Loading...
Loading...
In an FTD HA pair with monitored interfaces, an interface on the Active device will be stuck in "Normal (Waiting)" status. The Standby device for the same interface will show "Normal (Monitored)" status. The interface status follows the Active device upon failover. Failover works as designed. BEFORE FAILOVER: > show monitored-Interface This host: Primary - Active Interface Outside (10.10.20.2): Normal (Waiting) Other host: Secondary - Standby Ready Interface Outside (10.10.20.3): Normal (Monitored) AFTER FAILOVER: > show monitored-Interface This host: Primary - Standby Ready Interface Outside (10.10.20.2): Normal (Monitored) Other host: Secondary - Active Interface Outside (10.10.20.3): Normal (Waiting) Taking packet captures on the interfaces for the hello packets we can see both the Active and Standby devices sending/receiving hello packets. This suggest the monitored interface status is incorrect and a cosmetic issue. CAPTURES: Lab_FTD1# cap FTD1_hello Outside trace match ip host 10.10.20.2 host 10.10.20.3 Lab_FTD2# cap FTD2_hello Outside trace match ip host 10.10.20.3 host 10.10.20.2 Lab_FTD1# show cap FTD1_hello 1: 10:23:40.420542 802.1Q vlan#101 P0 10.10.20.2 > 10.10.20.3 ip-proto-105, length 48 2: 10.23.43.420927 802.1Q vlan#101 P0 10.10.20.3 > 10.10.20.2 ip-proto-105, length 48 We can see the hellos "ip-proto-105" being sent/received.
FTD HA pair running 7.2.9
Disable interface monitoring
According to the 7.2 FMC Device Configuration Guide, the interface status of "Normal (Waiting)" means the interface is up but has not yet received a hello packet from the corresponding interface on the peer unit. As the Standby device interface status is correct with "Normal (Monitored)", it would mean the Active device isn't receiving this hello packet but is sending it. 7.2 Guide: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/high-availability.html - See section "Interface Status" for reference.
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.