Firepower Management Center Backup SSH Keypair

goraprhelmad — Tue, 30 Sep 2025 13:12:34 GMT

Hi,

we store our backups to a remote storage via sftp. It's possible to do this with SSH public/private keys. The FMC default uses ssh-rsa key for root@firepower which is stored in /etc/ssh on the filesystem. The remote server doesn't accept rsa keypairs anymore. How can I change this, such that the FMCv uses the ed25519 or ecdsa keypair, which is also in /etc/ssh?

Thx in advance.

Re: Firepower Management Center Backup SSH Keypair

vishalbhandari — Sat, 11 Oct 2025 03:22:01 GMT

You can’t directly change the key type used by FMC’s backup process through the GUI or CLI. The FMC backup function is hardcoded to use the default ssh-rsa key for root@firepower. Since your remote SFTP server no longer accepts RSA, the practical solution is to either:

Re-enable RSA temporarily on the SFTP server (if possible), or
Use an intermediate SFTP host that accepts RSA from FMC and forwards via ED25519/ECDSA, or
Open a TAC case to request an enhancement or verified workaround from Cisco, since manually modifying /etc/ssh or the backup script is unsupported and may break after upgrades.

topic Firepower Management Center Backup SSH Keypair in Network Security

Firepower Management Center Backup SSH Keypair

Re: Firepower Management Center Backup SSH Keypair