topic Re: Firepower HA 2 subnets problem in Network Security

Firepower HA 2 subnets problem

cm — Tue, 04 Oct 2022 12:13:45 GMT

Hi All

I have 2 Firepower FTD (2130 models) in HA (high availabilty)mode working well in routed Mode. Its working using ONE protected subnet eg 98.x.x.0/24 for my servers. My servers are reachable from the outside using Public Addresses etc. BUT I have requirement to add a SECOND Subnet eg 49.x.x.0/24 on the same HA pair. is that possible. Logically this leans to BGP to advertise internal Networks. Any Examples or case Studies. So my Current setup below looks something like this ;

98.x.x.3 - 12( Protected Servers)--------98.x.x.1-2(Gw) [{Inside} HA -FTD(2 ftd) {Ouside} ] 69.x.x.1-2--- Static >---69.x.x.250[ Router-ISP ] (WORKING )

REQUIRED

98.x.x.0/24 and 49.x.x.0/24( Protected Servers)--------98.x.x.1-2(Gw) [{Inside} HA -FTD(2 ftd) {Ouside} ] 69.x.x.1-2--- Static >---69.x.x.250 [Router-ISP ]

Please Assist

Re: Firepower HA 2 subnets problem

MHM Cisco World — Tue, 04 Oct 2022 10:28:14 GMT

but config subinterface in FTD can solve issue this make FTD have one subinterface for each subnet.

Re: Firepower HA 2 subnets problem

cm — Tue, 04 Oct 2022 12:15:08 GMT

Unfortunately you cannot use subinterfaces in high availability mode.

Re: Firepower HA 2 subnets problem

cm — Mon, 10 Oct 2022 16:27:57 GMT

We managed to get working using IGP in our case it was OSPF used to advertise routes. I had made a mistake saying Subinterfaces dont work... It was just my wrong interpretation. Sub interfaces dont work on the failover link only.

Re: Firepower HA 2 subnets problem

MHM Cisco World — Mon, 10 Oct 2022 17:10:27 GMT

So glad your issue solve.

Good luck freind