topic Re: FTD HA Packet tracer different result for primary and secondary in Network Security

FTD HA Packet tracer different result for primary and secondary

Wonxie — Fri, 17 Nov 2023 06:28:31 GMT

Hi,

I have two FTD's in HA managed by FMC. When i run a trace using same criteria on both the FTDS from FMC ui, i get differnt results on the primary active and secondary standby. sample traces are given below.

Is it normal that only the primary active (or Active) pair will show the allow result and the Secondary being standby always drop ?

this is output from primary active

and this is from secondary standby

Regards,

Re: FTD HA Packet tracer different result for primary and secondary

MHM Cisco World — Fri, 17 Nov 2023 06:56:32 GMT

check other traffic like ICMP not TCP
TCP the active is build TCP conn and sync to standby I think that why you see different

Re: FTD HA Packet tracer different result for primary and secondary

tvotna — Fri, 17 Nov 2023 09:06:04 GMT

Yes, this is correct behavior for all traffic types.

Re: FTD HA Packet tracer different result for primary and secondary

Marius Gunnerud — Fri, 17 Nov 2023 09:47:36 GMT

The standby unit will always show the packet as dropped as it is not supposed to forward traffic. Also, we do not see an output interface in the packet-tracer which leads me to believe that you do not have the standby IP configured, but this will not affect the result of the packet-tracer.

Here is the result of one of my active/standby units (which has standby IP configured) for reference:

packet-tracer input LAN tcp 10.10.10.10 12345 8.8.8.8 443
Result:
input-interface: LAN(vrfid:0)
input-status: up
input-line-status: up
output-interface: outside(vrfid:0)
output-status: up
output-line-status: up
Action: drop
Time Taken: 30004 ns
Drop-reason: (fo-standby) Dropped by standby unit, Drop-location: frame 0x000055f8794d0dfc flow (NA)/NA

And this is the output from the Active device