Skip to content

High Availability

Location in GUI: Devices » Device Management » High Availability

Diagram

Diagram

Classes

devices (fmc.domains)

NameTypeConstraintMandatoryDefault Value
ha_pairsList[ha_pairs]No

ha_pairs (fmc.domains.devices)

NameTypeConstraintMandatoryDefault Value
nameStringNo
primary_deviceStringNo
secondary_deviceStringNo
ha_link_logical_nameStringNo
ha_link_interface_nameStringNo
ha_link_primary_ipIPNo
ha_link_secondary_ipIPNo
ha_link_netmaskIPNo
state_link_use_same_as_haBooleantrue, falseNo
actionChoiceSWITCHNo
encryption_enabledBooleantrue, falseNo
encryption_keyStringNo
encryption_key_generation_schemeChoiceAUTO, CUSTOMNo
failed_interfaces_limitIntegermin: 1, max: 211No1
failed_interfaces_percentIntegermin: 1, max: 100No
ha_link_use_ipv6Booleantrue, falseNo
interface_hold_timeIntegermin: 25, max: 75No
interface_poll_timeIntegermin: 1, max: 999No
interface_poll_time_unitChoiceSEC, MSECNo
peer_hold_timeIntegermin: 3, max: 999No
peer_hold_time_unitChoiceSEC, MSECNo
peer_poll_timeIntegermin: 1, max: 999No
peer_poll_time_unitChoiceSEC, MSECNo
state_link_interfaceStringNo
state_link_logical_nameStringNo
state_link_netmaskStringNo
state_link_primary_ipIPNo
state_link_secondary_ipIPNo
state_link_use_ipv6Booleantrue, falseNo
interfacesList[interfaces]No

interfaces (fmc.domains.devices.ha_pairs)

NameTypeConstraintMandatoryDefault Value
interface_logical_nameStringNo
ipv4_standby_addressIPNo
monitor_interfaceBooleantrue, falseNo

Examples

Prerequisites:

As any new configuration will be made to the primary device, it is important to note the deploy: true value should present on the primary and deploy: false should be present on the secondary for Terraform to manage the deployment of changes from the FMC to the firewalls. If deploy: false is set for all devices, changes will need to be manually deployed after they have been sent to the FMC.

Interface configuration is performed after HA configuration, so interfaces under the vrf: key are only required on the primary. Secondary IP address information is configured via the ha_pairs: block shown below.

fmc:
domains:
- name: Global
policies:
access_policies:
- name: MyAccessPolicyName1
default_action: BLOCK
devices:
devices:
- name: MyDeviceName1
host: 10.62.158.201
registration_key: cisco123
access_policy: MyAccessPolicyName1
deploy: true
licenses:
- ESSENTIALS
performance_tier: FTDv5
vrfs:
- name: Global
physical_interfaces:
- name: "GigabitEthernet0/2"
ipv4_static_address: 10.62.159.201
logical_name: INSIDE
- name: MyDeviceName2
host: 10.62.158.204
registration_key: cisco123
access_policy: MyAccessPolicyName1
deploy: true
licenses:
- ESSENTIALS
performance_tier: FTDv5

High Availability:

fmc:
domains:
- name: Global
devices:
ha_pairs:
- name: MyHAName1
primary_device: MyDeviceName1
secondary_device: MyDeviceName2
ha_link_logical_name: failover
ha_link_interface_name: GigabitEthernet0/2
ha_link_primary_ip: 10.10.4.1
ha_link_secondary_ip: 10.10.4.2
ha_link_netmask: 255.255.255.248
state_link_use_same_as_ha: true
interfaces:
- interface_logical_name: INSIDE
ipv4_standby_address: 10.62.159.202
monitor_interface: true