cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1069
Views
0
Helpful
3
Replies

Cisco 8130 firepower High availability

sifathmirza
Level 1
Level 1

Hi all,

    I have two cisco 8130 firepower NGIPS with six 10g ports (three 10 Gbps LR Fiber Network Modules). i have to implement  HA in transparent in-line mode. Can i use 10g link as HA ? or i need to purchase 1G network module .. 

3 Replies 3

Marvin Rhoads
Hall of Fame
Hall of Fame

While the documentation says

Firepower 82xx Family and 83xx Family devices require a 10G HA link, while other model devices require a 1G HA link.

(source page 10 here: link)

... I understand those to be minimum requirements. They are based on having to handle the state synchronization between the devices. Having more bandwidth available should not affect that.

To be absolutely certain, I would recommend you open a TAC case.

Thanks Marvin,

                without state sharing interface ,can we do High Availability for transparent in-line mode for the attached topology .if possible please let me know what is the minimum requirements in network side (core-switch). 

Thank you ,

Ah OK, I didn't carefully note that you were talking about transparent inline mode - I was focusing on the HA bit.

Look in the document I linked earlier at page 3 where we read:

You determine how to configure 7000 or 8000 Series device high availability depending on your Firepower System deployment: passive, inline, routed, or switched. You can also deploy your system in multiple roles at once. Of the four deployment types, only passive deployments require that you configure devices or stacks using high availability to provide redundancy. You can establish network redundancy for the other deployment types with or without device high availability.

Based on that, you will see further down in the guide it informs us regarding Inline Deployment Redundancy thus:

Because an inline set has no control over the routing of the packets being passed through it, it must always be active in a deployment. Therefore, redundancy relies on external systems to route traffic correctly. You can configure redundant inline sets with or without 7000 or 8000 Series device high availability.

To deploy redundant inline sets, you configure the network topology so that it allows traffic to pass through only one of the inline sets while preventing circular routing. If one of the inline sets fails, the surrounding network infrastructure detects the loss of connectivity to the gateway address and adjusts the routes to send traffic through the redundant set.

Based on that, your topology would work fine without an HA link between the two 8130s.

There are some details that arise from how your firewall pair is configured. Assuming Active-Standby HA pair with a single context in routed mode - that is simple as the traffic normally goes via one or the other link and never both.

Hope this helps.

Review Cisco Networking for a $25 gift card