Issue
A subinterface created on a port-channel and assigned IP address x.x.x.x/31 for the FTD HA standby IP address. However, when deploying the policy from FMC, the deployment consistently fails with a configuration error.
ip address x.x.x.240 255.255.255.254 standby x.x.x.241
^
ERROR: % Invalid input detected at '^' marker.
Config Error -- ip address x.x.x.240 255.255.255.254 standby x.x.x.241
Environment
- Cisco Firepower FPR-4112 appliances running FTD 7.2 in High Availability configuration
- Managed by Firepower Management Center (FMC)
- Software Version: 7.4.2
- Subinterface configured on port-channel.
- IP addressing scheme: x.x.x.240/31 with standby IP x.x.x.241
Resolution
The deployment failure is resolved by changing the subnet mask from /31 to /30 for any routed interface requiring an FTD HA standby IP address.
Recommended Solution
Use a /30 subnet (255.255.255.252) instead of /31 for any routed interface requiring an HA standby IP address. A /30 subnet provides four addresses (network, two usable host IPs, and broadcast), allowing for both an active IP and a standby IP to coexist.
Implementation Steps
1: Change from the current /31 addressing scheme to a /30 subnet that provides sufficient IP addresses for both active and standby configurations.
2: Update the interface configuration in Firepower Management Center to use the new /30 subnet addressing.
3: Deploy the updated configuration from FMC to both FTD devices in the HA pair.
4: Confirm that the policy deployment completes successfully without configuration errors.
Prevention Recommendations
- Always use a /30 or larger subnet for routed interfaces that require HA standby IP addresses.
- Review the Cisco Secure Firewall Management Center Device Configuration Guide before designing IP addressing schemes for HA deployments.
- Use /31 subnets only for point-to-point links without HA requirements (such as single-node deployments or non-failover scenarios).
Cause
The deployment failure is caused by attempting to configure a standby IP address on an interface using a /31 subnet mask (255.255.255.254).
A /31 subnet provides only two usable IP addresses (no dedicated network or broadcast address), which does not leave room for a separate standby IP in an HA configuration. Per Cisco documentation, standby IP addresses cannot be configured on interfaces with /31 subnets.
The Cisco Secure Firewall Management Center Device Configuration Guide explicitly states: "For point-to-point connections, you can specify a 31-bit subnet mask (255.255.255.254 or /31). In this case, no IP addresses are reserved for the network or broadcast addresses. You cannot set the standby IP address in this case."
Related Content
Feedback