FTD · FAILOVER

FTD-style: failover link Failed - No Switchover

HQ-PAIR is configured and deployed, but its failover link runs through switch SWF, and something on that switch keeps the two units apart. With no mate, each unit makes itself active: F2’s show failover says Failed - No Switchover, Mate Unknown, and the other host Failed, as on a real pair whose link is broken.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router and switches · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On F2, read show failover: the LAN interface is Failed - No Switchover, this host is Secondary - Active, the mate’s version and serial are Unknown, and its interfaces are Unknown (Waiting).
Find why on SWF (show vlan brief) and put both failover ports in the same VLAN, 10.
F2’s show failover now says Secondary - Standby Ready, Mate 9.16(4), and the link (up). F1 is Primary - Active, and F2 copied its interfaces.
PC1 reaches 198.51.100.1.

Start this lab

Before you start

A unit that can’t hear its mate on the failover link assumes the mate is dead and goes active, so a broken link makes two active units. Check the link first: cable, switch port, VLAN. Then read show failover on both units.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.