Firepower Threat Defense (FTD)

Introduction

Devices in an HA pair can be un-paired by executing an HA break action. Each device will revert to single state. This is most easily done if the devices are in a healthy active/standby state. Simply execute the break HA REST request on the active device and wait for both devices to be restored to single state. Otherwise, additional actions may be necessary.

HA break cannot be performed while either device is negotiating HA or synchronizing the HA configuration.

To Perform an HA Break:

Step 1

Send HA status GET requests to both devices, to determine their current HA state.

Request_to_primary
Request_to_secondary
Copycurl -H 'Accept: application/json'  -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.primary.example/api/fdm/latest/devices/default/operational/ha/status/default

Copycurl -H 'Accept: application/json'  -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default

 

Response_from_primary
Response_from_secondary
Copy{
  "nodeRole": "HA_PRIMARY",
  "nodeState": "HA_ACTIVE_NODE",
  "peerNodeState": "HA_STANDBY_NODE",
  "configStatus": "IN_SYNC",
  "haHealthStatus": "HEALTHY",
  "id": "default",
  "type": "hastatus",
  "links": {
    "self": "https://ftd.primary.example/api/fdm/latest/devices/default/operational/ha/status/default"
  }
}

Copy{
  "nodeRole": "HA_SECONDARY",
  "nodeState": "HA_STANDBY_NODE",
  "peerNodeState": "HA_ACTIVE_NODE",
  "configStatus": "IN_SYNC",
  "haHealthStatus": "HEALTHY",
  "id": "default",
  "type": "hastatus",
  "links": {
    "self": "https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default"
  }
}

Step 2

  • If both devices are in SINGLE_NODE state, then HA break is not needed. Stop here.
  • If either device is in HA_CONFIGURATION_SYNC or HA_NEGOTIATING_NODE state, then keep sending HA status requests until the state changes.
  • If either device configStatus property is PRIMARY_IMPORTING_CONFIG or SECONDARY_IMPORTING_CONFIG, then keep sending HA status requests until the status changes.
  • Otherwise, proceed to the next step.

Step 3

Send an HA break POST request to the active device. If neither device is active, select whichever one is not in standby state. Include the URL parameter ?clearIntfs=true if the device is not in active state.

Request_to_active_device
Request_to_non_active_device
Copycurl -X POST -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN" https://ftd.primary.example/api/fdm/latest/devices/default/action/ha/break

Copycurl -X POST -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN" https://ftd.primary.example/api/fdm/latest/devices/default/action/ha/break?clearIntfs=true

 

Response
Copy{
  "id" : "e1b1d88c-bd6b-11e9-a0c2-6f21a3274a42",
  "statusMessage" : null,
  "statusMessages" : null,
  "modifiedObjects" : { },
  "cliErrorMessage" : null,
  "queuedTime" : 1565660665718,
  "startTime" : -1,
  "endTime" : -1,
  "state" : "QUEUED",
  "name" : "HA Break Deployment",
  "deploymentStatusMessages" : [ ],
  "links" : {
    "self" : "https://ftd.primary.example/api/fdm/latest/devices/default/action/ha/break/e1b1d88c-bd6b-11e9-a0c2-6f21a3274a42"
  }
}

Step 4

Send periodic HA break GET requests to the selected device until it reports DEPLOYED state. Append the id from the previous step to the request URL. In the response, search for this line: "state" : "DEPLOYED"

Request
Copycurl -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN" https://ftd.primary.example/api/fdm/latest/devices/default/action/ha/break/e1b1d88c-bd6b-11e9-a0c2-6f21a3274a42

 

Response
Copy{
  "id" : "e1b1d88c-bd6b-11e9-a0c2-6f21a3274a42",
  "statusMessage" : "Deployed successfully",
  "statusMessages" : [ "Deployed successfully" ],
  "modifiedObjects" : {
    "HAConfiguration" : [ "HA_NAME" ]
  },
  "cliErrorMessage" : null,
  "queuedTime" : 1565660665718,
  "startTime" : 1565660666480,
  "endTime" : 1565660667597,
  "state" : "DEPLOYED",
  "name" : "HA Break Deployment",
  "deploymentStatusMessages" : [ {
    "taskName" : "PendingChangesTask",
    "timestamp" : 1565660666406,
    "message" : "Task begin",
    "properties" : {
      "hideFromUi" : true
    },
    "taskState" : "STARTED",
    "type" : "deploymentstatusmessage"
  },
  .... # many more deploymentStatusMessage entries may be included here
  ],
  "links" : {
    "self" : "https://ftd.primary.example/api/fdm/latest/devices/default/action/ha/break/e1b1d88c-bd6b-11e9-a0c2-6f21a3274a42"
  }
}

Step 5

Send periodic HA status GET requests to the selected device until it transitions to single mode state.

Request
Copycurl -H 'Accept: application/json'  -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.primary.example/api/fdm/latest/devices/default/operational/ha/status/default

 

Response
Copy{
  "nodeRole" : null,
  "nodeState" : "SINGLE_NODE",
  "peerNodeState" : "HA_UNKNOWN_NODE",
  "configStatus" : "UNKNOWN",
  "haHealthStatus" : "HEALTHY",
  "id" : "default",
  "type" : "hastatus",
  "links" : {
    "self" : "https://ftd.primary.example/api/fdm/latest/devices/default/operational/ha/status/default"
  }
}

Step 6

Send an HA status GET request to the other device in the HA pair.

Request
Copycurl -H 'Accept: application/json'  -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default

 

Response
Copy{
  "nodeRole" : null,
  "nodeState" : "SINGLE_NODE",
  "peerNodeState" : "HA_UNKNOWN_NODE",
  "configStatus" : "UNKNOWN",
  "haHealthStatus" : "HEALTHY",
  "id" : "default",
  "type" : "hastatus",
  "links" : {
    "self" : "https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default"
  }
}

Step 7

  • If nodeState is SINGLE_NODE, then the HA break is completed. Stop here.
  • If nodeState is not HA_SUSPENDED_NODE then proceed to the next step.
  • Otherwise skip to Step 10.

Step 8

Send an HA Suspend POST request to the device.

Request
Copycurl -X POST -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN" https://ftd.secondary.example/api/fdm/latest/devices/default/action/ha/suspend

 

Response
Copy{
  "nodeRole" : "HA_SECONDARY",
  "nodeState" : "HA_SUSPENDED_NODE",
  "peerNodeState" : "HA_UNKNOWN_NODE",
  "configStatus" : "UNKNOWN",
  "haHealthStatus" : "CRITICAL",
  "id" : "default",
  "type" : "hastatus",
  "links" : {
    "self" : "https://ftd.secondary.example/api/fdm/latest/devices/default/action/ha/suspend/default"
  }
}

Step 9

Send periodic HA status GET requests to the device until it is in suspended state.

Request
Copycurl -H 'Accept: application/json'  -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default

 

Response
Copy{
  "nodeRole" : "HA_SECONDARY",
  "nodeState" : "HA_SUSPENDED_NODE",
  "peerNodeState" : "HA_UNKNOWN_NODE",
  "configStatus" : "UNKNOWN",
  "haHealthStatus" : "CRITICAL",
  "id" : "default",
  "type" : "hastatus",
  "links" : {
    "self" : "https://ftd.secondary.example/api/fdm/latest/devices/default/action/ha/status/default"
  }
}

Step 10

Send an HA Break POST request to the device. Include an URL parameter ?clearIntfs=true to disable interfaces on the secondary device.

Request
Copycurl -X POST -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN" https://ftd.secondary.example/api/fdm/latest/devices/default/action/ha/break?clearIntfs=true

 

Response
Copy{
  "id" : "e372b6ec-bd75-11e9-9d27-f3463e7f50cd",
  "statusMessage" : null,
  "statusMessages" : null,
  "modifiedObjects" : { },
  "cliErrorMessage" : null,
  "queuedTime" : 1565664963617,
  "startTime" : -1,
  "endTime" : -1,
  "state" : "QUEUED",
  "name" : "HA Break Deployment",
  "deploymentStatusMessages" : [ ],
  "links" : {
    "self" : "https://ftd.secondary.example/api/fdm/latest/devices/default/action/ha/break/e372b6ec-bd75-11e9-9d27-f3463e7f50cd"
  }
}

Step 11

Send periodic HA break GET requests to the device until it reports deployed state.

  • Append the id from the previous step to the request URL.
Request
Copycurl -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN" https://ftd.secondary.example/api/fdm/latest/devices/default/action/ha/break/e372b6ec-bd75-11e9-9d27-f3463e7f50cd

 

Response
Copy{
  "id" : "e372b6ec-bd75-11e9-9d27-f3463e7f50cd",
  "statusMessage" : "Deployed successfully",
  "statusMessages" : [ "Deployed successfully" ],
  "modifiedObjects" : {
    "HAConfiguration" : [ "HA_NAME" ]
  },
  "cliErrorMessage" : null,
  "queuedTime" : 1565660665718,
  "startTime" : 1565660666480,
  "endTime" : 1565660667597,
  "state" : "DEPLOYED",
  "name" : "HA Break Deployment",
  "deploymentStatusMessages" : [ {
    "taskName" : "PendingChangesTask",
    "timestamp" : 1565660666406,
    "message" : "Task begin",
    "properties" : {
      "hideFromUi" : true
    },
    "taskState" : "STARTED",
    "type" : "deploymentstatusmessage"
  },
  .... # many more deploymentStatusMessage entries may be included here
  ],
  "links" : {
    "self" : "https://ftd.secondary.example/api/fdm/latest/devices/default/action/ha/break/e372b6ec-bd75-11e9-9d27-f3463e7f50cd"
  }
}

Search for this line: "state" : "DEPLOYED"

Step 12

Send periodic HA status GET requests to the secondary device until it reaches single state and the peer device is unknown state.

Request
Copycurl -H 'Accept: application/json'  -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default

 

Response
Copy{
  "nodeRole" : null,
  "nodeState" : "SINGLE_NODE",
  "peerNodeState" : "HA_UNKNOWN_NODE",
  "configStatus" : "UNKNOWN",
  "haHealthStatus" : "HEALTHY",
  "id" : "default",
  "type" : "hastatus",
  "links" : {
    "self" : "https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default"
  }
}

Step 13

Check both devices, and complete a deployment on each device if a deployment is pending.

Next