Cisco FMCs and Firewalls

[techburn_@hotmail.com]

Hi all,

 we are setting up on  Cisco FMCs and Firewalls. They will have 2 FMCs configured in HA.
Can you tell me if it is supported to have just 1 E-Streamer receiving logs from the primary FMC or should we have 2x E-streamers with a cert from each of the 2x FMC’s, to receive logs.

[marce1000 · Accepted solution]

  - Ref : https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215631-understand-estreamer-and-troubleshoot-en.html
        >...
        >What are the recommended options to configure eStreamer for FMC High Availability (HA) setup?
The recommendation is to configure only the active FMC unit for eStreamer. If you configure both FMC units for eStreamer the SIEM receives duplicates events because the standby FMC responds to eStreamer request. Related enhancement request: CSCvi95944 

  M.