re: FTD getting remote users connected on its standby unit.

Sheraz.Salim — Mon, 05 Apr 2021 08:09:01 GMT

@marvin and @sam I have seem this issue in production network. where end user s/he was connected to standby FTD public ip address. in my case this paticular use was able to connect to FTD (connected to standby ip address).