Troubleshooting Duplicate Cisco FTD Firewalls in an HA Pair

Overview

Duplicate Cisco FTD firewalls may appear in Auvik when stale SNMP or ENTITY-MIB data is retained while one HA peer is unreachable.

This can affect Cisco FTD 3105 firewalls and may also occur with older FTD platforms, such as the FTD 1150.

Symptoms

You may see:

Multiple device records representing the same firewall or HA pair
Repeated chassis or module entries
Duplicate or conflicting serial numbers or module identifiers
One HA peer shown as unreachable while duplicate records remain
Inventory changing after rediscovery or HA failover

Why this happens

In an HA deployment, each peer may expose chassis and module information through SNMP, including the ENTITY-MIB entPhysicalTable.

If one peer becomes unreachable, previously collected entity data may remain associated with the device. Later SNMP polls, rediscovery, or topology correlation may associate that stale information with the reachable peer and create duplicate inventory records.

Verify HA and SNMP health

Ask your network or firewall administrator to confirm that:

Both HA peers are online and reachable from the Auvik Collector.
SNMP is enabled and correctly configured on both peers.
The SNMP community or SNMPv3 credentials are valid.
The Collector’s source IP is allowed by the SNMP access lists and firewalls.
SNMPv3 engine IDs are stable and authentication and privacy settings match.
Both peers respond to system OIDs and ENTITY-MIB queries.

The following OIDs can help confirm the returned data:

1.3.6.1.2.1.1
1.3.6.1.2.1.47

The first identifies basic system information. The second represents the ENTITY-MIB hierarchy, including chassis and module information.

Refresh the Auvik inventory

After correcting reachability or SNMP issues:

Confirm that both HA peers are reachable.
Run a rediscovery or rescan for the affected devices.
Allow the discovery and polling cycle to complete.
Review the device records for duplicate chassis, serial, or module information.

If one HA peer is intentionally offline for maintenance or migration, coordinate with your Auvik administrator before changing its monitoring status.

Review discovery overlap

Confirm that:

Only one Collector is discovering the affected firewall management IPs and subnets.
The same devices are not being discovered through multiple overlapping discovery scopes.
Neighbor-based discovery is not introducing alternate records for the same firewall.
The firewalls are assigned to the intended site and Collector.

Multiple Collectors or overlapping discovery scopes can create additional device records that may appear to be SNMP duplication.

If duplicates remain

Do not delete device records until the correct active record has been identified.

Collect the following information and contact Auvik Support:

Screenshots of the duplicate records
Device names, management IPs, and serial numbers
HA status showing the active and standby peers
FTD model and firmware version
SNMP test or walk results from both peers
Collector names and assigned sites
Approximate time the duplicate records first appeared
Discovery or Collector logs showing SNMP timeouts or rediscovery activity

Support can determine which record is current and advise on the appropriate inventory cleanup. Historical data may not be fully recoverable if it was divided between duplicate records.

FTD 1150 considerations

Some older FTD platforms may continue to exhibit duplicate inventory behavior when HA peers are intermittently unreachable or expose inconsistent entity data.

For these devices, maintaining stable SNMP reachability for both peers and performing controlled rediscovery after HA changes can reduce recurrence. If duplicates continue, contact Auvik Support with the device and SNMP information listed above.

Administrative actions

The following actions require a network, firewall, or Auvik administrator:

Changing HA, SNMP, ACL, firewall, or SNMPv3 settings
Changing Collector assignments or discovery scopes
Pausing or unmanaging a device
Deleting or merging device records
Clearing backend inventory or cached discovery data

How can we help?