Moving FMC4100 to New Data Center

[TCSPB]

We are going to be moving our FMC FS4000 appliance to a new data center in the near future.   Does anyone here have any experience with moving their FMC like this?

 I know that the IP and name changes will require us to reconnect all SFR modules, but was wondering if there is anything else we need to worry about. Is there anything else that we should be aware of with the FMC being offline for more than 24 hours?  Besides not being able to make changes, is there anything else that we need to worry about?

Right now the plan is to make sure we have a backup, make the name and IP changes, then power off the FMC and ship it overnight to the new DC.  Then re-rack and power on in the new location.  I think because the SFR modules all connect to the manager by name, when we change the DNS record they will all be able to connect right back up after the device comes back online. 

[Oliver Kaiser]

Since you have used FQDN to register to your FMC the connection to the sensor should be re-established (already tested it > worked fine).

If you are using URL filtering make sure to disable unknown url lookups before the FMC migration to make sure you dont have latency issues (FMC does unknown url lookups and your sensors would need to reach a timeout before passing traffic with unknown urls).

In case you are using identity integration you should also be aware that there wont be any ip:user updates since FMC handles all the connection to ISE / User-Agent.

Hope that helps. :)

[TCSPB]

We are doing some URL filtering such as blocking Rep 1 URLs and the Category filters for things like Spam and Malware sites. Are you saying we should disable these while the FMC is offline?



I'm not sure where the unknown URL lookups come into play here so any help would be appreciated.

[Oliver Kaiser]

The unknown url lookups are triggered when an URL cannot be found in the local url database. On every sensors you have database in memory that is being queried when a url is being recognized in your network traffic. If the local url database has no match it will forward the query to FMC which then forwards the query to the cloud.

You can enable/disable unknown url lookups in FMC UI at System > Integration > Cisco CSI

[Marvin Rhoads]

Hi Oliver,

Your reply reminded me of this behavior. I believe the box is unchecked by default.

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/117956-technote-sourcefire-00.html#anc7

In the event that we do check it, do you know what the timeout value is? I don't see that in the documentation.

[Oliver Kaiser]

Hi Marvin,

I think there is a section in the FTD book by Nazmul Rajib that goes into more details. Unfortunately I borrowed mine to a colleague so I cant look it up at the moment. When I get a chance to look it up I will update this thread.

[TCSPB]

Is there a procedure for changing the manager IP on a HA pair of FTD devices?  Is it as simple as deleting them from the FMC and adding them back using the new IP address?