time range fmc

sedaghati — Thu, 10 Jul 2025 05:01:34 GMT

Hi,
I have two Firepower 2100 series devices clustered and managed by FMC version 7.4.2. Previously, when I was using FMC 7.2, I had configured time ranges on some rules, and they were working correctly. However, after upgrading to version 7.4, the time ranges stopped functioning. Whether I apply a time range or not, the traffic still matches the rule. Even on days when the time range should not be active, the rule is still active and matches traffic.

The system time and time zone on the FMC are both set correctly. I also applied the latest patch (7.4.2.3), but it didn’t make any difference.

Re: time range fmc

wajidhassan — Thu, 10 Jul 2025 16:45:06 GMT

Recommended Actions
1. Verify Time Zone Configuration
Platform Settings → Time Zone: make sure your devices have the correct timezone assigned. If no timezone or set to UTC, time-range will evaluate incorrectly.

Confirm actual device time (show clock localtime on FTD CLI) matches your expectations.

2. Redeploy a Clean Copy
Sometimes removing and then re-adding the time-range object and its associated rule can help.

Ensure the object is directly referenced in the policy (Access Control, Prefilter, or VPN Group). Then deploy again.

3. Upgrade or Patch
Check for fixes in patch releases. Notably FMC 7.4.x Patch 3 and beyond may address some deployment errs (no documented fix, but user feedback suggests behavior improves).

If possible, consider upgrading to FMC 7.5+, as newer builds often resolve these edge-case bugs.

4. Limit FlexConfig Use
Users in similar situations noted that having FlexConfig or custom configurations can exacerbate object removal during deploys.

If using FlexConfig for this policy, try temporarily disabling it to see if the time-range consistently sticks.

5. Open or Escalate a TAC Case
This behavior is widely reported. Provide TAC with a deploy transcript showing the time-range commands being undone.

Ask for a bug ID (CSC?) if one exists, or request priority handling.

Summary
Issue Why it Happens What to Do
Time-range gets removed FMC “undefines” unused objects during deploy Re-add and redeploy policy referencing it
Devices ignore time-range Possibly due to timezone misconfig or object removal Verify timezone in platform settings and deployment logs
Bug in FMC 7.4 Known funky behavior in object handling Apply latest patches or upgrade to FMC 7.5+

Quick Checklist
Check timezone on devices and FMC platform settings.

Recreate the time-range object, reference it in rule/policy.

Deploy cleanly and watch logs for no time-range entries.

Disable FlexConfig temporarily if used.

Patch or upgrade FMC; target latest 7.4.x or 7.5+ builds.

Log TAC case with deployment transcripts.

Re: time range fmc

MHM Cisco World — Thu, 10 Jul 2025 19:21:41 GMT

show access-control-config <<- from ftd cli share output of this command

MHM

topic Re: time range fmc in Network Security

time range fmc

Re: time range fmc

Re: time range fmc