topic Re: HA Pair question in Network Security

HA Pair question

seth.doyen — Tue, 31 Oct 2023 16:13:47 GMT

Hey everyone!

I have a weird situation going on with my failover and I just wanted to make sure the best practice for the HA Pair of a FTD. I have two outside interfaces with the same IP and I think when they have the same IP it broke the HA pair.

Question I have is, Do I need to assign different IP addresses to the outside interface in a HA Pair?

Thanks!

Re: HA Pair question

seth.doyen — Tue, 31 Oct 2023 16:39:22 GMT

I did fail to mention that I do have a failover IP configured however both FTD's are currently using the same IP address

Re: HA Pair question

Rob Ingram — Tue, 31 Oct 2023 16:46:13 GMT

@seth.doyen best practice for an HA failover pair is to assign each interface a unique IP address on both FTDs. You don't have to assign an IP address to interface on both FTDs, but if you do not then you cannot monitor those interfaces.

Re: HA Pair question

Marius Gunnerud — Tue, 31 Oct 2023 20:34:39 GMT

Are we talking that you have two interfaces on the same ASA that have the same IP or the outside interface has the same IP on both the active and standby devices?

Re: HA Pair question

Eric R. Jones — Tue, 31 Oct 2023 21:13:58 GMT

First let me qualify this with the face we manage our FTD's via FMC.

Our outside, internet facing, interfaces have the same IP going to our perimeter router. Our inside interfaces have the same IP but our management interfaces have different IP's. Our VPN, seperate device, and DMZ connection, seperate device, have the same IP and various other devices, e.g. Syslog, have the same ip on the cooresponding interfaces so when failover occurs they talk to the same devices.