topic Re: Who has FMCv in HA? in Network Security

Who has FMCv in HA?

Madura Malwatte — Tue, 14 Feb 2023 13:43:22 GMT

Interested to hear if everyone is using FMCv in HA set up now that this option is available since 6.7? The second FMCv does need to be licensed - so are people purchasing the additional license for HA or going with the old school method of a single FMCv and using a DR plan in case it goes down?

If using a single FMCv is the recovery recommendation to use backup/restore into a cold standby FMCv?

Re: Who has FMCv in HA?

balaji.bandi — Tue, 14 Feb 2023 13:52:40 GMT

we have a combination of Physical and Virtual - both work as expected. some of Colo need virtual and Local need Physicals.

Physical devices do not need a special License. but for Virtuals yes.

FMCv

You will need two identically licensed FMCvs.

below URL give you more information.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/system-ha.html#id_21087

If using a single FMCv is the recovery recommendation to use backup/restore into a cold standby FMCv?

FMC High Availability Disaster Recovery - from the above document help you.

As long as the IP not changing, you can do wish you like to do, if the IP changing, then you need do de-register and register FTD (just want to heads up)

Re: Who has FMCv in HA?

Madura Malwatte — Tue, 14 Feb 2023 13:59:49 GMT

Thanks for the response. Only interested in the virtual FMC set up. Do customers that have FMCv, using in HA mode out in the field since its supported?

Actually the FMC High Availability Disaster Recovery section in the doc is recovery when in HA. I am asking what is the recommended recovery pre 6.7 when HA was not available for FMCv, and is it still recommended post 6.7 in non HA set ups?

Re: Who has FMCv in HA?

balaji.bandi — Tue, 14 Feb 2023 16:06:50 GMT

You know the best answer here when there is no HA, means Lift and shift. (is that what we do right ?)

that means, you locally sync the database somehow your own between DR sites, making sure they are up to date in the SYNC along with objects and policies.

Re: Who has FMCv in HA?

Marvin Rhoads — Thu, 16 Feb 2023 13:01:25 GMT

I only have two customers (out of several dozen) running FMC in HA mode. Both of them are using physical appliances.

In my experience, the HA feature is about more trouble than it is help since it is one more thing that can (and does) break. I would be more of an advocate of having a good backup for your existing single FMC VM with a well thought-out business continuity / disaster recovery (BC/DR) plan.

Re: Who has FMCv in HA?

Marius Gunnerud — Thu, 16 Feb 2023 15:26:22 GMT

We have no customers running FMCv in HA. As long as you have up-to-date backups of the FMC restoring the FMCv into operational status is fairly fast and painless. I have had a few FMCv die on me and setting it up from scratch and restore the backup has worked like a charm.

Given that if the FMC is just a management center and client traffic is not affected if it is out of operation, clients prefer to accept the risk of being without it for a while and save money on the licensing. This goes the same for physical devices, again save money on licensing and hardware in exchange of accepting possible downtime of the FMC and not being able to perform changes.