cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2206
Views
0
Helpful
3
Replies

restart a FTD in a HA pair.... do i pause HA first...or just 'restart'

EDWICK QUILES
Level 1
Level 1

howdy folks

if i am t-shooting a weird behaviour coming out of one site, we have 2100-series FTD  pair.

should i PAUSE HA first....then do Restart Device via FMC....or simply Restart Device on the Secondary (non-active) unit....

then do a Failover....wait....and then do a Restart Device on the new Secondary (thereby having restarted both)

essentially i'm asking whether i can just 'restart device' on whichever is non-active....or if i should PAUSE HA between these sequences.

thnx for any feedback.

Ed

1 Accepted Solution

Accepted Solutions

@EDWICK QUILES assuming its a functioning HA pair then you should be able to restart the secondary without pausing. Before rebooting the secondary, confirm HA is functioning correct by running "show failover" from the CLI. Once the secondary is online again, from the CLI run "show failover" to confirm the secondary is "Standby Ready" at which point you can reboot the Primary/Active firewall - failover should automatically occur to the secondary, which would become active.

View solution in original post

3 Replies 3

@EDWICK QUILES assuming its a functioning HA pair then you should be able to restart the secondary without pausing. Before rebooting the secondary, confirm HA is functioning correct by running "show failover" from the CLI. Once the secondary is online again, from the CLI run "show failover" to confirm the secondary is "Standby Ready" at which point you can reboot the Primary/Active firewall - failover should automatically occur to the secondary, which would become active.

thnx @Rob Ingram , i have SNTC but can be slow to go thru TAC for 'easy-peasy' stuff like this.... i appreciate it. -E

Hello Rob,

something is not right here looks like. The test case is below.

TEST CASE - Reload standby firewall and make sure connectivity to workloads behind HA pair is not impacted. Testing on FTD version 7.2.5

  • we have two vFTD Devices in HA pair managed by vFMC.
  • FW-1 is active and FW-2 is standby.

"Show failover" command confirms the status and all good.

Then I run continuous pings to test workloads sitting behind this firewall pair. After that I reload the FW-2 and I monitor the live reload of FW-2 via vCenter Console as these are virtual firewalls. When FW-2 comes back up and seen by FW-1, then at the same time I see pings going down for 2 minutes. Not sure why this is happening and it is kind of very weird as active FW(FW-1) should be non-disruptively passing the traffic while configuration replication and sync happens with the rebooted standby FW(FW-2). I also tried with HA suspend on the secondary firewall FW-2 and then doing a reload on it but no luck and same issue occurs where pings are lost for 2 minutes. 

Then I did a failover from FW-1 to FW-2 and FW-2 became active. Then I did a reload on FW-1 and once it comes up after reboot same issue encountered where pings are lost for 2 minutes. We are running version 7.2.5

Any information provided here will be much appreciated.

 

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card