Adding HA to existing FTD primary

[spfister336]

We are converting an active/standby ASA pair to FTD. We decommissioned the old standby and set it up as the new FTD primary, managed through FMC. Once we tested that for a while, we have wiped the old ASA primary and have installed the same version of the FTD image on it (and brought FXOS to the same version too). It is registered to the FMC also, and we are ready to set up the HA pair. This doesn't wipe anything from the existing FTD primary, does it? It's in production use. I wanted to ask before trying it.

[Rob Ingram]

@spfister336 no, during configuration, the primary unit's policies are synchronized to the secondary unit.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/high-availability.html

[spfister336]

OK, thank you.... we're trying this kind of late in the day and I didn't want to deal with any surprises.

[spfister336]

Everything seemed to go OK with the HA setup, but I wasn't sure where to get the MAC addresses for the virtual MAC address step, so I haven't put anything in yet. Where do I get those?

[balaji.bandi]

You can add your own MAC as an example shown below :

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html

Note: some notes mentioned well to have, some have different, I have 2 different setups one with MAC (which cisco suggested the way I deployed) and one without any MAC configured, (done before we took over and test) both working as expected.

More information can be found in the link provided by other posts.

[spfister336]

Do I just make up MAC addresses?

[SinghRaminder]

You can as long as the format is good and are not being used in the Network already

I have seen people using the Same MAC address as the existing ASA on the FTD so there is no downtime with respect to ARP cache and mac address table entries

[Marius Gunnerud]

You do not need to make up MAC addresses.  If you do not provide "user defined" MAC then the FTDs will generate their own.