Best Practice on FMC/FTD as Edge for Production and Backup datacenter

[SIMMN]

Let me first explain what I am looking for around this post Title.

Say I have a production datacenter using a pair of FTD (managed by local FMC) for Internet Edge security. Now I need to setup a second datacenter for failover/backup (not 100% DR) of critical services. I would deploy a new pair of FTD and local FMC for management in the second datacenter. From operation perspective, I would hope to have the two FMCs "duplicate" each other policy wise but the question is how should/would I keep the policies in-sync between the Prod FMC and FMC in second dc? Just manually configure the same policy twice?

I was also thinking about just use one FMC to manage both FTD pairs but there would be dependency between the two datacenters OR single point of failure (from management/operation perspective)...

Advise? 

[Rob Ingram · Accepted solution]

Hi @SIMMN 

I couple of options I can think of. You could use RESTAPI to import the same settings into both FMCs, or you are not familar with APIs in 6.7 you can import or export objects, so you could import into prod then export and import to DR FMC. Alternatively in CDO you can manage an FMC to an extent, it's possible you could mange both FMCs and share the same objects/configuration between the two.

If you used 1 FMC, the FTD's would still operate without comunication to the FMC, you'd obviously not be able to log traffic and you'd not be able to do any cloud lookups (AMP).

HTH

[SIMMN]

"import or export objects" approach was considered but wonder how big of difference between this and manually configure twice assuming there would be frequent changes in FMC policy/object wise.

[Marius Gunnerud]

I am curious how you would route the public IPs between the two sites so that users can access services that are published to the internet? The ISP would need to be involved to provide some kind of failover for this, or you would need to update global DNS entries.

In any case, Have you considered moving the standby FTD to the backup DC an also place a standby FMC at the backup DC site...(assuming there is L2 connectivity between the two.)

That way if primary DC goes down then there will be automatic failover of both FMC and FTD.  Or is there a policy or situation that is preventing you from doing this?

[SIMMN]

Regarding the Live applications/services, I should be more specific. Mostly it would the Anyconnect VPN and at this moment there would not be any other app/service published to Internet while running live in this backup DC.

Regarding your point about how to route the internet inbound traffic, the only way would be DNS LB or some sort...

I prefer not to move the existing secondary FTD into new DC as there might be a chance this new DC would become some level of DR down the road...

[Marius Gunnerud]

Then I would agree with Rob that the best option would be to create an API script that synchronizes the configuration on the active FMC to DC 2 FMC.

[SIMMN]

Wonder if there would be any sample RESTAPI that I potentially could reference to make my own replication/synchronization script...