topic Re: Interfaces on Secondary Firewall "Not receiving packets" in Network Security

Interfaces on Secondary Firewall "Not receiving packets"

adamgerber — Wed, 12 Apr 2023 10:59:43 GMT

I have x2 4115's in Active Passive HA.

On my FMC, I'm getting critical health alerts for the secondary/passive firewall "not receiving any packets" on some of its subinterfaces. Is this normal or a bug? Or an issue with my health monitoring policy? I would like to eliminate these alerts. I have another HA pair of 1140's on the same FMC and don't get this issue. Weird how it's only complaining about a few random subinterfaces?

Any help would be appreciated.

KR,
Adam

Re: Interfaces on Secondary Firewall "Not receiving packets"

MHM Cisco World — Wed, 12 Apr 2023 12:15:30 GMT

FMC Interface 'DataplaneInterface0' is not receiving any packets - Cisco Community

Re: Interfaces on Secondary Firewall "Not receiving packets"

adamgerber — Wed, 12 Apr 2023 12:32:40 GMT

Hi - that thread is regarding ASA's with separate SFR modules. I am dealing with x2 FTD's in an HA pair. I dont want to disable interface monitoring for the HA Pair.

Re: Interfaces on Secondary Firewall "Not receiving packets"

MHM Cisco World — Wed, 12 Apr 2023 12:36:00 GMT

Yes friend I know the FW platform is different but in end the FMC is same.
this behave I think is similar.

Re: Interfaces on Secondary Firewall "Not receiving packets"

adamgerber — Wed, 12 Apr 2023 12:40:23 GMT

I expected different behavior since the FMC is aware of the a/p HA and again why is it only complaining about 4 out of 9 sub-interfaces. Might be a bug then?

Re: Interfaces on Secondary Firewall "Not receiving packets"

MHM Cisco World — Wed, 12 Apr 2023 12:42:55 GMT

4 of 9 subinterface <<- are all are config as HA monitor ? if all then think contact TAC it can be bug and there is solution or workaround for it.

Re: Interfaces on Secondary Firewall "Not receiving packets"

Rob Ingram — Wed, 12 Apr 2023 12:54:14 GMT

@adamgerber

Symptom: Critical health alerts for Interface Status stating that interfaces are not receiving any packets are seen on the FMC for the standby FTD, which is not supposed to be processing traffic, so this is a normal and expected behavior.

Conditions: FTD deployed in High Availability.

Workaround: Blacklist the health alerts for Interface Status.

https://bst.cisco.com/bugsearch/bug/CSCvk05446
https://bst.cisco.com/bugsearch/bug/CSCvb36840

Re: Interfaces on Secondary Firewall "Not receiving packets"

adamgerber — Tue, 25 Apr 2023 12:23:53 GMT

Hi - Yes they are enabled with failover monitoring.

Re: Interfaces on Secondary Firewall "Not receiving packets"

adamgerber — Mon, 30 Sep 2024 20:46:53 GMT

Hi all. Fixed by adding standby IP addresses to interfaces.

Re: Interfaces on Secondary Firewall "Not receiving packets"

Marvin Rhoads — Tue, 01 Oct 2024 15:06:23 GMT

Enabling interface monitoring for failover with the inclusion of standby addresses is the best solution.

When that's not possible (e.g., HA pair sharing a /30 WAN address), newer versions of FMC will allow you to blacklist just one member of the HA pair for only some interfaces while continuing to monitor the interface on the Primary (and normally active) member..