Configure Remote Backup for FMC Using NFS Storage Device

Introduction

This document describes how to obtain a remote backup of Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Secure FMC configuration via GUI and SSH navigation
• Secure FTD navigation via shell
• Network File System (NFS) configuration

Components Used

The information in this document is based on these software and hardware versions:

• vFMC version 7.2.5
• FPR1140 running FTD 7.2.5
• NFS Windows Server

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The ability to recover from a disaster is an essential part of any system maintenance plan. As part of your disaster recovery plan, it is recommended that you perform periodic backups.

You can store backups locally. However, it is recommended that you back up management centers and managed devices to a secure remote location by mounting an NFS, Server Message Block (SMB), or Secure SHell FileSystem (SSHFS) network volume as remote storage. For the management center, you can use the Copy when complete option to securely copy (SCP) completed backups to a remote server.

This document refers to the NFS setup. After you accomplish this, all subsequent backups are copied to that volume, but you can still use the management center in order to manage them.

Warning: The management center setup process schedules weekly configuration-only backups, to be stored locally. This is not a substitute for full off-site backups initial setup finishes. You must review your scheduled tasks and adjust them to fit the requirements of your organization.

Tip: After configuring and choosing remote storage, you can switch back to local storage only if you have not increased the connection database limit.

Configure

Network Topology

Network Diagram

Add an NFS Remote Storage Device

Step 1. In order to implement NFS for remote storage, rpcbind must be started first as it is disabled by default.

Open an SSH session to your FMC, navigate to expert mode, elevate to sudo rights, and issue the command /etc/init.d/rpcbind start.

You can validate that it has started correctly with the command /etc/init.d/rpcbind status.

Start rpcbind

Tip: In order to avoid having to start the rpcbind utility in the FMC manually, check the Use Advanced Options checkbox, and fill the Command Line Option with the -o nolock  command.

Step 2. Log in to your FMC GUI and navigate to System () > Configuration.

System-Configuration

Step 3. Choose Remote Storage Device and then choose NFS in the drop-down menu for Storage Type.

NFS Remote Storage

Step 4. Insert your NFS device information.

Enter the IPv4 address or hostname of the storage system in the Host field and the path to your storage area in the Directory field.

Check the Use for Backups checkbox under System Usage and click Save.

NFS Settings

Step 5. A successful integration shows a green Success Saved Remote Storage Device configuration successfully  box at the top of the page.

Saved Remote Storage Device configuration successfully

Setup a Backup Profile

Step 1. Navigate to System () > Tools > Backup/Restore.

System-Tools-Backup

Step 2. Move to Backup Profiles and click Create Profile.

Create Backup Profile

Step 3. Give your profile a Name and check all the checkboxes for a full backup profile.

Click Save As New.

Profile Settings

Schedule a Recurring Task to Backup the FMC

Step 1. Navigate to System ()> Tools > Scheduling.

Scheduling

Step 2. Click Add a Task.

Add Task

Step 3. Set the schedule as needed and pick Recurring as the Schedule task in order to run, and Management Center as your Backup Type.

For demonstration purposes, this backup task starts on September 2023 and repeats once a month at 3:00 am every 29th of the month.

Choose the Backup Profile you created earlier and click Save.

New Task

Step 4. Once saved, you are placed back into your calendar and the new scheduled task is shown under the day you have chosen.

Calendar

Schedule a Recurring Task to Backup the FTD

Step 1. Navigate to System () > Tools > Scheduling.

Scheduling

Step 2. Click Add a Task.

Add Task

Step 3. Pick Recurring as the Scheduled task in order to run and set the schedule as needed.

For demonstration purposes, this backup task starts on September 2023 and repeats once a month at 4:00 am every 29th of the month.

Insert a Job Name.

New Task

Step 3.1. Choose Device as the Backup Type and click the device that must be backed up recurrently.

Check the Retrieve to Management Center checkbox and click Save.

Task Settings

Tip: You can choose more than one device by pressing the Shift key while clicking over the other device(s).

Step 4. Once saved, you are placed back into your calendar and the new scheduled task is shown under the day you have chosen.

Calendar

Troubleshooting

• Verify that the FMC can reach the Remote Storage device. Open an SSH session to the FMC, navigate to the expert mode, and elevate to sudo rights. Send a ping to the remote storage device.

Ping test

• The logs of the backup task are stored in the FMC filename/var/log/backup.log. If an error occurred and the task did not finish successfully, you can search here for an error or failure.

less command

backup.log

• This file can also be found in the FTD when it has run a backup task. Find it under/ngfw/var/log/backup.log.

Less command

backup.log

• FTD logs show the backup file is stored locally however, in the end, it is sent to the FMC and then to the remote storage device.

FTD logs