topic Re: When adding existing ASA to a rebuilt FMC in Network Security

When adding existing ASA to a rebuilt FMC

lowellsmith — Thu, 14 Apr 2022 05:13:23 GMT

Hello,

We have an HA pair of ASA 5525 with the firepower module. The FMCv was corrupted and we had to take it offline. The FMC has since been rebuilt and we are ready to add it back as the manager of the firepower module. Everything I've read so far describes a net new install of an ASA to an FMC but from trial and error I've experienced once you make the FMC the manager it wipes out the config of that device. Can this be avoided or will i need to recreate the config on the FMC first and push it to the ASA after I make the FMC the manager?

Re: When adding existing ASA to a rebuilt FMC

balaji.bandi — Thu, 14 Apr 2022 14:07:51 GMT

If you have backup from old, restore to new FMC with new version, suggest to re-register the device, until the config is pushed its not going to overwrite here.

Re: When adding existing ASA to a rebuilt FMC

lowellsmith — Mon, 02 May 2022 17:58:04 GMT

We don't have a back up of the old FMCv config it is a brand new install. Because of how long it took for us to get the a new FMCv spun up the ASA's have been operating as without the FMC for some time now. So If we introduce the FMCv as the manager of the firepower module on the ASA will that wipeout the ASA config file and attempt to download a config from the FMCv?

Re: When adding existing ASA to a rebuilt FMC

Marvin Rhoads — Tue, 03 May 2022 04:42:36 GMT

If there are any access control policies or other child policies on the Firepower service module, (re)registering to an FMC will replace those policies with whatever is designated on the FMC to be associated to those modules.

However, many organizations only use the most basic IPS policy on an ASA Firepower service module, preferring to continue to use the ASA for implementation of security policy.

Re: When adding existing ASA to a rebuilt FMC

lowellsmith — Thu, 05 May 2022 18:02:14 GMT

So that is at the root of my concern, will registering the Firepower module to the FMC wipe out the existing ASA config? Will I have to create a config in the FMC for the ASA to pull down along with the policies for the Firepower module? I hope I explained that correctly. Thanks again for all the information btw. It is greatly appreciated.