Unfortunately database corruption is a possible side effect of power loss. I had a Webex with TAC this week and can confirm that this is an architectural issue that is being worked on. I cannot confirm that this affects firepower modules as well, but FTD on FPR2110 (<= 6.2.3.6) is definitely affected. It doesn't happen with every crash but it looks like under certain conditions power loss can brick the database beyond repair. (one of the matching bug IDs: CSCvc77158)  ... View more

It's a bit more than the management. FTD basically combines the asa and sourcefire code into one image so there is no need for a software or hardware module in the firewall. I wouldn't say it is their goal to eliminate CLI but it was an unfortunate conclusion that was reached. CLI configuration is not possible as of now (with some cli operations being the exception) and all configuration must be done from FMC or FDM UI.   As of now I would say it is worth taking a look at, since it will be the way forward in ciscos firewall strategy. Ofc there are still some limitations that you should keep in mind: Unsupported Multiple-Context mode Clientless SSL VPN Configuration CLI HA (Active/Standby) for Public Cloud (AWS/Azure) ASA5585-X Platform support (not possible due to hardware architecture) Hyper-V support TLS Proxy for Encrypted Voice Inspection Supported with limitations Local device manager (no feature parity between FDM and FMC) Central management via in-band data path (Staging or OOB required for remote management) AnyConnect (no feature parity with ASA) REST API (no feature parity with ASA REST API yet) SSL Acceleration (only for FPR4100 & FPR9300) Clustering (only for FPR4100 & FPR9300) Unified Connection Logging (FTD Connection events do not include detailed L4 information, e.g. SYN Timeout, etc.) Supported with FlexConfig Modular Policy Framework (e.g. changing tcp timeouts, changing inspections depending on ACL) Bidirectional Forwarding Detection (BFD) Web Cache Communications Protocol (WCCP) Virtual Extensible LAN (VXLAN) Intermediate System to Intermediate System (IS-IS) Enhanced Interior Gateway Routing Protocol (EIGRP) Policy-based Routing (PBR) Equal-cost multi-path routing (ECMP) NetFlow   Hope that helps. :)    ... View more

There could be various reasons as to why the performance is measured at 2.5Gbps by NSS Labs. According to their testing methodology (v 7.0) they are using traffic generators that will do various src/dst ip/port variations but I could not figure out the exact numbers.    Since Firepower load balances traffic across multiple snort (ips) instances the result could be like that because of sub-optimal load balancing due to insufficient number of variations in the test traffic. The datasheet numbers are basically the max performance if traffic is evenly distributed to all snort instances... so the maximum throughput of a single flow = [datasheet-throughput] / [snort-instances].   Another reason could be bugs in 6.1.0.1 that lead to performance degradation. If you seek a more detailed reason you would have to contact cisco or buy the nss labs report that might go into more details.   Hope that helps.    kind regards Oliver ... View more

CPU MIB   1.3.6.1.4.1.9.9.109.1.1.1.1.3. cpmCPUTotal5sec 1.3.6.1.4.1.9.9.109.1.1.1.1.4. cpmCPUTotal1min 1.3.6.1.4.1.9.9.109.1.1.1.1.5. cpmCPUTotal5min Memory MIB 1.3.6.1.4.1.9.9.48.1.1.1.5. ciscoMemoryPoolUsed 1.3.6.1.4.1.9.9.48.1.1.1.6. ciscoMemoryPoolFree ... keep in mind that this is only the lina part of FTD. As you may know FTD consists of two parts. Lina, which is basically the ASA code running in userspace and snort. Using the listed MIBs you will get stats for lina but not the various snort instances which handle L7 traffic.  As far as I am aware of there is no way to poll the linux part to get stats for snort instances using SNMP.   Hope that helps ... View more

The image is from a presentation. I am not sure if there is a customer facing document detailing all the feature differences between ASA with Firepower Services and FTD. As for the images content... it is still correct except for Remote Access VPN, which was added in 6.2.1 release for FPR2100 and 6.2.2 for all other platforms ... View more

FMC UI user accounts are being synced between FMCs. You may see a certain delay since the configuration must be replicated to the passive FMC... there is a enhancement request to publish more documentation on what exactly is synced between FMCs in HA (CSCve00330)   Hope that helps. :) ... View more

No offense but that logic is kinda flawed. I am not a big fan of the backup concept either. Its basically a database dump with some configuration files attached. I have some larger installations which already produce backup files that are > 2GB of size. @anazarenko - unfortunately you will need to live with the backup size. as of now there is no flat file configuration backup like what you are used to. 6.2.2.1 should include a better audit trail which might help you with compliance requirements. ... View more