FTD · FAILOVER

FTD-style: register two firewalls on the manager, then make them a pair

The order used on a real FMC: first each firewall points at the manager (configure manager add), then the manager adds both devices, then F1 gets its interfaces and policies, and only then do you make the High Availability pair. The manager already has its address, Evaluation Mode, and the policies ACP1 and NAT1. F1 (10.0.0.1) and F2 (10.0.0.2) have their management addresses, and nothing else.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router and switches · 5 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On F1’s and F2’s consoles: configure manager add 10.0.0.5 LABKEY.
FTD Manager, Devices › Device Management › Add › Device: F1 at 10.0.0.1 and F2 at 10.0.0.2, registration key LABKEY.
F1’s interfaces: inside Gi0/0 192.168.1.1 (standby 192.168.1.2) in INSIDE, outside Gi0/1 203.0.113.1 (standby 203.0.113.2) in OUTSIDE; a default route on outside to 203.0.113.9; assign ACP1 and NAT1; deploy F1.
Add › High Availability: HQ-PAIR, primary F1, secondary F2; page 2: Gi0/3, FOLINK, 10.255.255.1 and 10.255.255.2, 255.255.255.252, key LABKEY. Deploy. F1 is active and F2 Standby Ready.
PC1 reaches 198.51.100.1, and F2’s show failover says Secondary - Standby Ready.

Start this lab

Before you start

Register both units before you make the pair, and give the primary its configuration first: the secondary takes it over. Don’t configure the secondary on its own; the pair overwrites it.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.