topic Re: Replacing a faulty FTD with a new one on FMC in Network Security

Replacing a faulty FTD with a new one on FMC

l.buschi — Tue, 30 Sep 2025 11:21:08 GMT

Due to an error, an IT staff factory resetted a working FTD.

The FTD was registered to a FMC with a valid licenze subscription.

I have to reassociate my resetted FTD to FMC. Is there a way to do this without making again all configuration?

I'd like to configure my new FTD with the old management address and reassociate it to my FMC with the existing policies (pre filter, nat, interfaces and so on)

My firepower is a FPR-1010 associated to a vFMC. FW version is 7.0.6.3

Many tks

Johnny

Re: Replacing a faulty FTD with a new one on FMC

balaji.bandi — Tue, 30 Sep 2025 12:14:49 GMT

If the same model and same Code of the device, follow RMA and restore config and once rebooted check the FMC can see the new FW :

https://www.cisco.com/c/en/us/td/docs/security/firepower/hw/getting-started/fmc-1000-2500-4500/fmc-1000-2500-4500.html#Cisco_Concept.dita_d88eb4c6-88f2-4fb2-b3d2-60d46d3bb461

https://docs.defenseorchestrator.com/cdfmc/t-restore-threat-defense-from-backup.html#!t-restore-threat-defense-from-backup.html

Re: Replacing a faulty FTD with a new one on FMC

Marvin Rhoads — Tue, 30 Sep 2025 15:54:06 GMT

It's only possible to restore completely from FMC if you had a device backup saved. However the NAT, ACP, prefilter and platform settings are saved in FMC and can be re-associated once you register the replacement device. You would have to reconfigure the settings for interfaces, routing etc. that are all under the Device Configuration menus.

Re: Replacing a faulty FTD with a new one on FMC

l.buschi — Tue, 30 Sep 2025 16:03:22 GMT

Unfortunately I don't have a saved device backup.

So will I need to delete the original FTD and reassociate it configuring interfaces, routing and other device parameters?

Tks

Johnny

Re: Replacing a faulty FTD with a new one on FMC

Marvin Rhoads — Tue, 30 Sep 2025 16:19:30 GMT

@l.buschi yes, that is correct.

Re: Replacing a faulty FTD with a new one on FMC

Network Diver — Tue, 07 Oct 2025 08:14:45 GMT

What about when the failing FTD is a membe of a active/standby HA pair? I presume the steps are as follows:

Break HA
Unregister device from FMC
Replace device
Register new device with same IP/name to FMC
Update to same software version than active FMC
Configure port-channel for failover link
Configure HA.

We might do this soon as one of our four Firepower 2120 running FTD 7.4.2.4-9 is randomly crashing multiple times a day.