Deployment Fails with /31 Subnet on Standby FTD Interface IP

Issue

A subinterface created on a port-channel and assigned IP address x.x.x.x/31 for the FTD HA standby IP address. However, when deploying the policy from FMC, the deployment consistently fails with a configuration error.

ip address x.x.x.240 255.255.255.254 standby x.x.x.241

^

ERROR: % Invalid input detected at '^' marker.

Config Error -- ip address x.x.x.240 255.255.255.254 standby x.x.x.241

Environment

• Cisco Firepower FPR-4112 appliances running FTD 7.2 in High Availability configuration
• Managed by Firepower Management Center (FMC)
• Software Version: 7.4.2
• Subinterface configured on port-channel.
• IP addressing scheme: x.x.x.240/31 with standby IP x.x.x.241

Resolution

The deployment failure is resolved by changing the subnet mask from /31 to /30 for any routed interface requiring an FTD HA standby IP address.

Recommended Solution

Use a /30 subnet (255.255.255.252) instead of /31 for any routed interface requiring an HA standby IP address. A /30 subnet provides four addresses (network, two usable host IPs, and broadcast), allowing for both an active IP and a standby IP to coexist.

Implementation Steps

1: Change from the current /31 addressing scheme to a /30 subnet that provides sufficient IP addresses for both active and standby configurations.

2: Update the interface configuration in Firepower Management Center to use the new /30 subnet addressing.

3: Deploy the updated configuration from FMC to both FTD devices in the HA pair.

4: Confirm that the policy deployment completes successfully without configuration errors.

Prevention Recommendations

• Always use a /30 or larger subnet for routed interfaces that require HA standby IP addresses.
• Review the Cisco Secure Firewall Management Center Device Configuration Guide before designing IP addressing schemes for HA deployments.
• Use /31 subnets only for point-to-point links without HA requirements (such as single-node deployments or non-failover scenarios).

Cause

The deployment failure is caused by attempting to configure a standby IP address on an interface using a /31 subnet mask (255.255.255.254).

A /31 subnet provides only two usable IP addresses (no dedicated network or broadcast address), which does not leave room for a separate standby IP in an HA configuration. Per Cisco documentation, standby IP addresses cannot be configured on interfaces with /31 subnets.

The Cisco Secure Firewall Management Center Device Configuration Guide explicitly states: "For point-to-point connections, you can specify a 31-bit subnet mask (255.255.255.254 or /31). In this case, no IP addresses are reserved for the network or broadcast addresses. You cannot set the standby IP address in this case."

Related Content

• Cisco Secure Firewall Management Center Device Configuration Guide, 7.4
• Cisco Technical Support & Downloads