topic Re: FMC high availability in Network Security

FMC high availability

Vishnu_RR — Sat, 30 Jan 2021 13:33:29 GMT

Dear team,

Its new setup. There are 2 FMC such as fmc1 and fmc2 but not in HA.

2 perimeter firewall (p1 and p2) and 2 internal firewalls(i1 and i2) added in the fmc1.

fmc1, p1, i1 running from last few months where fmc2, p2, i2 were powered off.

Recently fmc2, p2 , i2 powered on. Now i have to setup HA between fmc1 and fmc2. both fmc1 and fmc2 running 6.4.0.9 software version and same snort update version.

what are the precautions do i need to take.

Re: FMC high availability

Marvin Rhoads — Sat, 30 Jan 2021 14:14:25 GMT

What model is your FMC? Until recently (i.e., 6.7), only hardware models (not VMs) could be used to create HA.

In any case, I would first move to the latest recommended release (6.6.1) for the FMC at least.

After that, you can then create FMC HA by following this guide:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/firepower_management_center_high_availability.html

Re: FMC high availability

Vishnu_RR — Mon, 01 Feb 2021 04:53:31 GMT

Hi Marvin,

we are using the hardware model 2600 FMC. both FMC currently running with 6.4.0.9 software version and FTD also running with same software versions.

shall I upgrade from 6.4.0.9 to 6.6.1 directly ?

Re: FMC high availability

Marvin Rhoads — Mon, 01 Feb 2021 06:57:27 GMT

Yes - 6.6.1 is the first Firepower release to allow direct upgrade to the minor release version from a previous major release train.

Re: FMC high availability

lm20ele — Thu, 28 Oct 2021 16:41:40 GMT

Configuration steps seem simple, did you encounter any issue?

Reading at the Configuration guide to build the HA pair I am reading a note under "Using CLI ro Resolve Device Registration in Firepower Management Center High Availability" where it says:

If you do an RMA of Secondary Firepower Management Center or add a Secondary Firepower Management Center, the managed FTDs are unregistered and as a result, their configuration may be deleted.

I got a little confuse here since that is what I am doing. Adding a Secondaru Firepower Management Center. why would it says the configuration of FTD will be deleted?

Re: FMC high availability

Vishnu_RR — Sat, 30 Oct 2021 10:14:19 GMT

Hi,

No issues in FMC HA. There is no option to configure a dedicated interface for FMC HA. so we have to use the same interface where we use it to register FTDs to FMC.

we can use a Fiber port that supports 10G.

suppose if the secondary FMC got replaced, then whatever configuration is in that secondary FMC will be deleted. but you can see the configuration in Primary FMC.