FMC high availability

[Vishnu_RR]

Dear team,

Its new setup. There are 2 FMC such as fmc1 and fmc2 but not in HA.

 2 perimeter firewall (p1 and p2) and 2 internal firewalls(i1 and i2) added in the fmc1. 

fmc1, p1, i1 running from last few months where fmc2, p2, i2 were powered off.

Recently fmc2, p2 , i2 powered on. Now i have to setup HA between fmc1 and fmc2. both fmc1 and fmc2 running 6.4.0.9 software version and same snort update version.

what are the precautions do i need to take.

[Marvin Rhoads]

What model is your FMC? Until recently (i.e., 6.7), only hardware models (not VMs) could be used to create HA.

In any case, I would first move to the latest recommended release (6.6.1) for the FMC at least.

After that, you can then create FMC HA by following this guide:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/firepower_management_center_high_availability.html

[Vishnu_RR]

Hi Marvin,

we are using the hardware model 2600 FMC. both FMC currently running with 6.4.0.9 software version and FTD also running with same software versions.

shall I upgrade from 6.4.0.9 to 6.6.1 directly ?

[Marvin Rhoads]

Yes - 6.6.1 is the first Firepower release to allow direct upgrade to the minor release version from a previous major release train.

[lm20ele]

Configuration steps seem simple, did you encounter any issue?

Reading at the Configuration guide to build the HA pair I am reading a note under "Using CLI ro Resolve Device Registration in Firepower Management Center High Availability" where it says:

If you do an RMA of Secondary Firepower Management Center or add a Secondary Firepower Management Center, the managed FTDs are unregistered and as a result, their configuration may be deleted.

I got a little confuse here since that is what I am doing. Adding a Secondaru Firepower Management Center. why would it says the configuration of FTD will be deleted?

[Vishnu_RR]

Hi,

No issues in FMC HA. There is no option to configure a dedicated interface for FMC HA. so we have to use the same interface where we use it to register FTDs to FMC.

we can use a Fiber port that supports 10G.

suppose if the secondary FMC got replaced, then whatever configuration is in that secondary FMC will be deleted. but you can see the configuration in Primary FMC.