FTD to 9400 Etherchannel in suspended state for clustering

[dbotelhosybistech]

In configuring FTD  cluster mode, 2 4115 appliances have channel-group 48 configured and both FTD's are connected to a 9400 with a channel-group 48.  I can get only 1 interface in the ether channel up at a time.  One is always in a suspended state.

FXOS 2.11 and FTD 7.0

[balaji.bandi]

Do you have any diagram of how these are connected? Can you post Catalyst side config? is the catalyst switch 1 or they are in SVL?

some troubleshoot and configuration information may help you :

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/regular_firewall_interfaces_for_firepower_threat_defense.html

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215351-configure-verify-and-troubleshoot-port.html

[marce1000]

         - Check the logs on the 9400 . when the etherchannel connect attempt is being made.

 M.

[dbotelho1]

I attached the diagram I found that cleared it ip for me.  On the switch side I needed 2 different port-channels, 1 for each FTD

 

[Marvin Rhoads]

@dbotelho1 yes - because, unlike the Nexus switches, the FTD devices have no construct equivalent to VPC that allows them to behave as a single device at layer 3.

For other readers, also be sure to always connect the CCL via switches. Otherwise you can end up with split brain issues in your cluster.

[balaji.bandi]

yes, that is the suggested setup, Hope you are able to resolve the issue, making them different port-channel towards nexus.