Got a weird issue with some of my FTDs, running 7.2.5 on FMC and FTD. It seems if there is a new LSP update (we're on snort 3), 9 times out of 10, a policy deployment fails to remote FTDs. Without an LSP update, it works fine. With an LSP update, its a tossup on if the push is successful or not. I'm investigating WAN link integrity as part of this, I did notice latency would spike to above 100ms on the 10mb circuit we have at some of these sites, but given the size of the LSP update, I figured this would be ok. WAN latency is usally around 10-20 ms.
I do have a tac case open, they haven't found anything weird with the config, and even ran our config in their own lab (allegedly) to 100% success.
One thing I am testing later is adding FMC-to-FTD connection to the prefilter policy on the HQ FTD, since the FMC is southbound of that, and has to send control connections through that site's FTD to connect to other sites' FTDs.
Just wondering if anybody else running cisco ftd / secure firewall has encountered something similar.
