We have 19 devices being managed by FMC. Limitation is up to 25. Getting nearer to 25 devices might slower down the performance of FMC.

[hrithiktej]

We are thinking of spinning up a second VM, one in each DC and we split the existing load between the two. This will give us an upper limit of 50 appliances and some redundancy with regard to potential outages. We would need to do further research to see if there is an HA model using VMs that would give us true failover logging.

Is this a good plan ?

[Marvin Rhoads · Accepted solution]

I'm surprised you're not already unhappy managing 19 devices with FMC VM. I don't usually recommend it for any but the smallest deployments (say 5-6 sensors) due to its scalability issues re the database.

Distributing the load across two VMs would work but then you lose any possibility of common policies, object etc. as well as the integrated logs that you mentioned.

Only the FMC hardware (i.e. not VM-based) is eligible for HA. See confirmation here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_management_center_high_availability.html#ID-2242-0000039a

[hrithiktej]

Hey thanks I wil pitch this to my management and push them to get us a budget for hardware FMC