topic FTD HA add to FMC in Network Security

FTD HA add to FMC

Nikola PEnev — Wed, 21 Feb 2024 13:55:50 GMT

Hi,

i've 2 FTD 2130 which are working in HA. What is the proper way to add them in FMC? I saw already how to add them separately and then to make HA through FMC...

Thanks,

Nikola

Re: FTD HA add to FMC

MHM Cisco World — Wed, 21 Feb 2024 13:57:42 GMT

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html

Check this

MHM

Re: FTD HA add to FMC

Nikola PEnev — Wed, 21 Feb 2024 14:02:17 GMT

This is the document how to make a HA pair when the devices are already added in the FMC.

How to add properly devices in FMC if they are already in HA before adding them to the FMC?

Re: FTD HA add to FMC

Marvin Rhoads — Wed, 21 Feb 2024 14:59:03 GMT

You cannot add them as an HA pair into FMC. You need to break HA, add the Primary and Secondary units separately into FMC and then re-form HA from FMC between the units.

Re: FTD HA add to FMC

Marius Gunnerud — Wed, 21 Feb 2024 21:35:14 GMT

As @Marvin Rhoads has mentioned, you need to break the HA before adding the FTDs to FMC. But this is also where you need to be aware that you will lose all configuration on the FTDs during the onboarding process. The only thing that is retained are the data interface configuration (and management of course). Everything else is lost and needs to be reconfigured.

So, assuming you want to keep the configuration that is already on the FTDs, be sure that you have preconfigured all interface security zones, ACP policies and NAT policies before you onboard the devices. After the devices are onboarded you will need to associate the interfaces with the security zones, configure all routing, DHCP relay and site to site VPN and remote access VPNs. basically everything that references physical interfaces will need to be reconfigured manually after onboarding.