On-Demand Backups

You can perform on-demand backups for the FMC and 7000/8000 series devices from the FMC.

You can also use the local web interface on a 7000/8000 series device to perform on-demand backups. Local backup management on 7000/8000 series devices is slightly different and has fewer options than backup management on the FMC, but in general works in the same way. Note that you can use the FMC to back up these devices remotely.

For more information, see Backing Up FMCs or Managed Devices.

Scheduled Backups

You can use the scheduler on an FMC or 7000/8000 series device to automate backups. You cannot schedule remote device backups from the FMC.

For more information, see Scheduled Backups.

Storing Backup Files

You can store backups locally. However, we recommend you back up FMCs and managed devices to a secure remote location by mounting an NFS, SMB, or SSHFS network volume as remote storage. After you do this, all subsequent backups are copied to that volume, but you can still use the FMC to manage them.

For more information, see Remote Storage Management and Manage Backups and Remote Storage.

Restoring the FMC and Managed Devices

You restore the FMC and 7000/8000 series devices from the local Backup Management page.

For more information, see Restoring FMCs and Managed Devices.

What Is Backed Up?

FMC backups can include:

• Configurations.

  All configurations you can set on the FMC web interface are included in a configuration backup, with the exception of remote storage and audit log server certificate settings. In a multidomain deployment, you must back up configurations. You cannot back up events or only.

• Events.

  Event backups include all events in the FMC database. However, FMC event backups do not include intrusion event review status. Restored intrusion events do not appear on Reviewed Events pages.

7000/8000 series device backups are always configuration-only.

What Is Restored?

Restoring configurations overwrites all backed-up configurations, with very few exceptions. On the FMC, restoring events overwrites all existing events, with the exception of intrusion events.

Make sure you understand and plan for the following:

• You cannot restore what is not backed up.

  FMC configuration backups do not include remote storage and audit log server certificate settings, so you must reconfigure these after restore. Also, because FMC event backups do not include intrusion event review status, restored intrusion events do not appear on Reviewed Events pages.

• Restoring to a configured FMC — instead of factory-fresh or reimaged — merges intrusion events and file lists.

  The FMC event restore process does not overwrite intrusion events. Instead, the intrusion events in the backup are added to the database. To avoid duplicates, delete existing intrusion events before you restore.

  The FMC configuration restore process does not overwrite clean and custom detection file lists used by AMP for Networks. Instead, it merges existing file lists with the file lists in the backup. To replace file lists, delete existing file lists before you restore.

Model Requirements: Backup

You can back up:

• FMCs

• 7000/8000 series devices

Backup is not supported for:

• Firepower Threat Defense

• NGIPSv

• ASA FirePOWER

If you need to replace a device where backup and restore is not supported, you must manually recreate device-specific configurations. However, backing up the FMC does back up policies and other configurations that you deploy to managed devices, as well as events already transmitted from the devices to the FMC.

Model Requirements: Restore

Version Requirements

As the first step in any backup, note the patch level. To restore a backup, the old and the new appliance must be running the same Firepower version, including patches.

For FMC backups, you must also have the same VDB. You are not required to have the same SRU.

License Requirements

Address licensing concerns as described in the best practices and procedures. If you notice licensing conflicts, contact Cisco TAC.

Domain Requirements

To:

• Back up or restore the FMC: Global only.

• Back up a device from the FMC: Global only.

• Restore a device: None. Restore devices locally.

In a multidomain deployment you cannot back up only events. You must also back up configurations.

Backup and Restore is for Disaster Recovery/RMA

Backup and restore is primarily intended for RMA scenarios. Before you begin the restore process of a faulty or failed physical appliance, contact Cisco TAC for replacement hardware.

Backup and Restore is not Configuration Import/Export

A backup file contains information that uniquely identifies an appliance, and cannot be shared. Do not use the backup and restore process to copy configurations between appliances or devices, or as a way to save configurations while testing new ones. Instead, use the import/export feature.

Restore is Individual and Local

You restore to FMCs and manageed devices individually and locally. This means:

• You cannot batch-restore to high availability (HA) FMCs or devices. The restore procedures in this guide explain how to restore in an HA environment.

• You cannot use the FMC to restore a device. For the FMC and 7000/8000 series devices, you can use the local web interface to restore.

• You cannot use an FMC user account to log into and restore one of its managed devices. FMCs and devices maintain their own user accounts.

When to Back Up

We recommend backing up during a maintenance window or other time of low use.

While the system collects backup data, there may be a temporary pause in data correlation (FMC only), and you may be prevented from changing configurations related to the backup. If you include event data, event-related features such as eStreamer are not available.

You should back up in the following situations:

• Regular scheduled backups.

  As part of your disaster recovery plan, we recommend that you perform periodic backups. To automate this process, see Scheduled Backups.

• Before upgrade or reimage.

  If an upgrade fails catastrophically, you may have to reimage and restore. Reimaging returns most settings to factory defaults, including the system password. If you have a recent backup, you can return to normal operations more quickly.

• After upgrade.

  Back up after you upgrade, so you have a snapshot of your freshly upgraded deployment. We recommend you back up the FMC after you upgrade its managed devices, so your new FMC backup file 'knows' that its devices have been upgraded.

Maintaining Backup File Security

Backups are stored as unencrypted archive (.tar) files.

Private keys in PKI objects—which represent the public key certificates and paired private keys required to support your deployment—are decrypted before they are backed up. The keys are reencrypted with a randomly generated key when you restore the backup.

Caution

We recommend you back up FMCs and devices to a secure remote location and verify transfer success. Backups left locally may be deleted, either manually or by the upgrade process, which purges locally stored backups. Especially because backup files are unencrypted, do not allow unauthorized access. If backup files are modified, the restore process will fail. Keep in mind that anyone with the Admin/Maint role can access the Backup Management page, where they can move and delete files from remote storage.

In the FMC's system configuration, you can mount an NFS, SMB, or SSHFS network volume as remote storage. After you do this, all subsequent backups are copied to that volume, but you can still use the FMC to manage them. For more information, see Remote Storage Management and Manage Backups and Remote Storage.

Note that only the FMC mounts the network volume. Managed device backup files are routed through the FMC. Make sure you have the bandwidth to perform a large data transfer between the FMC and its devices. For more information, see Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote).

Before Backup

Before you back up, you should:

• Update the VDB and SRU on the FMC.

  We always recommend you use the latest vulnerability database (VDB) and intrusion rules (SRU). Before you back up an FMC, check the Cisco Support & Download site for newer versions.

  This is especially important for the VDB, because the VDB versions must match to restore a backup. Because you cannot downgrade the VDB, you do not want a situation where your replacement FMC has a newer VDB than the backed up FMC.

• Check Disk Space.

  Before you begin a backup, make sure you have enough disk space on the appliance or on your remote storage server. The space available is displayed on the Backup Management page.

  Backups can fail if there is not enough space. Especially if you schedule backups, make sure you regularly prune backup files or allocate more disk space to the remote storage location.

Before Restore

Before restore, you should:

• Revert licensing changes.

  Revert any licensing changes made since you took the backup.

  Otherwise, you may have license conflicts after the restore.

  After the restore completes, reconfigure licensing. If you notice licensing conflicts, contact Cisco TAC.

• Disconnect faulty appliances.

  Disconnect the management interface, and for devices, the data interfaces.

  Note that restoring an FMC or 7000/8000 series device does not change the management IP address. You must set that manually on the replacement — just make sure you disconnect the old appliance from the network before you do.

• Do not unregister managed devices.

  Whether you are restoring an FMC or managed device, do not unregister devices from the FMC, even if you physically disconnect an appliance from the network.

  If you unregister, you will need to redo some device configurations, such as security zone to interface mappings. After you restore, the FMC and devices should begin communicating normally.

• Reimage.

  In an RMA scenario, the replacement appliance will arrive configured with factory defaults. However, if the replacement appliance is already configured, we recommend you reimage. Reimaging returns most settings to factory defaults, including the system password. You can only reimage to major versions, so you may need to patch after you reimage.

  If you do not reimage, keep in mind that FMC intrusion events and file lists are merged rather than overwritten.

After Restore

After restore, you should:

• Reconfigure anything that was not restored.

  This can include reconfiguring licensing, remote storage, and audit log server certificate settings.

• Update the VDB and SRU on the FMC.

  We always recommend you use the latest vulnerability database (VDB) and intrusion rules (SRU).

• Deploy.

  After you restore an FMC, deploy to all managed devices. After you restore a device, deploy to that device. You must deploy. If the a device or devices are not marked out of date, force deploy from the Device Management page: Redeploy Existing Configurations to a Device.