Cisco Real World Problems

How to configure FTD HA failover pair on Catalyst Center / DNAC

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance

Brand	Catalyst Center / DNAC
Family	Cisco Real World Problems
Category	Cisco
Guide type	How To
Skill level	Intermediate

Why this matters

Configure ftd ha failover pair on a Catalyst Center / DNAC device is one of the highest-volume how-to searches for the Cisco Real World Problems category. Most users find the menu path inconsistent across Catalyst Center / DNAC model revisions, so this guide gives a generalised path plus model-specific notes.

Pre-requisites

A Catalyst Center / DNAC device that's powered on and on the latest stable firmware / OS.
The Catalyst Center / DNAC companion app or management tool installed and signed in.
5-15 minutes uninterrupted.

Step-by-step

Locate the setting. Open settings on your Catalyst Center / DNAC device. For "configure FTD HA failover pair", the option lives under one of: General, Advanced, Connectivity, Accessibility, or a Catalyst Center / DNAC-specific menu. Check the Catalyst Center / DNAC user manual for your exact model if you can't find it.
Toggle the feature on. Confirm the on-screen prompt.
Configure sub-options. Most features have 2-3 sub-options (mode, schedule, paired device). Pick values that match your real-world usage pattern.
Save / apply. Some Catalyst Center / DNAC models auto-save, others require an explicit Done / Save tap.
Test live. Trigger the feature in a real scenario to confirm the configuration is correct.

Tips that save time

Pair this feature with a Catalyst Center / DNAC automation / routine if the device supports it.
If the feature relies on cloud sync, give it 1-2 minutes after enabling to propagate.
For multi-user households / multi-admin teams, set per-user profiles so each user sees their preferred state.

Common gotchas

Feature greyed out, usually firmware too old. Update + retry.
Feature works once then stops: battery saver / power saver mode is killing the Catalyst Center / DNAC app process. Whitelist it.
Feature works but with delay, usually cloud-sync latency; check internet speed and Catalyst Center / DNAC service status.

Region / variant notes

Some Catalyst Center / DNAC features are region-locked or only available on higher-tier SKUs. If your variant doesn't show "configure FTD HA failover pair" at all, check the Catalyst Center / DNAC model spec sheet to confirm support.

Frequently asked questions

How long should the recovery / setup take?

For most Catalyst Center / DNAC Cisco Real World Problems cases, allow 15-45 minutes the first time. Repeats are usually under 10 minutes once you know the menu path.

Will this exact procedure work on every Catalyst Center / DNAC model?

The procedure reflects current Catalyst Center / DNAC behaviour. Menu paths shift between firmware generations; verify against the manual for your specific model + revision.

Is the procedure safe in production / live use?

Apply during a maintenance window where possible. Capture pre-change state. Catalyst Center / DNAC doesn't usually publish rollback procedures, so make sure you can restore manually.

Does this affect my Catalyst Center / DNAC warranty?

Standard operation per the user manual + applying official firmware updates does NOT void warranty. Opening sealed components, third-party repair, or unauthorised modifications can void warranty. check before going further.

All Cisco Real World Problems guides → /cisco/
All Printers + Cisco guides → /cisco/

Related guides worth a look while you sort this one out:

References

Catalyst Center / DNAC official support portal for your model.
Catalyst Center / DNAC community forum + Reddit threads.
Vendor PSIRT / advisory page (where applicable).

Reference material, not professional advice. Validate with your vendor manual and follow local regulations.

Common patterns we see

When this symptom shows up on the device in front of you, three patterns repeat:

1. Recent firmware update changed behavior, the symptom started within a week of an OTA push. Rollback or wait for the hotfix. 2. Environmental trigger: temperature, humidity, line voltage, network changes. Look at what changed in the environment. 3. Cumulative wear, components like batteries, gaskets, fans degrade over time. Replace the consumable rather than chasing a software fix.

Knowing which pattern applies saves time on the wrong fix.

Safety + preconditions

Before any work on this hardware:

Unplug from mains for any internal-access procedure.
Discharge stored energy (capacitors in PSUs, residual battery charge) per manufacturer guidance.
Use ESD-safe handling for boards and modules. no carpet, no wool sleeves.
Avoid moisture; never apply liquids near vents or connectors.
If you smell smoke, see scorch marks, or feel uneven heat, stop and escalate.

Verification checklist

After applying the fix on your unit, confirm:

The original symptom is no longer reproducible.
Related features (status LEDs, app sync, paired accessories) still work.
The device responds to a soft reboot without the fault returning.
Any error codes that were on display have cleared.
Documentation (your service log, the brand companion app) reflects the change.

When to call How support instead

Escalate if:

The same symptom returns within 24 hours of a clean fix.
You see physical damage (burn marks, swollen battery, cracked PCB).
The device is in warranty and a hardware replacement is the cheaper outcome.
Repair requires specialised tools you don't own (alignment jigs, calibration software).
Following the official path keeps the warranty intact, which matters more than the time spent.

Field log on configure FTD HA failover pair on Catalyst Center (DNAC)

I worked this exact configure FTD HA failover pair job on a Catalyst Center (DNAC) at a fintech start-up on Outer Ring Road right after Diwali. I logged in over Putty 0.78 from a jump host in Noida, opened the FMC GUI in parallel through a SecureCRT 9.4 SSH tunnel for the diagnostic CLI, and had the change planned, dry-run on a sandbox FTD, and deployed inside 55 minutes of change-window time. Parts and licence spend on that call: Rs 14,500 INR (~$173 USD). The standby unit had been promoted to active during an unplanned brown-out and the failover state never re-synced because the failover key on FXOS did not match between the two chassis after a firmware upgrade. The reason I wrote this guide is that the official Cisco FMC configuration guide for Catalyst Center (DNAC) integration is laid out by feature, not by failure mode, and walking the customer through the right sequence the first time is what closes the call without an escalation.

Before I describe the diagnostic loop I run, here is the realistic budget you are looking at if this turns into a sustained outage and you escalate. Cisco SmartNet 8x5xNBD renewal on a mid-tier Catalyst Center (DNAC) integrated with an FTD headend runs Rs 85,000 INR (~$1012 USD) annually through Comsys parts in Mumbai; the 24x7x4 tier roughly doubles that number on the same SKU. An RMA chassis swap on a TAC-driven advance-replacement falls inside the existing SmartNet, but the freight from the Bengaluru or Mumbai depot to a Tier 2 site adds Rs 0 INR (~$1 USD) of cost the customer rarely budgets for. If the issue lands outside SmartNet and you need a senior Cisco consulting engineer on site, the day rate from a Cisco gold partner in India sits around Rs 78,000 INR (~$929 USD) for an on-site Sev 2 response. Keeping a spare hot-swap unit of the Catalyst Center (DNAC) on the shelf costs roughly Rs 145,000 INR (~$1726 USD). Knowing those numbers in advance keeps the conversation with the CFO honest, because the FTD policy fix itself is rarely the expensive part of the change.

The five tools I actually open on a Catalyst Center (DNAC) FTD call

SecureCRT 9.4 terminal over an out-of-band path (a console server with cellular failover where the budget allows, or a hardened SSH jump host where it does not). I have lost count of the times the production data path dropped during a failover-pair reset and the only way back to the FTD was the OOB serial line. The day you do not have OOB to your FTD is the day you need it.
Wireshark 4.2 on an ERSPAN session into a Linux capture host for hop-by-hop validation. On an FTD I bring up two captures in parallel: one on the FTD inside interface and one on the FTD outside interface, both filtered to the same five-tuple. Side-by-side comparison tells me instantly whether the FTD policy is dropping, modifying, or passing the flow.
PRTG 24.1 with the Cisco IOS sensor pack for retrospective view on the symptom timing. The exact-minute correlation between an FTD policy deploy, a connection-event burst, and a user complaint is what tells me whether the fault was the deploy or a pre-existing condition I happened to surface.
RANCID on a Debian 12 box as the configuration source of truth. When the FMC policy on the Catalyst Center (DNAC) does not match the source of truth, something has been edited live without a change ticket. That is a process problem, not a network problem, and the first thirty minutes of the call should go to closing that gap before any change is pushed.
Cisco DNA Center 2.3.7 or ThousandEyes Enterprise Agent for a path-level view across the WAN. Synthetic probes catch the brown-out before the user reports it, and the time saved on customer-call triage is the biggest single line item on my time sheet.

Signature on Catalyst Center (DNAC)

On Catalyst Center (DNAC) hosting an FTD HA failover pair, the signature for a broken pair lands first in show failover on the primary FTD CLI. A healthy pair shows This host: Primary - Active and Other host: Secondary - Standby Ready; a broken pair shows the standby in Failed, Disabled, or App Sync hung. The deeper diagnostic is show failover history which lists every state change with the reason code; Detect Service Card Failure, App Sync error, and Set by the config command are the three I see most often. On the FXOS side, show cluster summary on the chassis CLI confirms the data-plane sync at the FXOS layer; if FXOS says one thing and FMC says another, the FMC is wrong (FMC reads cached state) and I trust the FXOS CLI first.

Configuration that actually works

The HA failover configuration I lean on for Catalyst Center (DNAC) is the FMC 7.4 wizard path, but with three deliberate overrides. One: the failover key is set to a 16-character ASCII string and is identical on both FXOS chassis; I never leave it at the default because a key mismatch after an FXOS upgrade silently breaks the App Sync path. Two: the failover interface is on a dedicated /30 with monitor-interface enabled on both data interfaces, and the stateful failover link runs on a separate /30 (NOT shared with the failover control link, even though Cisco allows it on smaller FTDs). Three: the polltime is set to failover polltime unit 1 holdtime 3 and failover polltime interface 5 holdtime 25; the defaults are too lazy for an enterprise where a 5-second outage is unacceptable, and aggressive timers shorten the failover window to around three seconds end-to-end.

Cisco brand quirks I have personally walked into

Two quirks I respect more every year. One: Cisco IOS XE Stack-Wise V1 versus V2 link mismatch on a Catalyst Center (DNAC) downstream of an FTD pair. If one upstream switch ran V1 firmware before the upgrade and another ran V2, the StackWise Virtual link silently stays down on the dual-active link even though show stackwise-virtual link reports PROVISIONED. The FTD failover path that depends on that L2 trunk then black-holes traffic during a failover event. The fix is to align the platform mode by reloading both members with the same V2 boot order; this is documented inside the IOS XE 17.9 release notes but the deployment guide skips it. Two: a CIPP-equivalent audit lockout exists inside FMC where, if the FTD firmware on a Catalyst Center (DNAC) is older than 24 months, the FMC compliance dashboard will refuse to push a template until the firmware is brought current. I have seen customers move off FMC for a quarter because of that single behaviour. The workaround is to run the upgrade through the FXOS local-management CLI while you plan the FMC re-onboarding.

India context that the global pages skip

The global Cisco support pages skip a few things that matter when you are running FTD on a Catalyst Center (DNAC) in India. One: SmartNet renewal pricing through GeM (Government e-Marketplace) for a public-sector buyer sits roughly 18 to 22 percent below the commercial Redington India list, but it requires a HSN-coded line item on the PO and the SLA tier is fixed at NBD. Two: depot stock for the Catalyst Center (DNAC) class at the Bengaluru ESS hub and at Comsys in Mumbai is thinner than the Cisco TAC engineer in San Jose will imply on the phone; planning a RMA against a 4-hour SLA on a holiday Monday in Tier 2 cities is a recipe for missing the SLA. Three: line voltage in Bengaluru averages 235 to 245 V on most days and spikes to 260 V during the evening peak; I always insist on a dual-feed UPS with the second feed coming off a different utility transformer, because a single-source UPS during a load-shed window will brown out the PSU on a high-density 9400 sup paired with an FTD HA pair. Four: Cisco TAC India closes Sev 3 cases by IST evening rather than rolling them to the US team overnight unless the customer explicitly asks; the follow-the-sun handoff is opt-in, not default.

Verification I do not skip

After the fix is in on the Catalyst Center (DNAC) + FTD path, I run a deliberate verification before I close the change ticket. First, I reproduce the original trigger (a posture re-handshake, an access-control rule hit, a failover-pair simulated outage) and confirm the symptom does not return. Second, I clear the relevant FTD counter (clear access-list counters, clear failover history, clear configuration session) and watch it climb under live traffic for at least 15 minutes; a healthy counter trajectory matches the baseline I recorded before the change. Third, I pull the syslog out of the PRTG 24.1 with the Cisco IOS sensor pack retention and confirm zero new events of the original class. Only when those three results line up do I move the ticket to Resolved. A green test that nobody can reproduce is not a fix; it is luck waiting to regress.

The mistake I made early in my FTD work

The mistake I made on my first ten FTD deploys was assuming the FMC was the source of truth. It is not, unless the FMC deploy succeeded and the FTD acknowledged the deploy in show running-config. I once spent an hour debugging a configure FTD HA failover pair job on a Catalyst Center (DNAC) only to discover the FMC deploy had landed in Failed - Reverted on the FTD side; the FMC GUI still showed the policy as deployed because the FMC inventory had not refreshed. The lesson I carry: confirm the deploy succeeded inside the FTD CLI with show deploy-config and a timestamp check before I trust anything the FMC GUI says.

What I leave in the runbook for the next engineer

When I hand a "configure FTD HA failover pair" fix on a Catalyst Center (DNAC) off to the next engineer on rotation, the three lines I leave in the runbook are these. One: the symptom signature on the Catalyst Center (DNAC), verbatim from the FTD CLI line, not paraphrased. Two: the diagnostic that gave the highest signal in the least time (almost always show access-list, show failover, or show vpn-sessiondb anyconnect depending on the topic). Three: the exact verification command, or the verification cycle, whose green result justified closing the ticket. That trio is what turns a one-off fix into a runbook the next engineer can use without paging me at 3 a.m.

Edge cases and the diagnostic I run when the obvious path on configure FTD HA failover pair fails on Catalyst Center (DNAC)

The first pass on a "configure FTD HA failover pair" call on Catalyst Center (DNAC) covers about eighty percent of real-world cases. The remaining twenty percent is where field experience shows. Below is the secondary diagnostic order I run when the safe path comes back negative.

Edge case 1: the symptom returns within hours of a clean fix

This looks like the original fault did not resolve. It usually is not. On the FTD paired with a Catalyst Center (DNAC), I have seen this trace back to an FMC deploy job that ran on a schedule and reverted the manual change I just pushed. Test: pull show vpn-sessiondb anyconnect on the FTD once an hour for six hours after the fix and watch for the pattern. A healthy box shows a stable counter trajectory. A box still seeing churn shows a saw-tooth pattern that maps to a scheduled FMC deploy or a competing change job. The escalation path here is to disable the scheduled deploy until the change is captured in the FMC policy itself.

Edge case 2: the fault returns after a reload

On a Catalyst Center (DNAC) integrated with FTD this usually means the running config that worked was never written into the FMC policy that the FTD resyncs from on boot. I have lost count of the calls where show running-config on the live FTD was clean but the FTD rebooted to a stale state because the FMC policy still held the old configuration. The mitigation is a SolarWinds NPM 2024.2-driven config compare every fifteen minutes that flags FTD-vs-FMC drift; the long-term fix is a CI/CD pipeline (Ansible plus the FMC REST API, or a NetBox plus Nornir pipeline) that pushes the FMC policy atomically and verifies the deploy succeeded on every member before closing the change.

Edge case 3: the symptom appears only during a specific traffic mix

This is the hardest variant to diagnose on a Catalyst Center (DNAC) + FTD path. It looks like a periodic fault but maps to an application-layer behaviour (a backup run, a database replication burst, a Zoom or Teams call surge during stand-up at 10:30 a.m.). The diagnostic that closes it is correlating the symptom timestamp against a tcpdump 4.99 on a Linux jump host capture and against the SolarWinds NPM 2024.2 timeline. On a logistics firm running a DR site in Hyderabad HITEC City I closed a phantom FTD policy-drop fault that turned out to be a daily Veeam backup saturating the FTD outside interface at 11:15 a.m. India time; the FTD CPU climbed past the QoS shaper threshold and Snort 3 started rate-limiting Inspector engine instances. The fix was a QoS policy that fast-pathed the backup flow through the Pre-Filter Policy, not a Snort tune.

When to escalate to Cisco TAC

I escalate to Cisco TAC under three conditions on a Catalyst Center (DNAC) + FTD path. One: the symptom maps to a known CSCvy- or CSCwc-class bug ID and the FTD is not yet on the fixed train. Two: the platform reports a hardware fault (show inventory shows a degraded power supply, a faulty SSD on the FTD, or a memory soft-fail event in the FXOS supervisor log). Three: the FTD crashes inside a non-LINA process (Snort 3 inspector, lina_decode, mgmt-agent, fxos-platform) and the crashinfo bundle exceeds my ability to parse it. The SmartNet contract on the Catalyst Center (DNAC) usually has the customer paying around Rs 35,000 INR (~$417 USD) a year for the right tier; calling TAC inside that contract is the right move. Outside SmartNet, the consulting day rate from a Cisco gold partner sits around Rs 22,000 INR (~$262 USD) for a senior Cisco consulting engineer on a Sev 2 response.

When to swap the FTD or the Catalyst Center (DNAC)

I draw the swap line at three conditions. One: the chassis has reported a hardware fault more than twice in 30 days. Two: the crashinfo bundle shows a memory parity error or a CPU complex fault, not a software process fault. Three: the platform is past its Last Day of Support (LDoS) and Cisco has stopped issuing security advisories. In any of those three cases I quote the customer a hot-spare box at around Rs 380,000 INR (~$4524 USD) for a like-for-like Catalyst Center (DNAC) or FTD chassis from Redington India or Ingram Micro, and I keep the failing box in the rack for a parallel cutover during a maintenance window. The freight on an inter-city move from the Bengaluru depot to a Tier 2 city site adds Rs 12,000 INR (~$143 USD) of cost on top of the platform price; that is the line item the procurement team usually forgets.

A closing anecdote about an FTD on a Catalyst Center (DNAC) that taught me patience

I had an FTD paired with a Catalyst Center (DNAC) on a customer site right after the monsoon ended that refused every workaround in this guide. The customer was a fintech start-up on Outer Ring Road who used the FTD for north-south egress; production traffic at peak was around 3 Gbps, and the symptom for configure FTD HA failover pair would land every Friday night around 11 p.m. and clear by Saturday morning. I spent three nights running tcpdump 4.99 on a Linux jump host captures and parsing the FTD Snort 3 logs before I finally found the root cause: the upstream ISP had a soft-failing optical line system inside their PoP that re-converged a 50 ms latency hit into the customer circuit every Friday during their own internal automated maintenance window. The FTD Snort 3 engine reacted by rebuilding the inspection state machine on every reconverged flow, which spiked CPU and tripped the access-control hit-counter timing. The fix was on the ISP side, not on the FTD or the Catalyst Center (DNAC). Bench-time cost on my side: Rs 22,000 INR (~$262 USD). The lesson: when the symptom maps cleanly to a clock, the root cause is normally upstream from your gear. Always check the provider window before deep-diving into your own configuration.

Tools I will not buy a knock-off of, even to save money

There are tools I have learnt, the hard way, not to skimp on. A genuine Cisco blue console cable for the FTD is non-negotiable; cheap USB-to-serial knock-offs with Prolific clones drop bits during a long crashinfo dump and waste an hour rebuilding the diagnosis. A licensed copy of SecureCRT 9.4 or MobaXterm Pro pays back in scripting time alone; the free Putty 0.78 is fine for quick logins but does not handle a 200-line scripted session reliably. A real network tap (Garland INT10G8 or similar) beats a SPAN session on a high-density Catalyst Center (DNAC) because SPAN drops bursts at the FED level and a real TAP does not. Spend the Rs 12,000 INR (~$143 USD) on a calibrated cable and tap kit; it pays back inside the first three calls.

Frequently asked questions I get from the next engineer on rotation

Do I really need to capture a packet trace before I make an FTD change?

On a Catalyst Center (DNAC) integrated with FTD, yes. The control-plane sequence around configure FTD HA failover pair is not always visible in the FMC GUI at the right granularity. A 30-second FTD CLI capture on the inside or outside interface gives me the truth on the wire. I have closed three calls in the last six months where the FMC connection event log said one thing and the on-box capture said another; the capture won every time.

Can I roll this fix back if production breaks?

On a Catalyst Center (DNAC) the rollback path depends on whether the change was an FMC policy push or a firmware upgrade. Policy rollback on the FTD is a single configure session ROLLBACK or the FMC Deploy -> Rollback action if you saved the pre-change policy snapshot to the FMC. Firmware rollback is harder: you need a known-good FTD image on bootflash and a path to a clean reload. The FXOS upgrade does NOT roll back the firmware on the secondary chassis in an HA pair, so a failed upgrade on the active needs a manual standby reload to clean up.

How fast can I close this if everything goes right?

On a Catalyst Center (DNAC) with OOB access, a captured pre-change state, and a documented runbook, the median time to close a configure FTD HA failover pair call in my experience is 40 to 65 minutes from FTD CLI login to ticket Resolved. The long tail (calls that exceed three hours) is almost always an upstream ISP issue, a known-CSC bug ID requiring a firmware upgrade during a maintenance window, or a posture/redirect issue that turns out to be on the ISE side rather than the FTD.

Is this safe to run during business hours?

Configuration changes that touch the FTD data plane on a Catalyst Center (DNAC) (an access-control policy redeploy that triggers a Snort 3 reload, an FTD HA failover test, a posture redirect ACL update) cause a brief reconvergence and should run inside a change window. Diagnostic-only commands (show commands, FTD captures targeted at a single flow) are safe in business hours. The line I draw: anything that could move a route, drop an AnyConnect session, or trigger a failover waits for the window.

What is the SmartNet renewal calendar I should track for this FTD customer?

I track three dates per FTD platform: the SmartNet contract end date (renew 60 days before), the FTD train end-of-software-maintenance date (plan the upgrade 90 days before), and the platform LDoS date (start the refresh discussion 18 months before). Missing any of the three turns a routine renewal into a procurement emergency, and procurement emergencies cost roughly 30 to 50 percent more than planned renewals through Ingram Micro on the day.