Increase Cisco FTD and FMC Default Disk size in VMware Workstation.

[whizkidraj]

Hello guys,

So as we deploy (add) the Cisco FTD and FMC in VMware Workstation with the .ovf file, the default disk size is very less and since we can thin provision, how can I increase this size to 2 TB.

Also, once I upgrade my Cisco FTD or FMC, does the upgrade process also cleans (deletes) the old version files automatically i.e. is anything needed to be done after the upgrade to clean the old version and any other junk files,
and if yes then which files and under what directory can I safely delete such or other files to keep the disk space clean and not being wasted from old version files or any other junk files / unneeded files.

[Marvin Rhoads · Accepted solution]

Database table sizes  are limited by the license in FMCv, so it doesn't help anything to increase the disk size. See "event storage space" in the dats sheet here: https://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/datasheet-c78-736775.html#Platformspecifications

Changing FTDv disk size doesn't affect performance in any way.

[Ken Stieers]

So.... on a tac call right now... 7.2.x is wanting more space... I've got 104G free and can't get a geo location update to install, it wants 118.  TAC says they're talking 500G for new deployments...  And no-one knows how to grow it when you add space.  I'm sure I'm going to hear that I have to redeploy and backup/restore, which is completely asinine.

[Marvin Rhoads]

As noted in your teams space posting, I had a TAC case for this issue a couple of months ago. The TAC cited https://bst.cisco.com/bugsearch/bug/CSCwe44571 . The workaround was as follows:
Truncated the geolocation files using below commands.
```
OmniQuery.pl -db mdb -e "truncate geolocation_ipv4;"
OmniQuery.pl -db mdb -e "truncate geolocation_ipv6;"
OmniQuery.pl -db mdb -e "truncate geolocation_ipv4_country;"
OmniQuery.pl -db mdb -e "truncate geolocation_ipv6_country;"
```
Reclaimed 48 GB of disk space for a total of 130 GB available to use. 

[thor1024]

I'm getting an error trying these truncate commands:

Error: DROP command denied to user 'barnyard'@'localhost' for table 'MYD'

[Marvin Rhoads]

@thor1024 you need to run the commands as root user. So, first "sudo su -".

[thor1024]

I'm running the commands as a root user.

[br-it-team]

Tranks!! It worked for me!

[David Ding1]

Thank you, Marvin

We have the same problem after upgrage to 7.2

I use your truncated released a lot space, but now GeoLocation ACP rules stopped working.

I'm try to update GeoDB again, but FMC said already installed.

How can I rollback now?

Thanks,

David

[Marvin Rhoads]

I suggest working with TAC.

If that's not an option for you, you should be able to manually download an earlier version and install it using "System > Updates > Geolocation Updates"

[David Ding1]

Thank you for your fast reply.

The cover is in renew, but the services impacted.

I tried download last version GeoBD from Cisco, and use GUI to update, but FMC still says the version is already installed.

Then I SSH to FMC go to /var/ sf/updates, removed the file, then tried again in FMC guide, but after the upload, it will still say the version is already installed.

I will log a TAC case once the cover renewed.

Thanks again.

David

[David Ding1]

Hi Marvin,

Cisco just released a new GeoDB, after push the update from the FMC GUI, all back to normal.

Maybe 11-05 GeoDB got problem.

Thanks,

David

[Marvin Rhoads]

Thanks for the update. Glad it is working again for you.

[Rodrigo Gurriti]

Hi Marvin,

CSCwe44571 says the problem is fixed on 7.2.5.1. I had the issue and I had TAC on the line, we managed to save some disk space with the same commands + deleting some old PCAP files. 

NOTE: I upgraded the FMCv to 7.2.5.1 and I still have issues with the GEO updates. I dont think it is fixed. 

[jcdamper]

Hello Marvin, I have the Space issue where I can't upgradre from 7.2.5 to 7.2.8 at the moment I can see these 2 files: 39G /var/lib/mysql/sfsnort/geolocation_ipv4_new.MYD
20G /var/lib/mysql/sfsnort/geolocation_ipv4.MYD

Does your OmniQuery commend will apply to the _new.MYD? 

What is the latest result on performing this workaround?

Thanks.