FTD 2K series Fail Open? Software Bypass IPS?

[Freemen]

Hi

if FTD 2K in on routed mode, if the IPS engine somehow hang or not responding, it can be software bypass? or the health monitor will trigger as fail then fail over to secondary unit?

[Nikolaj Pabst]

Hi Freemen,

Inline-Pairs can be used for somthing like this with the Failsafe allow setting.

/Nikolaj

[Rahul Govindan]

Answer to this is no. The Failover trigger conditions for the FTD are:

Active unit loses power or stops normal operation.

Active unit interface physical link down.

Active unit interface up, but connection problem causes interface testing.

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_threat_defense_high_availability.html#ID-2107-000001b1

Unless the IPS hang somehow causes the FTD2 to be unable to talk to FTD1, I do not see this being a failover trigger condition. 

[Nikolaj Pabst · Accepted solution]

Sorry, missread the post, this is not an option in routed mode.