Configure Virtual MAC Addresses for FTD HA

Introduction

This document describes how to configure Virtual MAC addresses on a Firewall Threat Defence (FTD) High-Availability (HA) pair.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Secure Firewall Threat Defense (FTD)
• Secure Firewall Management Center (FMC)

Components Used

• FMC virtual version 7.2.8
• FTD virtual version 7.2.7

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Configuring virtual MAC addresses on an FTD HA pair is beneficial to the availability of a network. Virtual MAC addresses allow the primary and secondary FTD to maintain consistent MAC addresses which prevents certain traffic disruptions.

Without virtual MAC addresses configured, each unit of the HA pair boots using its burned-in MAC addresses. In the event the secondary unit boots without detecting the primary unit, it becomes the active unit and uses its burned-in MAC addresses. When the primary unit is eventually brought online, the secondary unit obtains the primary unit's MAC addresses which can cause network disruptions. New MAC addresses are also used if the primary unit is replaced with new hardware. Having virtual MAC addresses configured on the devices protects against this disruption. This is because the secondary unit knows the primary units MAC addresses at all times and continues using the correct MAC addresses when it is the active device, even if it comes online before the primary unit.

Note: The terms Virtual MAC address and Interface Mac address can be used interchangeably.

For additional information on the benefits of this configuration, refer to this guide.

Configuration

1. From the FMC GUI, navigate to the Devices page and edit the HA pair by clicking the pencil icon on the far right.

FTD HA Pair

2. Under the High Availability tab, locate the box labeled Interface MAC Addresses. Click the + icon to access the editor.

Interface MAC Addresses Box

3. From the editor, select the Physical Interface and configure the Active/Standby Interface Mac Addresses. Click OK when completed.

Interface Mac Address Creation

Note: When configuring the virtual MAC addresses, it is helpful to adhere to a standard convention. The addresses within the interfaces need to be valid MAC addresses but can be arbitrary in nature. Using a standard convention allows for ease of management when checking the upstream or downstream MAC address tables. MAC address formatting requires 12 hexadecimal digits with periods separating each set of 4 digits.

4. Repeat the process for any remaining interfaces needing virtual Mac address configurations.

5. Confirm the configurations are correct.

Interface Mac Address Configurations

6. Save and Deploy the configurations to the FTD HA pair.

Verification

From each of the devices running configurations, the virtual Mac addresses now appear.

Primary (active) FTD:

Show Run Failover Results

Show Interface Inside Results

Show Interface Outside Results

Secondary (standby) FTD:

Show Run Failover Results

Show Interface Inside Results

Show Interface Outside Results

This confirms the configuration was successful.