Multi Instance FTD Config

[Secure_M10]

I am trying to deploy Multi Instance in 2 Firepower 4100 boxes and have a few questions regarding that :

1. Can i use one physical interface say Eth1/2 as mgmt for 2 logical FTDs and assign the same interface to both instances for ftd mgmt purpose ?

2. Can the same physical interface say Eth1/8 be used as Fail/State Link for both logical devices? i.e. same interface can be assigned to both separate FTD Instances.

Thanks

[Francesco Molino]

Hi

Yes you can share mgmt interface between instances.

For failover interface, you can also share them. Create a vlan to differentiate the failover link for each instances.

Here a doc showing the different use-cases: https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2019/pdf/BRKSEC-3035.pdf

Check Slides 53 and 61

[Secure_M10]

Thank you for the link.. it is very helpful.
However.. is it possible to use only one interface as a State/HA link by tagging it as data-sharing ? is VLAN config necessary ?

[Francesco Molino]

Not sure I got your last question. You want 1 interface for Data and HA Link? This is not possible.

[Secure_M10]

Not one interface for both ..i meant is it necessary to tag VLANs for HA link interface.
Can it be done by selecting that interface as data sharing and then assigning to both instances as it can be done with mgmt interface

[Francesco Molino · Accepted solution]

If you want to use 1 interface for HA and use it against 2 different instances, you must create sub interfaces using vlan. You won't be able to attach a HA to an instance already attached to another instance.