cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
9157
Views
0
Helpful
3
Replies

FTD HA Packet-Tracer Output

mumbles202
Level 5
Level 5

Working on a pair of 2130s running 6.2.3.12 and setup in HA.  Having some issues with traffic passing from 1 interface to another even though the policies look correct.  At present the secondary unit is the Active unit in the pair.  If i go into advanced troubleshooting on the secondary (Active) unit and go through packet-tracer I get this result:

 

Result:
input-interface: Inside
input-status: up
input-line-status: up
output-interface: Device_Management
output-status: up
output-line-status: up
Action: drop
Drop-reason: (fo-standby) Dropped by standby unit

 

However if I run through the same packet-tracer on the primary (now Standby unit) I get this:

 

Result:
input-interface: Inside
input-status: up
input-line-status: up
output-interface: Device_Management
output-status: up
output-line-status: up
Action: allow

 

I'll have access to some equipment tomorrow to actually get a packet capture for review but was curious as to why I'm seeing the results I am in packet-tracer.  I saw a bug (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf72068/?rfs=iqvred) but that applies to different devices and these units aren't in transparent mode.

3 Replies 3

Never came across this before, but it looks like a bug to me. Based on my experience, the FTD 6.2.3.x is not stable and has a bunch of bugs. I would raise a TAC if upgrading it is not an option.

Could you issue show failover on the standby (active) unit just to verify the failover status.  Also, Could you check the connected switch ARP table to verify that the standby FTD MAC address has been associated with the Active unit IP.

Also, you say that the bug you posted applies to different devices, which devices do you have installed?

--
Please remember to select a correct answer and rate helpful posts

Thanks for the reply.  Going directly to the FTDs the Primary unit was in fact the Active and the FMC was wrong.  Forcing the re-sync corrected the status.  

Review Cisco Networking for a $25 gift card