topic Re: FMC 4600 Version 6.7.0 Etherchannel Configuration in Network Security

FMC 4600 Version 6.7.0 Etherchannel Configuration

TW80CJ5 — Mon, 14 Dec 2020 20:49:15 GMT

Hello All,

We have an FMC 4600 Version 6.7.0 that manages all of our ASA SFR's in Production. We are wanting to build a two port port channel on the FMC and are not having much luck. I see articles about that it is capable, but there are no configuration guides. The GUI doesnt really help much and figured that we would have to use the Linux CLI.

Any ideas or suggestions are welcomed!

Re: FMC 4600 Version 6.7.0 Etherchannel Configuration

balaji.bandi — Mon, 14 Dec 2020 21:59:44 GMT

have you tried below :

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215351-configure-verify-and-troubleshoot-port.html#anc25

Re: FMC 4600 Version 6.7.0 Etherchannel Configuration

Marvin Rhoads — Tue, 15 Dec 2020 08:32:58 GMT

The FMC appliance itself does not support connection to the network via portchannel.

FMC can create Etherchannel interfaces on managed FTD 1000 and 2100 series devices. Firepower 4100 and 9300 series devices must first create the Etherchannel using Firepower Chassis Manager.

For managed ASA Firepower service modules, all interface configuration is done on the parent ASA via ASA cli (or ASDM).

Re: FMC 4600 Version 6.7.0 Etherchannel Configuration

TW80CJ5 — Tue, 15 Dec 2020 15:42:23 GMT

Good Morning Marvin,

Are you saying we can use the FirePower Chassis Manager to create the Etherchannel? And if we are successful in creating it the Etherchannel, we wont be able to use if for our network connection???

Thanks for the information!

Re: FMC 4600 Version 6.7.0 Etherchannel Configuration

Marvin Rhoads — Thu, 17 Dec 2020 10:36:17 GMT

A Firepower Management Center (FMC) appliance itself does not support Etherchannel for its own (FMC appliance) interfaces. No way, no how, not now (as of version 6.7).

You use Firepower Chassis Manager (FCM) to create Etherchannel interfaces on Firepower 4100 and 9300 series devices. Once created they can be assigned to and used by the FTD logical device(s) running on that hardware.

FMC can create and configure Etherchannel interfaces on managed Firepower 1000 and 2100 series devices running FTD software. It can also configure Etherchannels (created in FCM) on managed Firepower 4100 and 9300 series devices running FTD software.

Re: FMC 4600 Version 6.7.0 Etherchannel Configuration

TW80CJ5 — Wed, 16 Dec 2020 23:40:09 GMT

Well darn...

Its stinks that Cisco builds a NGFW Database Appliance at a cost of $75k+ that doesnt support etherchannel.

I guess aI will keep my fingers crossed for a future release that incorporates that feature...

Thank you for a great answer / explanation.

Re: FMC 4600 Version 6.7.0 Etherchannel Configuration

Marvin Rhoads — Thu, 17 Dec 2020 10:38:12 GMT

Unfortunately the only high availability solution for FMC (currently) is to have a second appliance in HA configuration.

If throughput is the concern, you can use the multiple interfaces with separate routes for each one.