topic Changing FTD Platform Settings in Network Security

Changing FTD Platform Settings

jberrios — Mon, 16 Dec 2024 13:17:10 GMT

I currently have 2 sites, and each site has (2) FTDs in active/passive failover. When looking at the Platform Settings, they both share a single policy. I need to add another policy for each pair to change their syslog server settings to go to different syslog servers. When I create a "Threat Defense Settings" policy and add an HA to it, I am presented with the following message:

Following device have an existing platform setting or a DNS value configured by CLI. Do you want to replace the existing configuration?

How can I determine which setting(s) would be modified? Is there a potential for taking the pair offline?

Re: Changing FTD Platform Settings

Rob Ingram — Mon, 16 Dec 2024 13:26:16 GMT

@jberrios it is unlikely to impact transit traffic, as the Platform Settings policy applies setting applicable to the FTD itself. If your new Platform settings policy does not include DNS settings and the existing one does, you would probably want to ensure you define DNS servers and another other settings.

Why do you need to create a new policy, can you not amend the exist policy that is applied with the syslog servers?

Re: Changing FTD Platform Settings

MHM Cisco World — Mon, 16 Dec 2024 13:58:49 GMT

there is config replication from active to standby and there some little config not replicate
config different syslog is replication so what you try to do will not work

MHM

Re: Changing FTD Platform Settings

Marvin Rhoads — Mon, 16 Dec 2024 14:04:07 GMT

In addition to what @Rob Ingram correctly mentioned, you can preview the deployment changes before clicking the final confirmation button.

Re: Changing FTD Platform Settings

jberrios — Mon, 16 Dec 2024 16:14:27 GMT

@Rob Ingram , is it possible to specify multiple syslog servers within the same policy and direct each pair to specific syslog servers?

Re: Changing FTD Platform Settings

Rob Ingram — Mon, 16 Dec 2024 16:19:09 GMT

@jberrios not if they share the same policy.

Re: Changing FTD Platform Settings

jtorres44 — Thu, 03 Jul 2025 14:57:24 GMT

I have also began creating a platform settings policy in order to restrict ICMP access. I received the message regarding DNS settings, which were previously configured via CLI. If I keep the option, "Enable DNS name resolution by device" untoggled, will the FTD default back to the settings configured by CLI?

Re: Changing FTD Platform Settings

Marvin Rhoads — Mon, 07 Jul 2025 02:58:18 GMT

The cli-based DNS configuration is for the management interface only. The setting under platform policy is for dataplane DNS resolution and commonly used for access control policy entries that include FQDN references.