03-12-2017 12:49 AM - edited 03-10-2019 06:47 AM
Hi all,
I have two cisco 8130 firepower NGIPS with six 10g ports (three 10 Gbps LR Fiber Network Modules). i have to implement HA in transparent in-line mode. Can i use 10g link as HA ? or i need to purchase 1G network module ..
03-12-2017 04:00 AM
While the documentation says
Firepower 82xx Family and 83xx Family devices require a 10G HA link, while other model devices require a 1G HA link.
(source page 10 here: link)
... I understand those to be minimum requirements. They are based on having to handle the state synchronization between the devices. Having more bandwidth available should not affect that.
To be absolutely certain, I would recommend you open a TAC case.
03-12-2017 04:57 AM
03-12-2017 05:42 AM
Ah OK, I didn't carefully note that you were talking about transparent inline mode - I was focusing on the HA bit.
Look in the document I linked earlier at page 3 where we read:
You determine how to configure 7000 or 8000 Series device high availability depending on your Firepower System deployment: passive, inline, routed, or switched. You can also deploy your system in multiple roles at once. Of the four deployment types, only passive deployments require that you configure devices or stacks using high availability to provide redundancy. You can establish network redundancy for the other deployment types with or without device high availability.
Based on that, you will see further down in the guide it informs us regarding Inline Deployment Redundancy thus:
Because an inline set has no control over the routing of the packets being passed through it, it must always be active in a deployment. Therefore, redundancy relies on external systems to route traffic correctly. You can configure redundant inline sets with or without 7000 or 8000 Series device high availability.
To deploy redundant inline sets, you configure the network topology so that it allows traffic to pass through only one of the inline sets while preventing circular routing. If one of the inline sets fails, the surrounding network infrastructure detects the loss of connectivity to the gateway address and adjusts the routes to send traffic through the redundant set.
Based on that, your topology would work fine without an HA link between the two 8130s.
There are some details that arise from how your firewall pair is configured. Assuming Active-Standby HA pair with a single context in routed mode - that is simple as the traffic normally goes via one or the other link and never both.
Hope this helps.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide