Adding a network module to Firepower 4110

[Ivan Drobilo]

Hi all,

I am planning to add 10Gb network modules to a existing FP4110 devices (running container instances) and I have a question regarding the impact of the change. According to HA requirements for FTD, both FTDs should "have the same number and types of interfaces".

My plan was to power off the secondary/standby units, install the module and power the device back on in order to initialize the module. When the standby boots and HA is reformed, I move these secondary/standby units to active and do the same install on the primary units.

The FTD HA requirements also state that they have to "Be the same model. In addition, for container instances, they must use the same resource profile attributes." However,  it is possible to maintain FTD HA while making changes to the resource profile on FXOS, so for a period of time both units do not have matching resource profiles.

I would expect the same to be possible while installing modules, but I do not have a spare/test FP4110 units to check.

My question is whether I should expect downtime or other issues with HA during the time when the secondary unit has the module installed, but the primary still does not?

Thank you!

[Marvin Rhoads · Accepted solution]

Until interfaces from the new module are allocated to the logical devices they don't have any knowledge of the module. So your HA will be unaffected by adding a network module to one of the chassis while you wait to add the same to the other one.

Once you have them in both chassis and add them to a given logical device there will indeed be a temporary period during which the hardware doesn't match. I haven't tried it to see how HA behaves at that point in time but I would expect it to allow it and just give a warning - similar to how it reacts during an upgrade.

[Ivan Drobilo]

Hi Marvin,

thank you very much.