topic Re: FMC FTD HA Cluster in Network Security

FMC FTD HA Cluster

kamensky@kronovision.sk — Mon, 19 Aug 2024 12:19:46 GMT

Hello community,

currently we are facing a challenge to build FTD HA cluster using FMC while using the same interface for DATA and MANAGEMENT traffic processing.

However it turned out that on FTD models 1150 such setup is not supported. When building up a cluster we get message: "High availability not supported on this model for devices enabled for Management access through data interfaces".

In case we use our available public IPs for management interfaces to separate DATA and MANAGEMENT traffic there will be no left for outside interface to build VPN tunnel. In case we use private IPs for management interfaces we will not be able to publish any changes from FMC in case VPN tunnel will be down.

I would like to ask you what is the best practice to follow in such scenario.

Also I would like to ask you, in case we use public IPs for management interface, is there a way to secure this interface which will be facing public internet? (like limit access only from certain IPs, or deny ICMP, etc...)

Thanks a lot for any valuable information on these topics!

Re: FMC FTD HA Cluster

MHM Cisco World — Mon, 19 Aug 2024 13:25:26 GMT

FTD HA active/standby or cluster ?

MHM

Re: FMC FTD HA Cluster

kamensky@kronovision.sk — Mon, 19 Aug 2024 13:27:40 GMT

HA active/ standby

Re: FMC FTD HA Cluster

MHM Cisco World — Mon, 19 Aug 2024 18:54:34 GMT

MHM

Re: FMC FTD HA Cluster

Marvin Rhoads — Mon, 19 Aug 2024 14:12:12 GMT

FYI version 7.4 added support for this feature.

High Availability/Scalability
Manage threat defense high availability pairs using a data interface.	7.4.0	7.4.0	Threat defense high availability now supports using a regular data interface for communication with the management center. Previously, only standalone devices supported this feature. See: Using the Threat Defense Data Interface for Management

Re: FMC FTD HA Cluster

kamensky@kronovision.sk — Mon, 19 Aug 2024 18:36:26 GMT

Thanks a lot for info, tested, working.