FMC Deplyment

[CSCO12028419]

HI All,
We have ASA 5516x with firepower in HA at two different location and we are using virtual FMC at branch level. Now our requirement is to move FMC in DC(other location) and add both location firepower.

I have some query to perform this activity:

1. How do i do licensing on new FMC?

2. How to add new FMC in ASA firepower?

3. Can i take config backup of existing FMC and restore it on new configured FMC.

Thanks in advance.

[Marvin Rhoads]

If it moving from virtual at branch location to virtual at data center then just shutdown the FMC, snapshot the disk and then move it to the DC VMware ESXi server. Boot and, from console, reconfigure the IP address.

Reconfigure your ASA Firepower service modules to use the new manager address. Confirm they are registered to Firepower and then redeploy policies to sync everything.

[CSCO12028419]

HI Marvin,

Thank for your reply, unfortunately we don't have vm at branch location, we had configured FMC on virtual box.

Thanks,

[Marvin Rhoads]

OK. Are you using a classic license (PAK-based) on the existing FMC? If so, you will have to reassign the licenses (for both FMC and the ASA Firepower service modules) in your portal at software.cisco.com.

If you're using Smart licenses you can deregister the existing server and then register the new one and assign licenses once it's built.

You can back up the existing FMC configuration and restore it but only if the Firepower Management Center version, Snort rules, VDB etc. all match. The easiest way to ensure that would be to update all of those to the current versions on the existing FMC and then build a new one to the same version and also update it.

Depending on how much configuration os on the existing FMC, it may be easier to just rebuild from scratch and not try to migrate the configuration.