An engineer is configuring two new Cisco FTD devices to replace the existing high availability firewall pair in a highly secure environment. The information exchanged between the FTD devices over the failover link must be encrypted. Which protocol supports this on the Cisco FTD?

Cisco Firepower Threat Defense (FTD) devices in a High Availability (HA) pair use a dedicated failover link to exchange state information, health monitoring messages, and configuration data. To secure this communication in sensitive environments, FTD employs IPsec to encrypt the traffic traversing the failover and stateful failover links. This is configured by defining a shared secret key on both units. This key is then used to establish IPsec security associations (SAs) between the peers, ensuring the confidentiality and integrity of all synchronization traffic.

B. SSH: SSH is a protocol used for secure remote command-line administration and is not utilized for the high-speed, stateful synchronization required for a firewall failover link.
C. SSL: SSL (and its successor, TLS) is primarily used for securing application-layer traffic, such as HTTPS, or for remote access VPNs, not for inter-appliance stateful failover communication.
D. MACsec: MACsec (IEEE 802.1AE) provides Layer 2 encryption for Ethernet links but is not the protocol implemented by Cisco FTD for securing its specific HA failover link traffic.

1. Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager

Version 7.2

High Availability for Firepower Threat Defense

Section: "Configure the Failover Link".

The documentation states

"To encrypt failover and state link communication

you can configure an IPsec encryption key... The key is used to create IPsec security associations (SAs) for the failover link."

2. Cisco Secure Firewall Management Center (FMC) Configuration Guide

Version 7.4

High Availability for Secure Firewall Threat Defense

Section: "Failover Link".

This guide confirms the mechanism

stating

"To encrypt failover and state link communication

you can configure an IPsec encryption key. We recommend that you configure a key. The key is a shared secret that is used to create IPsec security associations (SAs) for the failover link."