topic Re: Reinstall FMC virtual appliance in Network Security

Reinstall FMC virtual appliance

Roy Lee — Fri, 21 Feb 2020 16:22:49 GMT

Dear All,

As my FMC virtual appliance was crashed when restore a backup (always show: System processes are starting, please wait.)

, I would like to reinstall FMC and try restore the backup again...

The original FMCv is managing a FirePower 2110.

I would like to reinstall FMCv from fresh.

A silly question: Is that possible to sync back the configuration/Policy etc from the FirePower 2110 to the fresh FMCv?

Here is my plan:

1. De-register the crached FMCv from smartlicense portal. (Because the MAC address will change)

2. Install FMCv from fresh with same version and update to same VDB as the crashed one.

3. Upload and restore the backup.

4. Register the fresh FMCv from smartlicense portal, and select appropriate license.

5. Hopefully the fresh FMCv can connect to the FirePower 2110 senor automatically?

5. Deploy the policy again to the FirePower 2110.

Anything wrong about my plan? And what should I take care before and after reinstall?

Thanks,

Roy Lee

Re: Reinstall FMC virtual appliance

Marvin Rhoads — Mon, 22 Oct 2018 12:09:42 GMT

The "system processes are starting" can take as long as 20 minutes or so to complete.

Unfortunately you can restore a configuration from a sensor to an FMC - even for the policies that are running on the sensor.

You might want to open a TAC case to check on your restore. Note you do need to have the same VDB and Snort Rules that were on the FMC previously already applied on the rebuilt FMC in order to restore successfully.

Re: Reinstall FMC virtual appliance

Roy Lee — Mon, 22 Oct 2018 15:52:06 GMT

Dear Marvin,
Unfortunately, the message "system processes are starting" stay over 1 hour after restore. I have reboot the FMCv but still got same message and can't login.
I have open another thread for the detail but no help: https://community.cisco.com/t5/firepower/fmc-virtual-appliance-6-2-3-on-esx-6-5-restore-problem/td-p/3728492
I didn't buy TAC support and there are leak of resources on the web (compare with ASA......), so I wonder only way is to rebuilt FMCv.
Thanks,
Roy Lee

Re: Reinstall FMC virtual appliance

Roy Lee — Tue, 23 Oct 2018 10:51:22 GMT

OK, I have spend whole day to JUST install a fresh FMCv 6.2.3 on ESXi6.5.

I want to set static MAC address so next time rebuild no need to care about licensing and hopefully the sensor connection.

Retried 4 times all failed, lots of Failed at Initialize stage, and the "System processes are starting, please wait" show after all.

Finally I gave up any changes from the default setting of VOF and rebuild AGAIN. I can login FMC after 5 times rebuild.....

OK, try to restore the backup done last week..... failed... "Unable to restore CSM"...... "System processes are starting, please wait" come back again...

What a wonderful product...

Now I think I can only rebuild fresh FMCv and connect to the FirePower 2110 which will remove all configuration.....

Hopefully I can get back the control on FirePower 2110. Then try the backup/restore again.....

It's nightmare if backup/restore function may destroy everything....

Re: Reinstall FMC virtual appliance

Marvin Rhoads — Tue, 23 Oct 2018 13:09:54 GMT

I missed you saying earlier that you had attempted to rebuild while changing the OVF settings. That is very risky and would not be expected to result in a clean build.

I've installed dozens of FMCv for multiple customers since as far back as when it was Sourcefire Defense Centre 5.0 and never had a problem with any of them.

Re: Reinstall FMC virtual appliance

Roy Lee — Tue, 23 Oct 2018 15:11:54 GMT

Hi Marvin,
Sorry for my bad english. I changed the default setting after deploy the OVF, by assigning a static MAC address inside the VM setting, not directly modify OVF file. The Cisco FMCv deployment guide also mention this static MAC address.
But this static MAC address caused the login problem of my 4 rebuilds, so I deploy OVF again directly without changing any VM setting.
It's up and running, but when I restore the backup of last week, crash again.
I wonder my last week backup got problem which cause restore fail. I will try to backup and restore again.
May I know your experience on backup / restore of FMCv? Is that stable?
If FMCv crash and restore fail like what happened to me, I can only build a fresh FMCv and lost all configuration. All existing firepower devices will lost configuration when connect and manage by that fresh build FMCv, right?
That is what I worry.

Will import configuration to fresh FMCv can be used in case of restore fail?
Thanks,
Roy Lee

Re: Reinstall FMC virtual appliance

Marvin Rhoads — Wed, 24 Oct 2018 03:06:02 GMT

I've only ever done a few FMC restores and they worked fine.

You would be best off opening a TAC case for this sort of issue as it is likely due to some low level setting that's not easily diagnosed in this forum.

Re: Reinstall FMC virtual appliance

Roy Lee — Wed, 24 Oct 2018 07:42:49 GMT

Thanks.
I will purchase TAC service asap, to secure the FirePower maintenance.
Hope I will never do the restore.