topic Re: HA on FTD in Network Security

HA on FTD

KayaaKashyap — Tue, 23 Jan 2024 09:51:35 GMT

Hi,

We have a greenfield project in which we are implementing FTD.

Let’s assume I have configured

Active : 192.168.75.10

standby : 192.168.75.11

FTD will connect to the SDWAN cedge devices (HA).

connectivity is as below:

SDWAN edge router (HA)—> FTD —> Core Switch —> internal servers

We will configure static route on firewall to reach SDWAN device.

And reverse traffic will reach to primary firewall which is 192.168.75.10

Now my question is during failover when standby firewall will be active. how the reverse traffic will reach to secondary firewall (192.168.75.12)?

Re: HA on FTD

Rob Ingram — Tue, 23 Jan 2024 09:57:59 GMT

@KayaaKashyap both FTD's (Active/Standby) inside and outside interfaces need to be plugged into a switch and in the same VLAN. Upon failover of the Active (Primary) firewall, the Standby (Secondary) firewall will become active and the firewalls will swap IP addresses. So 192.168.75.10 will be the Active IP address regardless of whether the which firewall is passing traffic.

Re: HA on FTD

MHM Cisco World — Tue, 23 Jan 2024 10:00:15 GMT

SDWAN router need to have static route to active FW IP
the FW IP is swap when fail over and hence always the SDWAN point to active FW
MHM

Re: HA on FTD

MHM Cisco World — Tue, 23 Jan 2024 10:01:22 GMT

NOTE:- if you run IGP only the active participate in igp, the standby dont have any role.
MHM

Re: HA on FTD

KayaaKashyap — Tue, 23 Jan 2024 10:39:29 GMT

This is helpful. Many thanks.

So we can say Primary IP of firewall works as VIP in FTD HA, right?

Please share if you have supportive document?

Re: HA on FTD

Rob Ingram — Tue, 23 Jan 2024 10:47:54 GMT

@KayaaKashyap yes, the primary unit IP address can be consider as VIP that will always be available regardless of which unit is active.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/high-availability.html#ID-2107-000000a8