FireSIGHT system central management utility and backup question

[project722]

Our company is in the process of deploying the Cisco FireSIGHT managed firewall solution for customers. This will be a virtual implementation of Defense Center, NGIPS and ASA. In our setup there will be one dedicated per customer. Today we were discussing backup and restore for this solution. I would like to know if Cisco offers a centralized platform that would allow us to manage backup/restore of the Firepower Management server ? Something that we could use that would essentially manage all the Defense Center VM's we have with a single centralized server? Obviously we would rather not have to log into each one and setup a scheduled backup task for 500 customers. 

[Marvin Rhoads]

There is no current product that will act as a "manager of managers" for FirePOWER management Center.

The system policy (where things like backup target and frequency are defined) can be exported from a given instance and imported to all of the other instances.You could also use tools from VMware like snapshots to make point in time snapshots of the FirePOWER VMs.

Contact your Cisco account manager and/or partner SE to get information on potential roadmap (future releases) directions for this sort of feature. If you're buying 500 instances of FirePOWER you should  be working closely with them already. 

[project722]

Marvin, 

What about the NGIPSv and the ASAv? Reading through the docs there is no supported backup method for virtual instances. Is this something that most people accomplish with snapshots? Or , maybe the better question is do the NGIPSv and the ASAv need to be backup up/snapped at all? 

If we lost a customers VM's would there be any value in restoring these from snapshots as opposed to simply rebuilding? 

[keithcclark71]

I have read that VMWare snapshots are not supported for the FMC???  The unsupported term is so vague. Do they mean snapshots will still work but will not be supported by VMware if an issue occurrs etc  Do snapshots work or do they not???

[Marvin Rhoads]

Snapshots are always a challenge when the server in question has databases under the covers (as FirePOWER Management Center does). So Cisco identifies that they are "not supported". That means if you open a TAC case and say"I'm trying to restore from a snapshot and ..." They can say "Sorry - that's not supported."

That said, other engineers have reported using VMware snaphsots of FMC successfully. That doesn't guarantee your success but does give you a data point from which to make a judgement call based on your risk tolerance and comfort level.