Firepower Threat Defense (FTD)

Introduction

Failover (switch mode) can be performed on either device in an HA pair. The active device will become standby, and the standby device will become active. For example, upgrades should be performed on the current standby device. The devices must be in a healthy active/standby state when performing the failover.

To Perform a Failover on an HA Pair:

Step 1

Send an HA failover POST request to a device in the HA pair.

Request
Copycurl -X POST -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN" https://ftd.example/api/fdm/latest/devices/default/action/ha/failover

 

Response
Copy{
  "nodeRole" : "HA_PRIMARY",
  "nodeState" : "HA_STANDBY_NODE",
  "peerNodeState" : "HA_ACTIVE_NODE",
  "configStatus" : "IN_SYNC",
  "haHealthStatus" : "HEALTHY",
  "id" : "default",
  "type" : "hastatus",
  "links" : {
    "self" : "https://ftd.example/api/fdm/latest/devices/default/action/ha/failover/default"
  }
}

Step 2

  • If the response to the previous step shows the nodeState and peerNodeState have exchanged values (E.G. active has become standby and standby has become active), then no more actions are needed. Stop here.
  • Otherwise proceed to the next step.

Step 3

Send periodic HA status GET requests to the new active device until it is active.

Request
Copycurl -H 'Accept: application/json'  -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default

 

Response
Copy{
  "nodeRole": "HA_SECONDARY",
  "nodeState": "HA_ACTIVE_NODE",
  "peerNodeState": "HA_STANDBY_NODE",
  "configStatus" : "IN_SYNC",
  "haHealthStatus" : "HEALTHY",
  "id": "default",
  "type": "hastatus",
  "links": {
    "self": "https://ftd.secondary.example/api/fdm/latest/devices/default/operational/ha/status/default"
  }
}
Next