topic Re: Firepower Updates in Network Security

Firepower Updates

dm2020 — Tue, 12 Mar 2019 14:08:31 GMT

Hi All,

Quick question regarding Recurring Rule Updates within FMC. If it tick the 'Deploy Updated Policies to targeted devices' does that mean that the update will be automatically deployed to my FTDs and the Snort Process restarted?

Thanks

Re: Firepower Updates

phil.hydea — Sun, 02 Dec 2018 14:18:10 GMT

Hi - yes it will automatically deploy the updates and there will be detection engine restarts which will disrupt traffic inspection.

You can uncheck that box and create a scheduled task > Deploy Policy. This would allow you to choose the desired time (eg. a maintenance window) and frequency. This would mean if there are 3 SRU updates since the last policy deploy, the FMC would wait to deploy them (culminative).

Thanks

Re: Firepower Updates

dm2020 — Sun, 02 Dec 2018 14:17:05 GMT

Hi,

Thanks for the response. If I have 10 FTDs in my deployment, will these all be impacted at the same time if I configure this? Is there anyway to deploy the updates the the FTDs one by one?

Thanks

Re: Firepower Updates

phil.hydea — Sun, 02 Dec 2018 14:20:46 GMT

I've just editted my previous post. Yes they would all be impacted, you can use the Deploy Policy scheduled tasks to schedule the updates and target specific devices. (Leave the automatic deploy SRU checkbox unchecked)

Thanks

Re: Firepower Updates

Abheesh Kumar — Sun, 02 Dec 2018 14:22:17 GMT

Hi , If you are running version 6.2.3, then you can configure from cli to preserve the snort connections

configure snort preserve-connection enable

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/policy_management.html#concept_uc1_gtq_ty

HTH

Abheesh

Re: Firepower Updates

phil.hydea — Sun, 02 Dec 2018 14:25:04 GMT

Yes good point. To also add to this, whilst existing connections can be
preserved, new connections will be dropped during the snort/detection
engine reload