Cisco Secure Firewall Threat Defense High Availability configuration with existing FTD – How to Tutorial

In this Tutorial I will configure Secure Firewall Threat Defense (originally – Firepower Threat Defense) (FTD) High Availability setup (Active/Standby failover) with one existing FTD Appliance (ftd1) and one new FTD Appliance (ftd2).

This process is commonly used if there is already one Firewall Threat Defense in production environment and the second Firewall Threat Defense must be added because of the high-availability needs into the HA Active/Standby “cluster” without changing network Gateway IP configuration on all devices in the network.

Both Firewall Threat Defense Appliances must meet following conditions:

• Same model.
• Same version- this applies to FXOS and to FTD – major (first number), minor (second number), and maintenance (third number) must be equal.
• Same number of interfaces.
• Same type of interfaces.
• Both devices as part of the same group/domain in FMC.
• Have identical Network Time Protocol (NTP) configuration.
• Be fully deployed on the FMC without uncommitted changes.
• Be in the same firewall mode: routed or transparent.

Source:

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html#toc-hId-967890738

Before the start of the configuration it is recommended to create backups of the FTD Appliance and Firewall Management Center (FMC).

Prerequisites:

• running Cisco Secure Firewall Management Center
  • Cisco Secure Firewall Management Center Virtual Install – How to Tutorial
• running Cisco Secure Firewall Threat Defense (FTD) already connected with Firewall Management Center
  • Cisco Secure Firewall Threat Defense Virtual Install – How to Tutorial
• new Firewall Threat Defense (FTD) already registered with Firewall Management Center (FMC)