topic Re: FTD HA Reconfiguration via FMC in Network Security

FTD HA Reconfiguration via FMC

Rene Mueller — Thu, 07 Aug 2025 08:37:54 GMT

Hi,

we have 2 FTD 2110 running in HA in the same datacenter with Mgmt IP in the same IP subnet. Failover/Linkstate link is configured on a single port but needs to be on a portchannel in the future

Now we need to move 1 FTD into another datacenter on the campus that has another Mgmt IP subnet. I can see in FMC that I cannot reconfigure HA settings. Also I am not sure if the FTD still connects to FMC whenever I change the Mgmt IP.

Does anyone has an idea what the steps are to reconfigure Mgmt and HA settings? The most important job is to change FTD Mgmt IP.

Re: FTD HA Reconfiguration via FMC

MHM Cisco World — Thu, 07 Aug 2025 09:13:16 GMT

I want to share only roadmap

1- break HA between ftd1 abd ftd2

2- unregistered ftd1

3- register ftd1 again with new IP

I think you need after point 2 reset factory.

This my opinion' also check other VIP reply before decide which solution is good

MHM

Re: FTD HA Reconfiguration via FMC

Rene Mueller — Thu, 07 Aug 2025 09:31:41 GMT

I just found out that changing the Mgmt IP should not be a big deal without unregister adn re-register:

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center-virtual/221961-change-the-management-interface-ip-addre.html

Re: FTD HA Reconfiguration via FMC

MHM Cisco World — Thu, 07 Aug 2025 09:37:41 GMT

Yes I know about this doc. But many engineers face issue after change mgmt IP.

As I mention before' check all solution and select one you see it best for you.

Goodluck friend

MHM

Re: FTD HA Reconfiguration via FMC

Rene Mueller — Thu, 07 Aug 2025 09:39:56 GMT

when breaking HA, the primary active FTD keeps active and functional?

Re: FTD HA Reconfiguration via FMC

MHM Cisco World — Thu, 07 Aug 2025 10:09:11 GMT

after HA break only the active keep have IP and can forward traffic

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html?utm_source=chatgpt.com#toc-hId-430987556

MHM

Re: FTD HA Reconfiguration via FMC

MHM Cisco World — Thu, 07 Aug 2025 10:10:22 GMT

Break HA not de register FTDs
delete HA de register both FTD

MHM

Re: FTD HA Reconfiguration via FMC

Rene Mueller — Sat, 09 Aug 2025 09:57:06 GMT

Today I had a maintenance window and was able to proceed. I was able to change the Mgmt IP of FTD-02 like in this URL:

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center-virtual/221961-change-the-management-interface-ip-addre.html

We use Version 7.4.2.2.

Also I had to break HA, then moved FTD-02 to the new location, setup Port-channel on FTD-01 (active), then created HA again.

Re: FTD HA Reconfiguration via FMC

MHM Cisco World — Sat, 09 Aug 2025 10:09:20 GMT

Thanks a lot for update us steps you use for move ftd.

Have a nice day

MHM