topic Re: FTD HA active/standby switching too long in Network Security

FTD HA active/standby switching too long

h.dam — Thu, 02 Sep 2021 13:42:23 GMT

Hello,

I have tested the FPR 2100 HA pair switching time in lab, it took 10 sec.

For our production environment, it is too long.

I remember that ASA 55xx A/S switching is immediately.

Do you have the same time?

Maybe there are some specific settings for optimisation, please let it know.

My HA settings are default at this time.

Thanks.

Re: FTD HA active/standby switching too long

Amine ZAKARIA — Thu, 02 Sep 2021 14:57:34 GMT

Hello @h.dam ,

Do you test failover by switching units or shutdown directly connected interfaces ?

Re: FTD HA active/standby switching too long

h.dam — Thu, 02 Sep 2021 15:48:00 GMT

Hello Amine,

I did it using FDM GUI and click switch mode.

Re: FTD HA active/standby switching too long

Amine ZAKARIA — Thu, 02 Sep 2021 16:10:48 GMT

Hello @h.dam ,

Usually i test failover by rebooting the active unit/shutdown switch interface for the link monitored by FDM.

For the manual switch mode it triggered real time, what FDM version are you using ?

Try to switch mode from GUI and verify the show failover state from cli in same time, did it switch real time ?

Re: FTD HA active/standby switching too long

h.dam — Thu, 02 Sep 2021 19:27:55 GMT

FTD version is 6.7.0

As I said I used FDM GUI HA switch mode. Tomorrow I'll try CLI command.

I got another issue:

from FDM GUI, the reboot works but not the shutdown.

Did you try this?

Thanks.

Re: FTD HA active/standby switching too long

h.dam — Tue, 07 Sep 2021 14:47:09 GMT

Hello,

I found out finally that it is the OSPF convergence that took time.

The failover works almost immediately.

I configured OSPF with BFD on ASA before. But FPR doesn't support it.

So after remplacement, the time is longer.

I also tried to modify the SPF timers but the result isn't what I expected.

Do anyone have an alternative solution to use on FPR instead of BFD?

Thanks.

Re: FTD HA active/standby switching too long

Amine ZAKARIA — Sat, 11 Sep 2021 10:08:07 GMT

Hi @h.dam ,

Make sure the secondary has the routes replicated from the primary.

Does your directly connected took time to re-establish the ospf neighborship or the route convergence are slow ?

Try to enable the NSF (Non stop forwarding) and let us know your experience!

Hope that helps!