Firepower NGFW 2110 two Trunk/sub-interfaces to core switch?

[dan hale]

Hi All, I'm replacing a legacy Cisco 3825 ISR that was doing are internal routing and firewall with a Cisco NGFW 2110 using FTD version 6.2.2. at a branch location.

It's basically firewall/router on a stick and I have only two Layer 2 2960-X access switches that are stacked together that it would connect to.

My question is it possible to create two trunk ports/sub-interfaces on the 2110 and have one port on the 2110 go to one switch and another port go to the second switch?

This way if one switch dies I still will be connected to the second switch from the 2110? I would assume that if this is possible that spanning-tree on the 2960-x switches would block one of the uplinks to the 2110.

Thanks,

Dan 

[Francesco Molino · Accepted solution]

Hi

Take a look here is explained.

The answer is yes. You need to configure redundant interfaces, deploy the config and then create sub interfaces on this new logical interface generated after redundant config is deployed.

[dan hale]

Perfect...thanks!

[Francesco Molino]

You're welcome

[dan hale]

An update on this...looks like the 2100,4100, and 9300 do not support redundant interfaces in FTD mode.

"• Redundant interfaces are not supported on the Firepower 2100, Firepower 4100/9300 chassis"

https://www.cisco.com/c/en/us/td/docs/security/firepower/621/configuration/guide/fpmc-config-guide-v621/interfaces_for_firepower_threat_defense.pdf

I imagine if they were in ASA mode they would.

Thanks,

Dan

[Francesco Molino]

Ok my bad, that's why we post the doc to be sure. Redundant interfaces I used them with ASA converted into FTD but never used and didn't get the use case to use them on bigger customer going to FP hardware.

[samuelmaoza80081]

Hie Guys am trying to configure my 2110 firepower ethernet ports as trunk ports but i do not know where to start? any luck

[Milos_Jovanovic]

Hi @samuelmaoza80081,

You can find relenvant information in the config guide.

BR,

Milos