topic FMC to FTD in Network Security

FMC to FTD

devnetfreak — Tue, 04 Apr 2023 16:06:44 GMT

My question is: If I remove FTD (in routed mode) from FMC and want to manage FTD locally using FDM, then using below steps won't remove config ?

Step 1 - Delete FTD from FMC.

Step 2 - Login to FTD using SSH and then use "configure manager delete"

Step 3 - Then after removing manager, use command "configure manager local" to enable FDM access.

Re: FMC to FTD

balaji.bandi — Tue, 04 Apr 2023 16:36:38 GMT

This is good question never done this, what is the use case why you looking to move from FMC to FDM ?

There is are some Limitation in FDM.

FMC most of the Configuration centrally saved in FMC, after pushing current config will be applied FTD.

configure manager delete and configuring Local (personally i see as risk)

rather i would reset to factory and start manangement locall and try to configure as required.

Re: FMC to FTD

Marvin Rhoads — Tue, 04 Apr 2023 16:44:58 GMT

Switching managers erases the device configuration and returns the system to the default configuration. However, management IP address and hostname are preserved.

Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/fdm/fptd-fdm-config-guide-700/fptd-fdm-mgmt.html#id_24195

Re: FMC to FTD

devnetfreak — Tue, 04 Apr 2023 18:00:33 GMT

Thanks Balaji, Actually one of our client organization had his FTDs managed on our FMC, now that client organization was bought by some other organization and they wanted to manage the network themselves. There Switching and Wireless solution is Cisco based, but not security. So they are not willing to go with FMC. I deleted the FTDs from our FMC and gave them managed device backup along with FTD admin credentials. So, I was thinking of the scenario where FTD from FMC is moved to FDM and just out of curiosity, I wanted to know if there is any method with which FTD won't lose config while shifting from FMC to FDM.

Re: FMC to FTD

balaji.bandi — Thu, 06 Apr 2023 00:34:10 GMT

yes agreed with your response, in that customer taking risks, as mentioned covering Local will erase config(as mentioned by @Marvin Rhoads , so the customer has the config, so they can build manually whatever they like.