topic Re: HA Pair- FirePower Backup in Network Security

HA Pair- FirePower Backup

Lifeisbeautiful — Fri, 21 Feb 2020 14:28:38 GMT

I dont have backup of Firepower config from my old ASA in HA pair, but can I take firepower config from my working Active ASA in the HA pair and apply that on the new ASA firepower module?

Thanks

Re: HA Pair- FirePower Backup

Karsten Iwen — Fri, 13 Oct 2017 06:07:56 GMT

It all depends what Firepower-Version you are running on your ASA. With 9.2 on the ASA it's likely that you run a quite outdated Firepower version and the replacement ASA is newer than the old ASA. If that is the case then:

Update the ASA-software to a recent version (I prefer the newest 9.6 interim)
Update Firepower management Center to the newest 6.2.2 version
Update Firepower to the newest 6.2.2
Install the same ASA-software on the new ASA
Assumed that the sw-model on the new ASA also comes with a 6.2 version:
setup the module for your FPMC.
Apply the latest Updates to the new Firepower

For the Firepower config you don't need a backup. After adding the new module to the Firepower Management Center you can just apply the policies again.

Re: HA Pair- FirePower Backup

Lifeisbeautiful — Fri, 13 Oct 2017 07:04:00 GMT

I have got both the ASA running 5525-X which is running 9.2(2)4.

I read here that you can apply the backup config

https://supportforums.cisco.com/t5/intrusion-prevention-systems-ids/asa-rma-with-firepower-on-ssd/m-p/2942561#M23274

My question is , after I have installed the firepower (same version as of active ASA) on the new SSD if I take the backup from the active ASA with firepower module and apply that on the backup ASA firepower module, will that be ok

Re: HA Pair- FirePower Backup

Karsten Iwen — Fri, 13 Oct 2017 07:16:01 GMT

You don't need a backup/restore procedure as the FMC will take care of the policy. All you have to do is bring the module into FMC.

Re: HA Pair- FirePower Backup

Lifeisbeautiful — Fri, 13 Oct 2017 07:29:03 GMT

Thanks for your reply.

So once the module is intalled on the SSD and point to the FMC , then do I have to goto FMC to push the config to the backup ASA firepower module or does it happen automatically