topic Re: Firepower Failover behavior in Network Security

Firepower Failover behavior

Wrecktangle — Tue, 14 Mar 2023 20:52:26 GMT

Context: Just got an pair of FTD 4140s and 2140s HA configured. They're at v7.0.5 with vFMC and wondering how the FTDs handle failover scenarios. For this question, monitoring is enabled for L2 and L3 interfaces and I have a single Inside (access) and Outside (trunked) configured for each appliance (just for the example, not actual config).

The Question: Is there a difference in the failover behavior when an entire appliance goes offline versus when an interface goes offline? For example and pretty obvious, if my primary (active) 4140 goes offline for whatever reason, the standby will become active. However, what if an individual interface, L2 or L3, on the primary (active) goes offline? Does the interface itself failover to the standby? Or does the entire standby unit become active?

Addt'l Question: Does the failover behavior change when Etherchannel/Port-channels are configured?

Regards,

Wreckt

Re: Firepower Failover behavior

Rob Ingram — Tue, 14 Mar 2023 20:58:37 GMT

@Wrecktangle by default the failure of an interface on the Active Firewall (whether it's physical or logical) would cause the standby FTD appliance (the entire standby unit) to become active.

Re: Firepower Failover behavior

Eric R. Jones — Tue, 14 Mar 2023 21:16:14 GMT

This is the information I used when deploying our FTD's with FMC frontend. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/fdm/fptd-fdm-config-guide-630/fptd-fdm-ha.html

Re: Firepower Failover behavior

Wrecktangle — Tue, 14 Mar 2023 21:34:31 GMT

@Rob Ingram wrote:(whether it's physical or logical) would cause the standby FTD appliance (the entire standby unit) to become active.

Assuming this includes etherchannel/port-channels (logical), why would one use an etherchannel/port-channel say in the case of a 2 or 4-port etherchannel if it will failover if any of those ports go down?

Re: Firepower Failover behavior

Rob Ingram — Tue, 14 Mar 2023 21:44:23 GMT

If the portchannel was dedicated per interface, then all interfaces would need to go down to dictate a failover.

If you were using sub interfaces on the portchannel and the sub interface went down, that would cause a failover.

Re: Firepower Failover behavior

Wrecktangle — Tue, 14 Mar 2023 23:03:01 GMT

Appreciate the enlightenment!