topic Re: Firepower Sensor distribute deployment in Network Security

Firepower Sensor distribute deployment

Jing Hong Li — Fri, 21 Feb 2020 14:58:48 GMT

I would like to deploy a FMC at HQ site, and with firepower sensor(firepower appliance, asa with firepower service, ftd) deploy at remote site, is there some prerequisite to meet this deployment requirement ? such as:

1.HQ site and remote site minimum bandwidth

2.HQ site and remote site minimum RTT, delay, and jitter

3.need QoS policy to guarantee the FMC and sensor traffic ?

Thanks!

Re: Firepower Sensor distribute deployment

Bogdan Nita — Tue, 19 Dec 2017 11:35:08 GMT

1. 256 kbps for policy push.

2. I wasn't able to find a guideline. It shouldn't be that important, as long as the values are reasonable for tcp traffic.

3. Yes, if you want to be able to push the polices in a timely fashion, the other necessary downloads can be scheduled.

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212043-Guidelines-for-Downloading-Data-from-the.pdf

Re: Firepower Sensor distribute deployment

Jing Hong Li — Tue, 19 Dec 2017 13:47:08 GMT

Thanks for reply and the doc.

And according this doc，It is download direction bandwidth from FMC to managed device，but how about upload direction bandwidth from managed device to FMC ? As I know there will be some event data, host info will sent to FMC from managed device.

Best Regards,

Re: Firepower Sensor distribute deployment

Marvin Rhoads — Tue, 19 Dec 2017 14:54:32 GMT

Bandwidth up from sensor to the managing FMC can vary greatly. Event reporting will consume, on average, 700 bytes/event. So that's 5600 bits x your anticipated number of events per second (EPS).

Since the EPS rate can vary by orders of magnitude among customers (and even across sensor deployment at a given customer), you need to do the math on that bit yourself.

Re: Firepower Sensor distribute deployment

Jing Hong Li — Thu, 21 Dec 2017 09:25:58 GMT

thanks Bogdan and Marvin.

Re: Firepower Sensor distribute deployment

bstewart — Sat, 24 Mar 2018 06:41:25 GMT

Firepower Appliance and ASA+Firepower can both be deployed at remote sites. FTD wasn't designed to do that very well, so you'll need to either have a separate management connection (like an extra DSL or 3G/4G wireless connection) or an alternate router or firewall that can do NAT in parallel to your ASA, because otherwise you need the connection from the FTD management port to the FMC to set up NAT, but you can't use that until the NAT is set up. (That's not a problem for the ASA+FP configuration, because you can use the ASA CLI to set up NAT, so any connection to the console or the outside port can be used to reach that.)