Backing up config, FTD and vFMC.

[itsupport]

Hi.

I am most of the way through implementing an ASA 5508-x, controlled by a vFMC. Both are running 6.2.2.0 of the FTD and FMC software.

Since the configuration is quite complex, and I would hate to have to do it all again from scratch, I figured that backing it up would be a good idea. When I go to  System>Tools>Backup/restore, I see options for "Firepower Management Backup"and "Managed Device Backup."This seems logical; one backs up the vFMC, the other the ASA 5508-x.

Going to "Firepower Management Backup", I was indeed able to create and pull down a 270Mb .TAR file. Looks good!

When I go to "Managed device backup" however, I am greeted with a blank box of "managed devices", and cannot kick off a backup.


So, Questions:

1. Should the managed ASA 5508x be listed here as a managed device that I can backup?
2. If not, if the configuration and other data required to restore the ASA 5508x included in the "firepower management backup".

I want to be in a position where I can restore both the FTD and vFMC in the event of a catastrophic hardware failure. Probably better to sort this out now as opposed to when a device catches fire or gets stolen or something.


 

[garrett.butler]

@Marvin Rhoads I also would like to know the advantage of taking individual FTD device backups. The FMC has all Platform Settings and ACP etc., -- why do we need to backup each FTD, if we are already backing up the FMC?

Consider FMC/FTD 7.x -- If FTD fails but FMC is fine, then we can simply re-register a new FTD (eg., RMA device) with the same FMC, and then assign the same ACP and Platform Settings and push policy to it. Right? So, as long as FMC is backed up, then it is easy to restore any failed FTD under it.

Right?

[Marvin Rhoads]

@garrett.butler a complete device configuration is comprised of data drawn from several sources in FMC. The ACP with all child policies (Intrusion, SSL Network Discovery etc.) in one piece. The platform policy is another. As is the NAT policy.

The device backup will include all of the elements under the device configuration menus - interface address, names, zone assignment, port channel (if any), routing, VRFs etc. None of those are included in the previously mentioned policies.