Troubleshoot management connectivity on a data interface in a High Availability pair

This topic provides troubleshooting steps for management connectivity issues on data interfaces in High Availability, covering scenarios involving interface connectivity failures and ISP changes.

The management connection between the active peer and the Security Cloud Control can be disrupted due to the following reasons:

  • Connectivity issues on the data interface that is used for management on the active unit.

  • Change in internet service provider (ISP).

Follow these procedures to restore connectivity based on the identified cause:

  • Connectivity issues: Manually fail over to the standby unit and configure a new data interface for Security Cloud Control access.

  • ISP change: Manually update the new network details on the active unit using CLI commands to restore device connectivity.

Data management interface on active unit has connectivity issues

  1. In Security Cloud Control , manually switch the active unit to standby. See Switch the Active Peer in the Firewall Threat Defense High Availability Pair .

    As an alternative, you can run the no failover active command on the active unit.

  2. Next to the device high-availability pair you want to edit, click Edit ( ).

  3. Choose Routing > Static Route and delete the static route defined for the old data management interface.

  4. Click the Interfaces tab to remove the old interface configuration and configure the new data management interface.

    Note

    Before removing the old data management interface information, remember the details if you want to use the same information.

  5. Click the High Availability tab to update the Monitored Interfaces and Standby IP Address for the new interface.

  6. Click Save and add the static route for the new data management interface under Routing > Static Route .

  7. Deploy configuration changes. .

  8. Re-cable the FTD when deployment reaches 90 percent so the Security Cloud Control reaches the device on the new interface.

    Note

    After you re-cable, the deployment may fail if it timed out before re-establishing the management connection to the new interface. In that case, you must reinitiate the deployment after re-cabling for a successful deployment.

  9. Verify the management connection status in Cloud-Delivered Firewall Management Center or via the sftunnel-status-brief command at the FTD CLI.

Internet service provider has changed

If you have changed your ISP, you can lose management connectivity, even though High Availability health is normal. Configure the new network details of the management interface using the CLI commands.

Note

These commands are available only on the active unit and not on standby.

For information about the Firewall Threat Defense CLI, see the FTD command reference .

  1. Connect to the device CLI and log in with the Admin username and password.

  2. Use the configure network management-data-interface commands to update the IPv4 address, netmask, or gateway.

    Example: 

    
            Configure network management-data-interface ipv4 manual 10.10.6.7 255.255.255.0 interface gig0/0
            Configuration updated successfully..!!
    Note

    All other CLI commands of configure network management-data-interface are not supported on devices in a High Availability pair.

  3. Verify the connection using sftunnel-status-brief .

  4. In Security Cloud Control , navigate to Security Devices > FTD, select the device, and click Refresh in the FMC Access Details pane.

  5. Click Acknowledge to remove the deployment block and reconcile the configuration changes.