Related Topics
SFRP
Advanced Virtual Switch Settings
Deployment Types and Device High Availability
You determine how to configure 7000 or 8000 Series device high availability depending on your Firepower
System deployment: passive, inline, routed, or switched. You can also deploy your system in multiple roles
at once. Of the four deployment types, only passive deployments require that you configure devices or stacks
using high availability to provide redundancy. You can establish network redundancy for the other deployment
types with or without device high availability. For a brief overview on high availability in each deployment
type, see the sections below.
You can achieve Layer 3 redundancy without using device high availability by using the Cisco Redundancy
Protocol (SFRP). SFRP allows devices to act as redundant gateways for specified IP addresses. With network
redundancy, you configure two devices or stacks to provide identical network connections, ensuring connectivity
for other hosts on the network.
Note
Passive Deployment Redundancy
Passive interfaces are generally connected to tap ports on central switches, which allows them to analyze all
of the traffic flowing across the switch. If multiple devices are connected to the same tap feed, the system
generates events from each of the devices. When configured in a high-availability pair, devices act as either
active or standby, which allows the system to analyze traffic even in the event of a system failure while also
preventing duplicate events.
Inline Deployment Redundancy
Because an inline set has no control over the routing of the packets being passed through it, it must always
be active in a deployment. Therefore, redundancy relies on external systems to route traffic correctly. You
can configure redundant inline sets with or without 7000 or 8000 Series device high availability.
To deploy redundant inline sets, you configure the network topology so that it allows traffic to pass through
only one of the inline sets while preventing circular routing. If one of the inline sets fails, the surrounding
network infrastructure detects the loss of connectivity to the gateway address and adjusts the routes to send
traffic through the redundant set.
Routed Deployment Redundancy
Hosts in an IP network must use a well-known gateway address to send traffic to different networks. Establishing
redundancy in a routed deployment requires that routed interfaces share the gateway addresses so that only
one interface handles traffic for that address at any given time. To accomplish this, you must maintain an
equal number of IP addresses on a virtual router. One interface advertises the address. If that interface goes
down, the standby interface begins advertising the address.
In devices that are not members of a high-availability pair, you use SFRP to establish redundancy by configuring
gateway IP addresses shared between multiple routed interfaces. You can configure SFRP with or without
7000 or 8000 Series device high availability. You can also establish redundancy using dynamic routing such
as OSPF or RIP.
7000 and 8000 Series Device High Availability
4
7000 and 8000 Series Device High Availability
Deployment Types and Device High Availability
