Making changes on the interfaces on the Secondary Standby FTD while Primary FTD is running

[Pahee Nagulan]

We have 2x 2120 Cisco FTDs(managed by FMC) in the DMZ.  Primary/Active FTD has a single L3 link to EDGE 1 and Secondary/Standby FTD has a single L3 to EDGE-2 switch. We are planning to deploy VPC on the EDGE switches where each FTD is going to have two legs to the EDGE switches(One is to EDGE-1 and the other one is to EDGE-2). We would like to reduce the outage on the DMZ. So my question is, Can I make changes on the Secondary Standby FTD(Single layer 3 interface to Layer 3 Port channel) while Primary FTD is being active(It's running with single L3). Once I build the port-channel on the Secondary Standby FTD, I will do a failover to make that active. Then change the interfaces on the Primary FTD.

[balaji.bandi · Accepted solution]

You can only Make changes on Primary all the time, ( you can not make any changes on Secondary interm of config).

i am sure you need small downtime (or maintenance window) while conergence take place from single link to Port-chanel move config time.

[Marvin Rhoads · Accepted solution]

Besides what @balaji.bandi correctly noted, changing single interface to a 2-member portchannel interface is particularly challenging. Assuming you want to retain the same interface name (and associated zone and inferface group) you have to essentially remove it altogether and then re-add it anew.

[Pahee Nagulan]

Thank you @balaji.bandi @Marvin Rhoads for taking your time to reply to my question. When I'm removing the existing L3 interface config(and associated zone and interface group) on the FTDs, will that wipe-out the config on routing and policies associated with that interface and security zone on the FTD?

[balaji.bandi · Accepted solution]

The Interface config no longer valid, you need created associated config to reflect. and clean up old config.

[Pahee Nagulan]

Thanks @balaji.bandi for confirming.