topic Re: FTD with HSRP/GLBP in Network Security

FTD with HSRP/GLBP

georgipetrov — Sat, 18 Feb 2023 11:26:11 GMT

Greetings,

I wanted to ask whether it is possible to set up HSRP/GLBP with two Firepower 1150 FTD devices. I was not able to find any concrete answers looking around, or any recent ones.

Thank you in advance.

Re: FTD with HSRP/GLBP

MHM Cisco World — Sat, 18 Feb 2023 11:33:34 GMT

you can not config HSRP in FTD
because the FTD can work as active/standby FTD HA.
both HSRP and FTD HA active/standby do same job.

Re: FTD with HSRP/GLBP

georgipetrov — Sat, 18 Feb 2023 11:40:16 GMT

Thank you, and is it possible to do an Active/Active with those two FTDs? So both firewalls carry traffic and are redundant to each other - i.e. if one fails, the other takes the traffic?

Re: FTD with HSRP/GLBP

MHM Cisco World — Sat, 18 Feb 2023 11:45:37 GMT

I need to check
if FTD 1150 support active/active (multi instance)
I will update you soon

Re: FTD with HSRP/GLBP

MHM Cisco World — Sat, 18 Feb 2023 12:07:31 GMT

please see below comment

Re: FTD with HSRP/GLBP

georgipetrov — Sat, 18 Feb 2023 11:58:19 GMT

I understand, thank you for this. Do you think that policy based routing can be an 'alternative' to active active. So you have the two FTDs but you set up policy based routing to determine what source traffic goes to each ?

Re: FTD with HSRP/GLBP

MHM Cisco World — Sat, 18 Feb 2023 12:14:35 GMT

Cisco Firepower 1000 Series Data Sheet - Cisco

data sheet is
FTD 1150 support active/active is appliance
FTD 1150 support only active/standby if run FTD image

so we return to first point
FTD run only active/standby

for using PBR I will check it

Re: FTD with HSRP/GLBP

Rob Ingram — Sat, 18 Feb 2023 12:13:23 GMT

For clarity, the 1000 series (1150) supports Active/Active (or Active/Standby) only if running the ASA software image.

Only Active/Standby is supported with the FTD software image.

Re: FTD with HSRP/GLBP

mimack — Wed, 24 Sep 2025 21:41:53 GMT

It really shows that the engineers at Cisco don't always understand the use cases. Lack of HSRP/VRRP support is a major weakness. HA is not the same thing, not at all. While I'm sure in many cases HA can be used as an HSRP replacement, its not nearly identical. The biggest issue with HA is that the entire platform must match identically between devices, not just the physical platform, but also all of the interfaces and their configurations. There are many times where you need something like HSRP or VRRP on just a single network, but otherwise the two platforms shouldn't have to match on everything else. Lack of this support is just frustrating. Its a step backwards.