topic Re: How do you negate changes for a deployment that's queued up in Network Security

How do you negate changes for a deployment that's queued up

ABaker94985 — Sat, 10 Sep 2022 21:27:22 GMT

I started a configuration on an HA pair of 4110's running 7.0.1 managed by an FMC that ended up having some reachability problems between the FMC and FTDs because of some network changes that were happening concurrently. Deployment is failing because of the following:

Deployment failed due to configuration error . If problem persists after retrying, contact Cisco TAC.

I'd like to negate these, but I can't find the option to start from scratch and just have the FMC and FTDs to ignore these changes. How do I go about doing this? Thank you.

Re: How do you negate changes for a deployment that's queued up

Ambuj M — Sun, 11 Sep 2022 15:23:47 GMT

7.0 has a rollback feature, but I am not sure it will work in your case since FTD is already disconnected from FMC, see an example here

https://www.lammle.com/post/cisco-firepower-7-0-deploy-and-rollback-features/

Re: How do you negate changes for a deployment that's queued up

Marvin Rhoads — Mon, 12 Sep 2022 12:46:56 GMT

As @Ambuj M noted, you can use the Deploy > Deployment History > Rollback feature. But only if the deployment ever passed. Otherwise you would have to negate all of the pending changes in the respective sections of FMC to "erase" them as pending. If that's not practical, then open a TAC case. The TAC engineer should be able to negate the job manually via manipulation of the underlying database.

Re: How do you negate changes for a deployment that's queued up

ABaker94985 — Mon, 12 Sep 2022 12:50:46 GMT

ammahend, I appreciate your input. I've seen the rollback feature, but I found some documentation that states this is for DR purposes or something like that. I've been afraid to use it.

We did figure it out, though. I was pretty sure of the changes what were creating the error, so I went back into the configuration and negated them, tried to deploy, and then it succeeded. I was able to put the changes back in and redeploy, so we're good at the moment.