Firepower Backup and Restore

-

 Backup FMC and FTD to remote SMB Server


Lab on FMC 7.2.x

1. Create remote storage




One SMB server:
     file "appliance_rsd_info.txt" contains folder info.
    The folder name is FMC UUID, can be seen in FMC "show version".



Folder "backups" is for FMC, folder "remote-backups" is for FTD device








2. Create Backup Profile, specify backup Configuration and/or Events.
     System > Backup/Restore > Backup Profiles >Create Profile
       
        Backup profile is used by FMC only 



3. Backup FMC or FTD
System > Backup/Restore > Backup Management

Choose backup FMC or device (FTD)



4. Schedule a backup for FMC or FTD
System > Scheduling > Add Task

FTD:
Check "Retrieve to Management Center" will list backup in FMC and backup to remote storage. If it is not checked, backup is only on FTD local /var/sf/backup





==================

Lab


Scenario 1: Standalone FTD has device backup.

FTD-72-C is a standalone FTD, have backup on FMC and remote storage place. Assume FTD-72-C is failed, a new device FTD is ready to replace it.
Note: don't delete FTD-72-C from FMC

1. on new FTD expert mode create an user account called scpuser
   useadd scpuser
   passwd scpuser

2. Use Winscp to copy backup file "FTD-72-C_20240726161647.tar" to /var/tmp

3. In FTD expert mode, move backup to backup folder
    mv /var/tmp/FTD-72-C_20240726161647.tar /var/sf/backup

4. Exit to firepower mode to restore backup file
    > restore remote-manager-backup FTD-72-C_20240726161647.tar

5. After restore completes, FTD will be reboot automatically.

6. Re-deploy policy

    New FTD has all configuration from failed FTD, includes management IP, so after a few minutes,  FTD-72-C will show alive in FMC.
    however, at this stage, LAN PC is not able to access Internet, packet-tracker shows Drop at Snort. "show snort instance" doesn't show any snort instance is running.
    FMC shows policy need be deployed to new FTD, when deploy,  receives warning about Virtual Router change, ignore the warning, deployment is successful, LAN PC then can access Internet.
 

Conclusion:
    Device backup is important, with it, we don't need delete then re-register FTD


Scenario 2: Standalone FTD doesn't have device backup, restore using device configuration.

FDT-72-C failed, don't delete it from FMC before export Device Configuration.

1. Export Device Configuration

 

2. Delete FTD-72-C from FMC

3. Configure new new FTD with same MGMT IP, register it to FMC, with an initial Discovery ACP.  

4. Import Device Configuration. Apply proper ACP  and NAT policy, then deploy....


Conclusion:
    If no Device backup, Export Device Configuration from FMC before delete it.


Scenario 3 One FTD is failed in HA deployment. FTD has device backup

FTD-72-A and FTD-72-B are in HA, FTD-72-B is failed.
Don't break or delete HA

1. Configure RMA FTD with same management IP, in expert mode create an user account called scpuser
   useadd scpuser
   passwd scpuser

2. Use Winscp copy backup file "FTD-72-B_Secondary_20240725092245.tar" to RMA FTD /var/tmp

3. In RMA FTD expert mode 
    mv /var/tmp/FTD-72-B_Secondary_20240725092245.tar /var/sf/backup

4. In Firepower mode 
    restore remote-manager-backup FTD-72-B_Secondary_20240725092245.tar

> restore remote-manager-backup FTD-72-B_Secondary_20240725092245.tar

Device model from backup :: Cisco Firepower Threat Defense for VMware
This Device Model  :: Cisco Firepower Threat Defense for VMware

***********************************************
             Backup Details
***********************************************
Model = Cisco Firepower Threat Defense for VMware
Software Version = 7.2.8
Serial = 9AW96A5V42E
Hostname = FTD-72-B
Device Name = FTD-72-B_Secondary
IP Address = 192.168.2.94
Role = SECONDARY
VDB Version = 353
SRU Version =
Manager IP(s) = 192.168.2.65
Backup Date = 2024-07-25 09:22:45
Backup Filename = FTD-72-B_Secondary_20240725092245.tar
***********************************************



********************* Caution ****************************
Verify that you are restoring a valid backup file.
Make sure that FTD is installed with same software version and matches versions from backup manifest before proceeding.(Running 'show version' command on FTD, displays Model Name and version details).
Restore operation will overwrite all configurations on this device with configurations in backup.
If this restoration is being performed on an RMA device then ensure old device is removed from network or powered off completely prior to proceeding with backup restore.
 **********************************************************


Are you sure you want to continue (Y/N)y
Restoring device . . . . . . . . . . . . . . . . . . . . . . . . . . . .Use of uninitialized value in string eq at /usr/local/sf/lib/perl/5.24.4/SF/BackupRestore.pm line 1401.
 . . . . . . . . . .


5. Deploy policy then resume HA

>configure high-availability resume



Scenario 4. Restore device backup from HA member to standalone FTD fails


HA is created on FMC with FTD-72-A and FTD-72-B
weekly device backup to remote storage is scheduled. Download backup file from FMC to local drive


Break HA, FTD-72-B is failed, deleted FTD-72-B from FMC.
Restore FTD-72-B backup to a new FTD FTD-72-B-New
  from FTD FTD-72-B-New cli, see all configurations includes HA configuration.
  show snort instance indicate no snort is running (because original FTD-72-B same??)
  has managers configured it, register it back to FMC failed
  delete managers
  Registered FTD-72-B-New to FMC successfully, see FTD IPs in FMC, but no security zone, no static route in FMC, has static route in FTD cli
  deploy policy failed with error "Timeout waiting for snort detection engines to process traffic: 6c5ed7ba-47b5-11ef-a706-f2c00f2684d5"
  internal PC is unable to access internet, packet-tracer shows drop at:

Phase: 15
Type: SNORT
Subtype:
Result: DROP
Elapsed time: 9216 ns
Config:
Additional Information:
Snort Verdict: (snort-down) snort instance is down




 ==================


Replace Faulty Unit in Secure Firewall Threat Defense of High Availability

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221097-replace-faulty-unit-in-secure-firewall-t.html#toc-hId--1760804637

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more