Interfaces on Secondary Firewall "Not receiving packets"

[adamgerber]

Hi

I have x2 4115's in Active Passive HA.

On my FMC, I'm getting critical health alerts for the secondary/passive firewall "not receiving any packets" on some of its subinterfaces. Is this normal or a bug? Or an issue with my health monitoring policy? I would like to eliminate these alerts. I have another HA pair of 1140's on the same FMC and don't get this issue. Weird how it's only complaining about a few random subinterfaces?

Any help would be appreciated.

KR,
Adam

[MHM Cisco World]

FMC Interface 'DataplaneInterface0' is not receiving any packets - Cisco Community

[adamgerber]

Hi - that thread is regarding ASA's with separate SFR modules. I am dealing with x2 FTD's in an HA pair. I dont want to disable interface monitoring for the HA Pair.

[MHM Cisco World]

Yes friend I know the FW platform is different but in end the FMC is same.
this behave I think is similar. 

[adamgerber]

I expected different behavior since the FMC is aware of the a/p HA and again why is it only complaining about 4 out of 9 sub-interfaces. Might be a bug then?

[MHM Cisco World]

4 of 9 subinterface <<- are all are config as HA monitor ? if all then  think contact TAC it can be bug and there is solution or workaround for it.

[adamgerber]

Hi - Yes they are enabled with failover monitoring.

[Rob Ingram]

@adamgerber 

Symptom: Critical health alerts for Interface Status stating that interfaces are not receiving any packets are seen on the FMC for the standby FTD, which is not supposed to be processing traffic, so this is a normal and expected behavior.

Conditions: FTD deployed in High Availability.

Workaround: Blacklist the health alerts for Interface Status.

https://bst.cisco.com/bugsearch/bug/CSCvk05446
https://bst.cisco.com/bugsearch/bug/CSCvb36840

[adamgerber]

Hi all. Fixed by adding standby IP addresses to interfaces.

[Marvin Rhoads]

Enabling interface monitoring for failover with the inclusion of standby addresses is the best solution.

When that's not possible (e.g., HA pair sharing a /30 WAN address), newer versions of FMC will allow you to blacklist just one member of the HA pair for only some interfaces while continuing to monitor the interface on the Primary (and normally active) member..