top of page
Search

Cisco FTD HA Not Syncing: show high-availability When FMC Says Healthy

Aug 15
2 min read
Cisco FTD network security troubleshooting lab
Cisco FTD · Techclick CLI troubleshooting lab
FMC shows HA green. Secondary does not have the new NAT rule. Failover would lose the change.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Cisco FTD for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

FTD HA has config sync and state sync. show high-availability on the device is more honest than the FMC widget.

Why this ticket shows up

A paused sync or a failed deployment on one unit leaves a split brain config that FMC still paints green.

Symptoms operators actually see

  • NAT missing on secondary

  • HA state not healthy on CLI

  • Last deploy failed on one unit

  • State sync age old

CLI first — copy this block

Run these on the Cisco FTD device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show high-availability config
show high-availability state
show running-config nat
show managers
show version

How to read that output

Config sync must be enabled and recent. If state is not healthy, do not fail over.

Triage order

  1. Compare NAT on both units via CLI

  2. Read HA config/state

  3. Redeploy from FMC to the pair

  4. Resume sync if paused

  5. Verify the rule exists on secondary

Classic traps

What you see

Real cause

Fix

Failover to test

Secondary lacks NAT

Sync first

Trust FMC green

CLI disagrees

Trust CLI

Break HA and rebuild

A deploy retry may be enough

Try that first

Proof the ticket is closed

  • NAT present on both

  • HA state healthy

  • Sync age fresh

Say this in an interview

I verify FTD HA from the device CLI. FMC green is not a config compare.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page