https://community.cisco.com/t5/network-security/cisco-ftd-ha-pair-issue/m-p/4854417#M1101580 <P>Failover link is back to back interconnect both FW.</P> <P>Also You can specify virtual mac for both fw' this prevents any issue in ip-mac in sw.</P> Wed, 14 Jun 2023 10:16:05 GMT MHM Cisco World 2023-06-14T10:16:05Z https://community.cisco.com/t5/network-security/cisco-ftd-ha-pair-issue/m-p/4854362#M1101569 <P>Hello All,&nbsp;</P><P>We have Cisco FTD pair configured with HA. Recently we have updated the FTD with 7.0.5 version with this we have also upgraded snort-2 to snort-3 (as per recommendation). Both the requirement has been completed properly. But ..&nbsp;</P><P>Post than a strange behavior has been observed.</P><P>- When Actual Secondary becomes ACTIVE , Traffic is working.</P><P>- When we failover and Actual Active unit becomes ACTIVE . All traffic stopped and resulting in massive outage.</P><P>ARPs are learning fine on problematic FTD (Actual Active) , While troubleshooting we came to know that FTD is not seeing SYN-ACK packet. However, traffic restored and working fine when we make Actual Secondary as Active unit.</P><P>If anyone experienced this problem and had solution. Please advice.</P><P>&nbsp;</P><P>Rgds</P><P>***</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 14 Jun 2023 08:19:14 GMT https://community.cisco.com/t5/network-security/cisco-ftd-ha-pair-issue/m-p/4854362#M1101569 netbeginner 2023-06-14T08:19:14Z https://community.cisco.com/t5/network-security/cisco-ftd-ha-pair-issue/m-p/4854417#M1101580 <P>Failover link is back to back interconnect both FW.</P> <P>Also You can specify virtual mac for both fw' this prevents any issue in ip-mac in sw.</P> Wed, 14 Jun 2023 10:16:05 GMT https://community.cisco.com/t5/network-security/cisco-ftd-ha-pair-issue/m-p/4854417#M1101580 MHM Cisco World 2023-06-14T10:16:05Z