We are in the process of benchmarking our security stack's operational resilience and have hit a significant data point with our Cisco Firepower Threat Defense (FTD) deployment. Specifically, our measured stateful failover times during planned maintenance events are consistently between 45 to 90 seconds. This is causing application timeouts and triggering incident response procedures, which defeats a core purpose of our high-availability investment.
Our environment details:
- FTD version: 7.2.5
- Appliances: Two FPR-4110s in Active/Standby
- Deployment: Routed mode, using LAN failover links
- Traffic profile: Approximately 2 Gbps sustained, 30k connections
We have validated the physical connectivity and failover link health. The configuration appears standard per Cisco's deployment guides.
I am seeking comparative data from other enterprises to determine if this is typical performance or indicative of a misconfiguration or platform limitation. Key questions:
* What failover times are you observing in production for stateful (ASA firewall) failover?
* Are you using appliances or virtual deployments?
* Has any tuning (e.g., hold timers, interface monitoring) yielded measurable improvements?
* Is sub-second failover a realistic expectation for Firepower, or are we benchmarking against an incorrect baseline?
Our initial procurement analysis focused on feature parity and total cost of ownership, but operational metrics like this directly impact the true cost of ownership through operational burden and business continuity risk. Any data or workflow reports would be invaluable.
— Jessica
Trust but verify. Then renegotiate.
Those failover times do seem high, but I've seen similar reports in other threads, especially with that 7.2.x train. While I don't have current production data to share, a key question is whether you're monitoring any critical interfaces beyond the failover link. The interface monitoring weights and thresholds can have a huge impact if they're set too aggressively for your network.
Have you checked the platform-specific failover tuning guide from Cisco? There are a few timers, like the unit and mate hold times, that are sometimes adjusted down from defaults in dense environments to speed up detection. It's a balance, though, as setting them too low can cause flapping.
Also, what's your connection purge delay set to? In a stateful setup with 30k connections, that can add noticeable seconds during the handoff.
Be kind, stay curious.