Failover Triggers and Detection Timing

The following events trigger failover in a Firepower high availability pair:

• More than 50% of the Snort instances on the active unit are down.

• Disk space on the active unit is more than 90% full.

• The no failover active command is run on the active unit or the failover active command is run on the standby unit.

• The active unit has more failed interfaces than the standby unit.

• Interface failure on the active device exceeds the threshold configured.

  By default, failure of a single interface causes failover. You can change the default value by configuring a threshold for the number of interfaces or a percentage of monitored interfaces that must fail for the failover to occur. If the threshold breaches on the active device, failover occurs. If the threshold breaches on the standby device, the unit moves to Fail state.

  To change the default failover criteria, enter the following command in global configuration mode:

  Command	Purpose
  failover interface-policy num [%] hostname (config)# failover interface-policy 20%	Changes the default failover criteria. When specifying a specific number of interfaces, the num argument can be from 1 to 250. When specifying a percentage of interfaces, the num argument can be from 1 to 100.

The following table shows the failover triggering events and associated failure detection timing. If failover occurs, you can view the reason for the failover in the Message Center, along with various operations pertaining to the high availability pair. You can configure these thresholds to a value within the specified minimum-maximum range.

Threat Defense Failover Times

Failover Triggering Event	Minimum	Default	Maximum
Active unit loses power, hardware goes down, or the software reloads or crashes. When any of these occur, the monitored interfaces or failover link do not receives any hello message.	800 milliseconds	15 seconds	45 seconds
Active unit interface physical link down.	500 milliseconds	5 seconds	15 seconds
Active unit interface up, but connection problem causes interface testing.	5 seconds	25 seconds	75 seconds