FMC FTD HA Cluster

[kamensky@kronovision.sk]

Hello community,

currently we are facing a challenge to build FTD HA cluster using FMC while using the same interface for DATA and MANAGEMENT traffic processing.

However it turned out that on FTD models 1150 such setup is not supported. When building up a cluster we get message: "High availability not supported on this model for devices enabled for Management access through data interfaces".

In case we use our available public IPs for management interfaces to separate DATA and MANAGEMENT traffic there will be no left for outside interface to build VPN tunnel. In case we use private IPs for management interfaces we will not be able to publish any changes from FMC in case VPN tunnel will be down.

I would like to ask you what is the best practice to follow in such scenario.

Also I would like to ask you, in case we use public IPs for management interface, is there a way to secure this interface which will be facing public internet? (like limit access only from certain IPs, or deny ICMP, etc...)

Thanks a lot for any valuable information on these topics!

[MHM Cisco World]

FTD HA active/standby or cluster ?

MHM

[kamensky@kronovision.sk]

HA active/ standby

[MHM Cisco World]

MHM

[Marvin Rhoads · Accepted solution]

FYI version 7.4 added support for this feature.

High Availability/Scalability
Manage threat defense high availability pairs using a data interface.	7.4.0	7.4.0	Threat defense high availability now supports using a regular data interface for communication with the management center. Previously, only standalone devices supported this feature. See: Using the Threat Defense Data Interface for Management

[kamensky@kronovision.sk]

Thanks a lot for info, tested, working.