Cisco FTD 1010 needed switch between it and the ISP to come up

[Travis-Fleming]

I recently came back from implementing my 12th Cisco FTD 1010 device to a remote site and this one was a bear. The outside interface would not come up no matter what I did. No link lights, but the FMC showed the port was enabled, but down. We called the ISP (AT&T) who has a Ciena router as the default gateway next hop device. They assured me the port was properly configured for their side and enabled.

What I ended up having to do was plug the outside interface of the 1010 into a segregated VLAN on a switch that then connected to the ISP and it came up instantly.

Has anyone else had any experience with this or any ideas of what may have caused this? I find it odd that the interface would not come up until a switch was put as an intermediate in between the 1010 and the ISP Ciena router.

[Marius Gunnerud]

Do you know if the Ciena interface was hardcoded speed and duplex?  Sounds like the FTD1010 and the router were not able to agree on something.

Also, what type of interface on the Ciena router interface compared with the interface you are using on the FTD10101? for example, 1Gig, 10Gig, etc.

[Travis-Fleming]

Thank you for the reply Marius. Their device was indeed hardcoded for 100 MB and full duplex, so on our FTD we matched those settings. I do not know what type of interface they have in terms of 1Gig or more.

Even if the duplex and speed mismatched would the link light at least come up though you think? I've had that with MPLS routers when we upgrade speeds the ISP decides to hard code instead of auto-negotiate, but the link lights come up it just works like poo.

[Marius Gunnerud]

I have encountered situations with Nexus switches and FTD where one of these devices are set to auto negotiate and the uplink is hardcoded to a lower speed than what the interface defaults to and the link doesn't come up (interface up / line protocol down).  We have always solved this by setting the hardcoded side to auto but we have had the luxury of doing so.

Did matching up the speed and duplex solve your issue?

[Travis-Fleming]

What we ended up doing is we also had an ISR 4331 with a 4 port switch NIM in it with spare ports 1U down. So we created a segregated vlan on two of the ports and used it as an intermediate. Then the dmarc plugged into the switch, then switch to 1010 and it came up. It is odd to us the ISP said their device was set to hard coded 100 MB and full duplex, and even when we did that to our 1010, a link light was not produced.

I have to wonder if the ISP tech was just stating that, and in reality it was not correctly set. We may never know, but we are up now.

Odly enough my manager here when he setup our Cisco ASA 5516 with our Nexus 7K had the same problem as you described and had to resolve it in the same manner. So there has to be something to that.