Cisco Virtual Ftds

[YonasA]

Hello Everyone, 

We have deployed two cisco virtual FTDs on our environment and configure them as HA. Those firewalls are connected with core switch over ospf and they are working seamlessly. However when the standby unit become active it will lose the ospf configuration it had earlier.  But when we move the status to the former one, it works fine. So is there anyone who can guide us to sort out this issue or explain the reason why it loses ospf configuration?

with regards,

Yonas A

[MHM Cisco World]

How it loss the config? Can you more elaborate 

Thanks 

MHM

[YonasA]

Hello MHM,

Like i said before changing the active unit the firewall is connected with the core switch over ospf protocol. Then we would like to change the active unit to standby by shutting down or reload it. By that time the standby unit will become active but it will ospf configuration and can be able to forward traffic to the core switch as the way it should. We dont know why it losses its ospf configuration. 

With regards,

Yonas A. 

[MHM Cisco World]

I dont think it loss ospf config' but issue is

In FW active/standby only active established ospf and standby not participate in ospf' when failover is happened standby need some time to establish ospf with core.

To solve issue and forward traffic use NSF.

MHM

[YonasA]

Can you guide as the optimal steps used to configure NSF. Because i have tried but it does not have any different.

[Flavio Miranda]

@YonasA 

You can configure a device as NSF-capable or NSF-aware. A NSF-capable device can indicate its own restart activities to neighbors and a NSF-aware device can help a restarting neighbor.

Pay attentition to this warning

"Note

 You must not configure the OSPF process to use fast hello packets if you also configure graceful restart. Graceful restart cannot occur with fast hello packets, because the time taken for the role change between the active and standby units is more than the configured dead interval."

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-ospf.html