You can use the scheduler to automate backup of your Firepower Management Center or physical managed devices.

To perform a scheduled backup of configuration data on a physical managed device, use the web interface of the device itself.

To perform a scheduled backup of configuration and events data or configuration data only on a Firepower Management Center, use the Firepower Management Center web interface. The backup profile you select while scheduling the task determines the type of data backed up.

You cannot schedule a backup for a managed device from its managing Firepower Management Center, but you can perform on-demand backups of some models of managed devices from a Firepower Management Center.

You must perform this procedure using the local web interface for the Firepower Management Center or the 7000 or 8000 Series device. In a multidomain deployment, this task is only supported in the Global domain for the Firepower Management Center.

The system automatically creates the Download CRL task when you enable downloading a certificate revocation list (CRL) in the local configuration on an appliance where you enable user certificates or audit log certificates for the appliance. You can use the scheduler to edit the task to set the frequency of the update.

After modifying configuration settings in the Management Center, you must deploy those changes to the affected devices.

In a multidomain deployment, you can schedule policy deployments only for your current domain.

Caution

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the target device handles traffic. See Snort® Restart Traffic Behavior and Configurations that Restart the Snort Process When Deployed or Activated.

You can automate reports so that they run at regular intervals.

In a multidomain deployment, you can schedule reports only for your current domain.

You can automatically generate rule state recommendations based on network discovery data for your network using the most recently saved configuration settings in a custom intrusion policy.

Note	If the system automatically generates scheduled recommendations for an intrusion policy with unsaved changes, you must discard your changes in that policy and commit the policy if you want the policy to reflect the automatically generated recommendations.

When the task runs, the system automatically generates recommended rule states, and modifies the states of intrusion rules based on the configuration of your policy. Modified rule states take effect the next time you deploy your intrusion policy.

In a multidomain deployment, you can automate recommendations for intrusion policies at the current domain level. The system builds a separate network map for each leaf domain. In a multidomain deployment, if you enable this feature in an intrusion policy in an ancestor domain, the system generates recommendations using data from all descendant leaf domains. This can enable intrusion rules tailored to assets that may not exist in all leaf domains, which can affect performance.

You can automatically download and apply most patches and feature releases to the Firepower System.

The tasks you must schedule to install software updates vary depending on whether you are updating the Management Center or are using a Management Center to update managed devices.

Note	Cisco strongly recommends that you use your Management Centers to update the devices they manage.

• To update the Management Center, schedule the software installation using the Install Latest Update task.

• To use a Management Center to automate software updates for its managed devices, you must schedule two tasks:

  • Push (copy) the update to managed devices using the Push Latest Update task.

  • Install the update on managed devices using the Install Latest Update task.

  When scheduling updates to managed devices, schedule the push and install tasks to happen in succession; you must first push the update to the device before you can install it. Allow enough time between tasks for the process to complete; schedule tasks at least 30 minutes apart. If you schedule a task to install an update and the update has not finished copying from the Management Center to the device, the installation task will not succeed. However, if the scheduled installation task repeats daily, it will install the pushed update when it runs the next day.

Note

You must manually upload and install updates in two situations. First, you cannot schedule major updates to the Firepower System. Second, you cannot schedule updates for or pushes from Management Center that cannot access the Support Site. If your Management Center is not directly connected to the Internet, you should use management interfaces configuration to set up a proxy to allow it to download updates from the Support Site.

Note that a task scheduled to install an update on a device group will install the pushed update to each device within the device group simultaneously. Allow enough time for the scheduled task to complete for each device within the device group.

If you want to have more control over this process, you can use the Once option to download and install updates during off-peak hours after you learn that an update has been released.

You can use the scheduler to automate updates of URL filtering data from Cisco Collective Security Intelligence (CSI).

Note that when you enable URL filtering, you can also enable automatic updates. This forces the Management Center to contact CSI every 30 minutes for URL filtering data updates.

Note	If you enabled automatic updates when you enabled URL filtering, do not create a scheduled task to update URL filtering data. Schedule a task only if you want strict control over URL filtering updates.

Although daily updates tend to be small, if it has been more than five days since your last update, new URL filtering data may take up to 20 minutes to download, depending on your bandwidth. Then, it may take up to 30 minutes to perform the update itself.

In a multidomain deployment, you can view scheduled tasks only for your current domain.

In a multidomain deployment, you can edit scheduled tasks only for your current domain.

In a multidomain deployment, you can delete scheduled tasks only for your current domain.