topic Re: Change DNS server FTD High Availability in Network Security

Change DNS server FTD High Availability

Juan Marilaf Millahual — Mon, 05 Dec 2022 14:10:50 GMT

I have two FTD 2130 (High Availability) and FMC 1600

I need to change the CLI server DNS on my high availability FTD 2130 (CLI DNS for management) no change DNS GUI on my FMC

the older DNS server no works and now don't have resolution name

I need to know if when I change the CLI DNS in the primary FTD or CLI DNS in the secondary FTD I will have errors with the high availability or errors (wrong configuration, no mismatch configuration, etc) on my FTD change to any errors

How I can make this change safely?

How I can resolve this case and no trouble?

Re: Change DNS server FTD High Availability

balaji.bandi — Mon, 05 Dec 2022 14:26:35 GMT

why not change using FMC - platform settings ?

you can do changes on FTD active device -

configure network dns server x.x.x.x

Re: Change DNS server FTD High Availability

Juan Marilaf Millahual — Mon, 05 Dec 2022 14:32:03 GMT

Platform setting is ok with the correct DNS. But, Platform setting only use DNS for name resolution for politics or configuration no for FTD manager resolution (my fail is to connect the FTD to cisco cloud)

Re: Change DNS server FTD High Availability

MHM Cisco World — Mon, 05 Dec 2022 14:32:39 GMT

I have little info. about FTD but there is DS primary and secondary
you can add new DNS as secondary,
and if the FTD can not connect primary it will shift to secondary.
check this solution

Re: Change DNS server FTD High Availability

balaji.bandi — Mon, 05 Dec 2022 14:38:27 GMT

then you can configure from command level as i have suggested.

Re: Change DNS server FTD High Availability

Juan Marilaf Millahual — Mon, 05 Dec 2022 14:41:50 GMT

The question is. when I configure the new DNS over CLI in the active FTD, this action affect to High Availability due mismatch configuration with the FTD secondary? How affect this to the HA?

Re: Change DNS server FTD High Availability

Marvin Rhoads — Mon, 05 Dec 2022 16:32:05 GMT

The local server bootstrap settings (management address, gateway, DNS server etc.) do not replicate between members of an HA pair (or among cluster members).

Re: Change DNS server FTD High Availability

balaji.bandi — Mon, 05 Dec 2022 16:46:40 GMT

if you looking only Manangment then you can configure using Cli. that not have replicated to standby.