FTD · FAILOVER

FTD-style: high availability on the device manager (no FMC)

No FTD Manager here: each firewall uses its own device manager, as a small site does. F1 is configured and working. F2 has only finished its setup, and a cable joins the two Gi0/3 ports. You make the pair from each device manager’s Device › High Availability page: the primary first, then the secondary, which takes its configuration from the primary.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router and switches · 5 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On F1’s Device Manager, Device › High Availability: Primary Device, failover link GigabitEthernet0/3, primary IP 10.255.255.1, secondary IP 10.255.255.2, netmask 255.255.255.252, the same interface for the stateful link, IPsec key LABKEY, Activate HA. F1 is active, and its peer Failed for now.
On F2’s Device Manager, the same page: Secondary Device, Paste from Clipboard, key LABKEY, Activate HA. F2 becomes Standby Ready and copies F1’s configuration.
On F1, Interfaces: give inside the standby IP 192.168.1.2 and outside 203.0.113.2, then deploy. F2’s interfaces take the standby addresses.
PC1 reaches 198.51.100.1.
On F1’s High Availability page, Switch Mode. F2 is active and PC1 still reaches 198.51.100.1.

Start this lab

Before you start

Configure the primary first: the secondary’s configuration is replaced by the active unit’s when it joins. The failover port must have no name. Afterwards, make changes on the active unit only: the standby refuses them and copies what the active unit deploys.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.

Concept

The screens and the console do the same thing

A manager’s screens are forms that produce configuration lines. Here every screen shows those lines before it sends them, and the console takes the same lines, so either way gives the same result. A managed firewall’s own management address and manager stay on its console, because the manager reaches it through them.