topic Re: Backing up config, FTD and vFMC. in Network Security

Backing up config, FTD and vFMC.

itsupport — Fri, 21 Feb 2020 14:30:29 GMT

Hi.

I am most of the way through implementing an ASA 5508-x, controlled by a vFMC. Both are running 6.2.2.0 of the FTD and FMC software.

Since the configuration is quite complex, and I would hate to have to do it all again from scratch, I figured that backing it up would be a good idea. When I go to System>Tools>Backup/restore, I see options for "Firepower Management Backup"and "Managed Device Backup."This seems logical; one backs up the vFMC, the other the ASA 5508-x.

Going to "Firepower Management Backup", I was indeed able to create and pull down a 270Mb .TAR file. Looks good!

When I go to "Managed device backup" however, I am greeted with a blank box of "managed devices", and cannot kick off a backup.

So, Questions:

1. Should the managed ASA 5508x be listed here as a managed device that I can backup?
2. If not, if the configuration and other data required to restore the ASA 5508x included in the "firepower management backup".

I want to be in a position where I can restore both the FTD and vFMC in the event of a catastrophic hardware failure. Probably better to sort this out now as opposed to when a device catches fire or gets stolen or something.

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Tue, 17 Oct 2017 04:43:18 GMT

Managed device backups are only for classic Firepower appliances - not for ASA firepower service modules or FTD appliances.

Your FMC backup has all the policies and other settings for your ASA 5508 running FTD. To recover from scratch (say a hardware failure requiring RMA), you would have to at least bootstrap FTD on the ASA with the proper FTD software revision and then register it to your FMC and then redeploy all the policies to it.

Re: Backing up config, FTD and vFMC.

fperalta11 — Tue, 22 May 2018 22:20:12 GMT

Hello, I have the same problem with the ASA5525, I can not perform the Backup!!

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Wed, 23 May 2018 15:56:12 GMT

@fperalta11 as I noted on my 10-17-2017 reply, the FMC backup feature is not for ASA firepower service modules.

This limitation is documented in the FMC Configuration Guide as follows:

"You cannot create or restore backup files for NGIPSv, Firepower Threat Defense physical or virtual managed devices or ASA FirePOWER modules. To back up event data, perform a backup of the managing Firepower Management Center."

Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/backup_and_restore.html#concept_DF40AA6939E34B249A51AEA910226342

Re: Backing up config, FTD and vFMC.

spopravak@mds.rs — Tue, 30 Oct 2018 12:51:36 GMT

Hello Marvin.

First of all, thank you for all your effort with the Firepower. You are doing a great job!

Anyhow, is there a possibility to recreate a configuration/policies/etc from the managed device in the case of the FMC failure (given that there is no FMC backup 🙂 )? (almost) All data is still on the device, right?

Thanks

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Tue, 30 Oct 2018 15:04:34 GMT

You're welcome spopravak@mds.rs

You're right the configuration is indeed all there on the managed device. Unfortunately it cannot be retrieved in any usable way to restore to a rebuilt FMC.

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Sun, 03 Feb 2019 11:48:26 GMT

Note that version 6.3 added the capability to backup managed FTD devices from FMC.

Re: Backing up config, FTD and vFMC.

ramirezjason — Fri, 10 May 2019 16:19:44 GMT

Hi Marvin,

I dont really understand the use case for backing up FTD devices if we still would need the FMC to restore the backup

Unless this is for a case where we lose FMC, all created policy and have no backup

Any other advantages to having FTD device backups?

Re: Backing up config, FTD and vFMC.

NeWGuy1109 — Tue, 15 Oct 2019 14:22:33 GMT

Hello Marvin,

With reference to mentioned link i understand that FTD devices cannot be backed up using FMC...however, if the FMC backup is taking care of all the policies and managed device configurations... is there a need to take individual FTD device backup ? cant FTDs be restored from FMC backup in times of a disaster

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Wed, 16 Oct 2019 06:13:20 GMT

Things such as device interfaces, routing etc. aren't included in the FMC backups (pre-6.3).

Re: Backing up config, FTD and vFMC.

NeWGuy1109 — Wed, 16 Oct 2019 08:51:41 GMT

Thank You for the reply...

So pre 6.3 .. for complete recovery FMC Backup + Chassis (Where FTD logical device is installed) is required.
Will Chassis Backup include whole FTD configs such as interfaces routing etc ?

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Thu, 17 Oct 2019 03:33:34 GMT

I'm not positive about what the chassis backup includes. I don't think it gets logical device platform settings.

Basically, older versions of FTD don't have a sound backup strategy. That's why Cisco is enhancing those features going forward.

Re: Backing up config, FTD and vFMC.

Prashobcv93 — Tue, 11 Oct 2022 10:24:08 GMT

Could we take a list of all ACLs in the FTD from FMC??

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Tue, 11 Oct 2022 15:49:08 GMT

You can see the Access Control Policy entries (and associate object values) if you run a report of the ACP from the main page Access Policy page. Look for the icon that looks like a stack of papers on the right. That will generate a PDF copy of the policy.

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Thu, 11 May 2023 14:46:13 GMT

Updating this old thread since I just got a helpful vote today. 🙂

Device backups for FTD devices are available in FMC 7.x - they were not available in 2017 with 6.x.

Re: Backing up config, FTD and vFMC.

garrett.butler — Wed, 27 Mar 2024 04:31:34 GMT

@Marvin Rhoads I also would like to know the advantage of taking individual FTD device backups. The FMC has all Platform Settings and ACP etc., -- why do we need to backup each FTD, if we are already backing up the FMC?

Consider FMC/FTD 7.x -- If FTD fails but FMC is fine, then we can simply re-register a new FTD (eg., RMA device) with the same FMC, and then assign the same ACP and Platform Settings and push policy to it. Right? So, as long as FMC is backed up, then it is easy to restore any failed FTD under it.

Right?

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Wed, 27 Mar 2024 14:42:07 GMT

@garrett.butler a complete device configuration is comprised of data drawn from several sources in FMC. The ACP with all child policies (Intrusion, SSL Network Discovery etc.) in one piece. The platform policy is another. As is the NAT policy.

The device backup will include all of the elements under the device configuration menus - interface address, names, zone assignment, port channel (if any), routing, VRFs etc. None of those are included in the previously mentioned policies.

Re: Backing up config, FTD and vFMC.

ShaktiNarayanLakshmanan22571 — Fri, 10 May 2024 08:40:29 GMT

@Marvin Rhoads Wanted to check if FMC is down due to a hardware issue we don't have the latest backup of FMC but the FTD managed via the FMC has having latest config. Is there any way we can restore the policy and objects from FTD to FMC to avoid losing the latest config of FTD.

Re: Backing up config, FTD and vFMC.

Marvin Rhoads — Fri, 10 May 2024 11:13:51 GMT

There is no supported way to copy an FTD configuration into a rebuilt FMC. The best you can do is to save the "show running-config" and use that as your basis for a manual rebuild.

Re: Backing up config, FTD and vFMC.

garrett_butler@dell.com — Sun, 10 Nov 2024 20:48:05 GMT

Hi Marvin,

Firstly, thank you for all of your helpful replies and guidance in the Cisco community.

In a previous response in this thread, you stated "Things such as device interfaces, routing etc. aren't included in the FMC backups (pre-6.3)."

But post 6.3, are the Platform Settings, device interfaces, routing, etc., included?

From Firepower Management Center Configuration Guide, Version 7.0 - Backup and Restore [Cisco Secure Firewall Management Center] - Cisco -- It states that "All configurations you can set on the FMC web interface are included in a configuration backup, with the exception of remote storage and audit log server certificate settings."

What Is Backed Up?

FMC backups can include:

Configurations.
All configurations you can set on the FMC web interface are included in a configuration backup, with the exception of remote storage and audit log server certificate settings. In a multidomain deployment, you must back up configurations. You cannot back up events or TID data only.

This indicates that all settings configurable in the FMC Web UI (including Platform Settings, routing, NAT, etc), will be included in the "FMC" backup itself (not the FTD "managed device" backup). Because these settings fall under"All configurations you can set on the FMC web interface are included in a configuration backup, with the exception of remote storage and audit log server certificate settings."

If we do not have a "managed device backup" of the FTD taken by the FMC, and we needed to restore policy to a new RMA device -- Other than manually configuring the same or new "management" IP address on the new RMA FTD, and re-registering to FMC, and then re-deploying correct policies to it from FMC (Platform Settings, NAT, routing) -- what exact configuration would be missing/lost from the FTD at this point, which would prevent us from bringing it back into production?

Thanks in advance for your expertise,