topic Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in in Network Security

Interface breakout and PO on 2 FP9300 runnin logical device ASA in HA

mbshankr — Wed, 19 Apr 2023 08:30:04 GMT

Hi,

My network has 2 FPs 9300 running an ASA logical device on each chassis. The 2 ASAs are deployed in HA pair.

My requirement is to:

1. Create 2 breakout interfaces (using 40G interfaces) on each Firepower chassis.

2. Bundle these breakout interfaces into a Port-channel on each chassis.

3. Add the Port-channel interface to the logical ASA device on each chassis (ASA running in HA pair)

Then on I will configure these Port-channel interfaces from Active ASA as per my requirement. I need to do all this without any network downtime (except for the failover time).

Now my questions are:

1. On which Firepower should I initiate the activity? The chassis running active ASA or the chassis running standby ASA?

2. After I finish the config/reboot on one Firepower and it comes up after reboot, would the ASA running on that Chassis have the port-channel present already (blank PO though)? Would this affect the config sync between the ASA pair?

3. What is the best way to carry out the activity with best practices?

Many thanks

Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in

MHM Cisco World — Wed, 19 Apr 2023 10:06:25 GMT

let me check

Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in

mbshankr — Wed, 19 Apr 2023 08:41:23 GMT

As per my understanding, the FP will require a reboot after configuring breakout interface/s. So when I do this on the FP running active ASA, the reboot would trigger failover and the ASA running on the other chassis will become new active. Hence I am confused how to go about this.

I was considering downtime assuming if I needed to apply config and reboot on both the FPs parallelly (but I don't think that would be the case).

Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in

MHM Cisco World — Wed, 19 Apr 2023 09:45:28 GMT

I will make deep dive and update you, but are the two FW run HA or cluster ?

Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in

mbshankr — Wed, 19 Apr 2023 09:49:30 GMT

The 2 ASA are in HA pair. Each ASA is running on different Firepower 9300 chassis.

Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in

MHM Cisco World — Wed, 19 Apr 2023 10:07:22 GMT

Cisco Firepower 4100/9300 FXOS CLI Configuration Guide, 2.7(1) - Interface Management [Cisco Firepower 9300 Series] - Cisco

commit-buffer

This will cause an automatic reboot. If you are configuring more than one breakout, you should create all of them before you issue the commit-buffer command.

Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in

MHM Cisco World — Wed, 19 Apr 2023 11:09:50 GMT

Now let build strategy here

we see from my previous post that the breakout 40G will automatic reboot the FPR
and using the table above
so we start with standby <<- this will not effect the traffic there is no downtime
then reboot, there is NO failover in this case.
then we config breakout in Active <<- here the standby will become the new Active, here you can see some downtime because other network device must notice this change via ARP
after that the OLD active will not become active again, the standby will continues to be active FW.

Re: Interface breakout and PO on 2 FP9300 runnin logical device ASA in

mbshankr — Wed, 19 Apr 2023 13:38:24 GMT

Yes, that is the same plan of action I was planning as well. Just a minor change to gracefully failover the firewall before proceeding with the other Firepower.

we start with standby <<- this will not effect the traffic there is no downtime
then reboot, there is NO failover in this case.

After the standby is up and config fully synced, we gracefully failover the firewall.

then we config breakout in now Standby
after that the OLD active will not become active again, the standby will continues to be active FW

Then create new PO with port members on the FP chassis running the current Active ASA and add it to the logical device.

Then create new PO with port members on the FP chassis running the current Standby ASA and add it to the logical device.

Then configure the new PO from the active ASA which would sync to the standby.

Last Question:

1. Are there any challenges/restrictions/limitations/special points to consider while adding Breakout interface/s in Port-channel?