FTD · FAILOVER

FTD-style: two managers as a high-availability pair

One manager is a single point of failure for every change and deployment (traffic keeps flowing without it, but nobody can change a rule). Two managers can work as a pair. One is active: it takes every change and deploys. The other is the standby: it copies the active one and is read-only. MGR1 (10.0.0.5) already manages FTD1 and has its policy. MGR2 (10.0.0.6) is new and empty. On a real management center you build the pair on Integration › Other Integrations › High Availability, and there are no console commands for it: the manager-ha lines here are RouteBuddy’s own, so that you can see what each click sends.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 5 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On MGR2 (the empty one), Integration › High Availability: make it the secondary, with the primary’s address 10.0.0.5 and the registration key HAKEY. It now waits.
On MGR1: make it the primary, with the secondary’s address 10.0.0.6 and the same key. The pair forms: MGR1 is active, and MGR2 copies FTD1 and its policies.
Try a change on MGR2: it is refused, because the standby is read-only. Then on MGR2 choose Switch Peer Roles. MGR2 is active, and FTD1’s show managers names it.
On MGR2, now the active one: add access rule WEB-OUT to ACP1 (allow, INSIDE to OUTSIDE, any to any, TCP, log) and deploy to FTD1.
Switch back on MGR1. MGR1 is active again, it has the rule WEB-OUT that was made on MGR2, and PC1 still pings 198.51.100.1.

Start this lab

Before you start

Secondary first, primary second: the primary registers the secondary. The secondary must be empty, and both need the same key. show manager-ha says what is missing. Pause Synchronization keeps changes on the active unit until you resume. Break HA leaves the unit where you click it with the devices, and the other one empty. RouteBuddy has no clock, so nothing fails over by itself: when the active manager is gone you choose Make Me Active on the standby, as on a real pair.

Concept

Two managers work as one: active and standby

A manager is not in the traffic path, so the network keeps working when it is down. But nobody can change a rule or deploy until it is back. Two managers can work as a pair. The active one takes every change and talks to the firewalls. The standby copies the active one and is read-only. The firewalls belong to the pair, so they follow whichever unit is active.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.