topic FTD Replacement in Network Security

FTD Replacement

muath1987 — Fri, 21 Feb 2020 17:07:32 GMT

Hello,

I have FP 2110 running FTD image, I should replace the appliance as I received new one, can you please advise me how I can replace the appliance and connect the new FTD, I mean is there any document or shall I first Join the FTD to FMC and how the configuration will be copied to the new FTD , do I need downtime or can i connect the new appliance directly.?

Re: FTD Replacement

balaji.bandi — Mon, 13 May 2019 21:26:47 GMT

Can you explaing more, what device are you replacing ? current working with new one same model ?

what is the reason of replacing? is the old one Faulty ?

Re: FTD Replacement

muath1987 — Tue, 14 May 2019 01:32:00 GMT

Hi Balaji

Here is the full story, we have received FP 2120 as demo from our cisco
partner, to test the device when we receive it we created FMC on local PC.
Before one week we have purchased server and I installed new FMC and then I
took a backup from old FMC and restore it on the new FMC..yesterday we have
received the new Firepower and the series is 2110 it's little not
different from the demo, today I configure the manager on the new FP but it
didn't join the FMC until I deleted the old device..i am looking for a way
to copy the config from old FP2120 to FP2110,, is there any way or shall I
configure the new appliance from scratch?

Re: FTD Replacement

Marvin Rhoads — Tue, 14 May 2019 02:57:14 GMT

Unfortunately this is a bit of a shortcoming on Firepower - you need to at least do the bootstrap config on the new unit from cli.

IF you are running FMC 6.3 or later you can have a backup of an FTD appliance and restore from it.

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/backup_and_restore.html#ID-2200-0000001f

Note you will probably have to also reassign the zone to interface mapping.

Re: FTD Replacement

balaji.bandi — Tue, 14 May 2019 06:50:13 GMT

As this is new product line from Cisco, some features are upcoming, as suggest @Marvin Rhoads you need to do basic config, then push the rest of the config from backup.

Good note for cisco development team this case in the future many customer expect to do so.