Cisco Firepower 9300 Multi-Instance HA

[mikiNet]

Hello Guys,

I have a question about HA (Failover Active/Standby) for Multi-instance deployment. In ASA platform with multicontext I setting failover on system context and I using only one link between devices (state link cover on failover link) with one IP address and one vlan, but what about multi-instance ha ? Is it the same configuration ? Or I need to configure one-to-one (ip, vlan) per instance? For example I have two FPR9300, I setup 6 instances, so for failover I need to create six subnets for failover and six vlan for it ? Any guide not telling anythink about it .... I only saw that links can share the same physical interface. 

[Marvin Rhoads · Accepted solution]

Each instance needs a failover interface. Best practice would be 6 unique subnets, but they could be separate VLANs all addressed the same since they have no knowledge of each other IP-wise. You can share a parent interface for all of them if you like.