Firepower Failover behavior

[Wrecktangle]

Context: Just got an pair of FTD 4140s and 2140s HA configured.  They're at v7.0.5 with vFMC and wondering how the FTDs handle failover scenarios.  For this question, monitoring is enabled for L2 and L3 interfaces and I have a single Inside (access) and Outside (trunked) configured for each appliance (just for the example, not actual config).

The Question: Is there a difference in the failover behavior when an entire appliance goes offline versus when an interface goes offline?  For example and pretty obvious, if my primary (active) 4140 goes offline for whatever reason, the standby will become active.  However, what if an individual interface, L2 or L3, on the primary (active) goes offline?  Does the interface itself failover to the standby?  Or does the entire standby unit become active?

Addt'l Question: Does the failover behavior change when Etherchannel/Port-channels are configured?

Regards,

Wreckt

[Rob Ingram]

@Wrecktangle by default the failure of an interface on the Active Firewall (whether it's physical or logical) would cause the standby FTD appliance (the entire standby unit) to become active.

[Wrecktangle]

---

@Rob Ingram wrote:(whether it's physical or logical) would cause the standby FTD appliance (the entire standby unit) to become active.

---

Assuming this includes etherchannel/port-channels (logical), why would one use an etherchannel/port-channel say in the case of a 2 or 4-port etherchannel if it will failover if any of those ports go down?

[Rob Ingram · Accepted solution]

If the portchannel was dedicated per interface, then all interfaces would need to go down to dictate a failover.

If you were using sub interfaces on the portchannel and the sub interface went down, that would cause a failover.

[Wrecktangle]

Appreciate the enlightenment!

[Eric R. Jones]

This is the information I used when deploying our FTD's with FMC frontend. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/fdm/fptd-fdm-config-guide-630/fptd-fdm-ha.html