Firepower Updates

[dm2020]

Hi All,

Quick question regarding Recurring Rule Updates within FMC. If it tick the 'Deploy Updated Policies to targeted devices' does that mean that the update will be automatically deployed to my FTDs and the Snort Process restarted? 

Thanks

[phil.hydea]

Hi - yes it will automatically deploy the updates and there will be detection engine restarts which will disrupt traffic inspection.

You can uncheck that box and create a scheduled task > Deploy Policy. This would allow you to choose the desired time (eg. a maintenance window) and frequency. This would mean if there are 3 SRU updates since the last policy deploy, the FMC would wait to deploy them (culminative).

Thanks

[dm2020]

Hi,

Thanks for the response. If I have 10 FTDs in my deployment, will these all be impacted at the same time if I configure this? Is there anyway to deploy the updates the the FTDs one by one?

Thanks

[phil.hydea · Accepted solution]

I've just editted my previous post. Yes they would all be impacted, you can use the Deploy Policy scheduled tasks to schedule the updates and target specific devices. (Leave the automatic deploy SRU checkbox unchecked)

Thanks

[Abheesh Kumar · Accepted solution]

Hi , If you are running version 6.2.3, then you can configure from cli to preserve the snort connections

configure snort preserve-connection enable

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/policy_management.html#concept_uc1_gtq_ty

HTH

Abheesh

[phil.hydea]

Yes good point. To also add to this, whilst existing connections can be
preserved, new connections will be dropped during the snort/detection
engine reload