topic Re: Disabling Automatic Deployments in FMC/FTD in Network Security

Disabling Automatic Deployments in FMC/FTD

CJ Bird — Mon, 11 Dec 2023 14:12:37 GMT

I have a question to an issue that none of us can effectively figure out. We created and staged a few different firewall rules and tunnels this weekend, with the intent on deploying sometime later this week. At 2:08am, FMC automatically deployed this rule and it took our entire LAN down, as not all configuration changes have been completed. Nowhere in the FMC GUI does clearly show where you can stop all deployment changes. We want to have complete manual control over all updates, and do not want FMC deploying any changes automatically. What is the manual override and a permanent config setting that will not allow this to happen ever again? If you select 'deploy', these is a menu that allows you to apply scheduled deployments, but nowhere is there a place here you can cancel existing automatic deployments. Thanks in advance.

Re: Disabling Automatic Deployments in FMC/FTD

MHM Cisco World — Mon, 11 Dec 2023 14:18:11 GMT

check under the tab of deployment advanced
MHM

Re: Disabling Automatic Deployments in FMC/FTD

Rob Ingram — Mon, 11 Dec 2023 14:22:32 GMT

@CJ Bird you've probably got a scheduled task configured to deploy policies, you should disable these tasks to ensure policies are only deployed manually. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/720/management-center-admin-72/tools-scheduling.html?bookSearch=true#task_CA11FE907BD94BF385C63C433DE29E15

Re: Disabling Automatic Deployments in FMC/FTD

Marvin Rhoads — Mon, 11 Dec 2023 17:12:56 GMT

In addition to the task scheduler mentioned by @Rob Ingram , you should also check the System > Updates > Rule updates section for a possible recurring updates with automatic deployment.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/720/management-center-admin-72/system-updates.html#ID-2259-00000422

Re: Disabling Automatic Deployments in FMC/FTD

CJ Bird — Mon, 11 Dec 2023 18:06:12 GMT

So it turns out, it seems like the policy rules may be tied to the SRU updates, which we do prefer to remain updated during weekly automated intervals According to TAC, the only way to disable the automated policy updates is to disable the automated SRU updates, as the two are tied together. This doesn't immediately make sense, and I question that claim, as it appears you can independently deploy policy changes from normal recurring automated SRU updates.