Cisco NGFW 4100 Cluster with Active/Active setup

[dngore]

Hi Expert,

Customer is looking for Active/Active deployment for NGFW 4100. The solution is to use firewalls in cluster setup and make A/A by using Etherchannel load balancing scheme.

Queries are:

1. Can it be deployed for two firewalls setup?

2. Will Master unit entertain user traffic?

3. Any issues/limitation for cluster in two firewall deployment?

Kindly share your thoughts on same.

[balaji.bandi]

You can not have Active/Active with single context. Active/Active only with Multi Context

here is single context Master / Slave

Multi-context

context A  Primary / Other until slave

context B  Salve / Other untl is Active.

here is the design guide

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_threat_defense_cluster_for_the_fxos_chassis.html#concept_491990D3D9574F4DA5B15BA191E9D60E

[dngore]

Hi,
As per my understanding, FP4100/9300 supports Active/Active in cluster deployment. Active/Active is achieved by etherchannel load balancing algorithm : src-dst-IP or src-dst-ip-port.

Here is the link:
https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_threat_defense_cluster_for_the_fxos_chassis.html#concept_b1f_35n_sz