topic Re: Cisco Virtual Ftds in Network Security

Cisco Virtual Ftds

YonasA — Wed, 01 Jan 2025 19:48:07 GMT

Hello Everyone,

We have deployed two cisco virtual FTDs on our environment and configure them as HA. Those firewalls are connected with core switch over ospf and they are working seamlessly. However when the standby unit become active it will lose the ospf configuration it had earlier. But when we move the status to the former one, it works fine. So is there anyone who can guide us to sort out this issue or explain the reason why it loses ospf configuration?

with regards,

Yonas A

Re: Cisco Virtual Ftds

MHM Cisco World — Wed, 01 Jan 2025 19:52:46 GMT

How it loss the config? Can you more elaborate

Thanks

MHM

Re: Cisco Virtual Ftds

YonasA — Wed, 01 Jan 2025 19:58:54 GMT

Hello MHM,

Like i said before changing the active unit the firewall is connected with the core switch over ospf protocol. Then we would like to change the active unit to standby by shutting down or reload it. By that time the standby unit will become active but it will ospf configuration and can be able to forward traffic to the core switch as the way it should. We dont know why it losses its ospf configuration.

With regards,

Yonas A.

Re: Cisco Virtual Ftds

MHM Cisco World — Wed, 01 Jan 2025 20:06:51 GMT

I dont think it loss ospf config' but issue is

In FW active/standby only active established ospf and standby not participate in ospf' when failover is happened standby need some time to establish ospf with core.

To solve issue and forward traffic use NSF.

MHM

Re: Cisco Virtual Ftds

Flavio Miranda — Wed, 01 Jan 2025 21:31:17 GMT

@YonasA

You can configure a device as NSF-capable or NSF-aware. A NSF-capable device can indicate its own restart activities to neighbors and a NSF-aware device can help a restarting neighbor.

Pay attentition to this warning

"Note

You must not configure the OSPF process to use fast hello packets if you also configure graceful restart. Graceful restart cannot occur with fast hello packets, because the time taken for the role change between the active and standby units is more than the configured dead interval."

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-ospf.html

Re: Cisco Virtual Ftds

YonasA — Thu, 02 Jan 2025 05:22:58 GMT

Can you guide as the optimal steps used to configure NSF. Because i have tried but it does not have any different.