FMCv HA issue with FTD 2120

[MTN_CY]

Dear Community,

I'm trying to build HA on FMCv for two ftds 2120.

The specs of the devices are:

FMCv: 6.3.0 software 

FTD 2120: Cisco Firepower 2120 Threat Defense (77) Version 6.2.3.10 (Build 59)

During the HA procedure all prerequisites are met, I'm able to choose the interfaces for the failover and afterwards I get the following error:

On System-->Tasks-->: High availability configuration could not be updated on the primary device <Devices' Name>

and on

System-->Deployments:  

Other logs 
May 5 18:20:49 Unable to open /var/cisco/deploy/sandbox///network_analysis/snort.conf.abba00a0-cf29-425c-9d75-49699aadc898 for appending 

Has anyone seen this issue before?

Thanks in advance.

Stelios

[Marvin Rhoads]

FMCv does not currently support high availability.

6.3 (your version) reference:

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/firepower_management_center_high_availability.html#ID-2242-0000039a

6.4 (current latest version) reference:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/firepower_management_center_high_availability.html#ID-2242-0000039a

[MTN_CY]

Hi Marvin,

Thanks for the reply.
I'm not looking HA for FMCv but for the ftds which are managed by FMCv.

Thanks.

[Marvin Rhoads · Accepted solution]

OK - that should definitely be supported.

Have you ever managed either FTD device before? It often helps to deploy to them first so that SRUs (Snort Rule Updates), VDB version etc. are all in sync before starting.

If that all looks good then I'd recommend opening a TAC case. They can dig deep in the logs and remedy the root cause for you.

[MTN_CY]

Hi Marvin,

I'm new to FTD, ok i will do what you suggested and if it doesn't work I will reach TAC.

Thanks for your help.

[Marvin Rhoads]

You're welcome. Keep us posted on the outcome.

[MTN_CY]

Snort Rule Update did the work!!!
Now HA is working smoothly.

Thanks a lot Marvin :)

[Marvin Rhoads]

That's great to hear.

FMC can be particular about Snort rule sets being in sync before allowing FTD or Firepower service module upgrades so I thought it might similarly object to it during creation of an HA pair.