topic FMC Deployment time in Network Security

FMC Deployment time

orkhan.rustamli.96 — Fri, 21 Feb 2020 17:09:11 GMT

Hi all,

I have 4 Firepower devices: 2 FTD 2130 and 2 ASA5525x with Firepower module which are managed by FMC. All software are in 6.2.3.7 version. The problem is deployment time. While SFR modules take appx 4mins to deploy FTD HA Pair is deployment nearly 6-7 minutes which is effecting my work. What is you advise? Which version is faster and stable?

PS:. FMC is virtual. 16RAM and 8 CPU

Re: FMC Deployment time

Sheraz.Salim — Tue, 21 May 2019 08:22:40 GMT

this depends what and how long your configuration on FMC you pushing toward your sensor ASA and the FTD. when you make the changes the whole script at the back end of the FMC is generated and pushing the configration to end end devices. This is a normal behavior.

Re: FMC Deployment time

Abheesh Kumar — Tue, 21 May 2019 10:49:02 GMT

Hi,
It depend upon the number of access rules you binded to the firewall. We can expect improvement in deployment time on future releases. As of now Cisco suggested release is 6.2.3.10. But that doesn't improve the deployment time.

Hope This Helps
Abheesh

Re: FMC Deployment time

Marvin Rhoads — Wed, 22 May 2019 05:45:02 GMT

6.3 and 6.4 have both improved deployment times. Up to 50% better as compared to 6.2.x.

TAC is continuing to recommend 6.2.3.x as the most stable release but 6.3.0.3 is looking pretty good. 6.4.0.1 is still pretty new and not as widely deployed so I would hold off on it if you're at all risk averse.

Re: FMC Deployment time

mj0hansen — Thu, 23 May 2019 06:34:50 GMT

I've deployed several 6.4.0.1 updates to multiple customers, and they do speed up the deployment process substantially vs. the previous releases as you're referring to. Haven't run into any showstopping bugs either.