Guidelines for Downloading Data from the Firepower Management Center to Managed Devices

Introduction

Maintaining a Firepower deployment requires that you periodically download data from the Firepower Management Center to the devices it manages. This document provides information you can use to successfully transfer updates from the Firepower Management Center to managed devices.

General Download Guidelines

To support day-to-day operation of your Firepower system, Cisco recommends maintaining a dedicated network bandwidth of at least 256 kbps between the external interface and each managed device. Be sure the bandwidth allotted between the Firepower Management Center and the switch it uses to communicate with its managed devices is sufficient to support at least 256 kbps for each device. Additional bandwidth may be required when downloading software updates from the Firepower Management Center to a managed device, or when simultaneously downloading multiple policy or data updates to a managed device.

Caution: Downloading updates to managed devices may affect traffic inspection, traffic flow, and link state. In the case of software updates, the Data Correlator is disabled while an update is in progress. Therefore Cisco recommends you download updates in a maintenance window or at a time when the load on the managed device being updated is minimal and an interruption will have the least impact on your deployment.

The time required to perform any type of data download from the Firepower Management Center to a managed device depends on the size of the data package and the dedicated network bandwidth between the two appliances. Data downloads to managed devices will fail if they cannot complete within the designated timeout periods Firepower enforces on download activities.

Note: The bandwidth requirements cited in this document presume lossless links between appliances; if your network experiences high latency or high rates of packet loss, additional bandwidth will be required to complete downloads within the timeouts Firepower requires.

If after adjusting your network environment using the information in this document you cannot download an update package to a managed device within the timeout period, contact Cisco TAC.

Downloading Software Updates

Software update package sizes vary widely; see the Firepower System Release Notes for your version for the full update process as well as the data package size. Firepower applies a timeout of 1 hour to software downloads. The following table provides formulae to approximate the amount of time a software download will take depending on the package size and the available dedicated bandwidth between devices.

Caution: Because the update process may affect traffic inspection, traffic flow, and link state, and because the Data Correlator is disabled while an update is in progress, Cisco recommends you perform the software update in a maintenance window or at a time when the interruption will have the least impact on your deployment.

Downloading Vulnerability Database Updates

Vulnerability database updates range in size from 30 to 70 MB. Downloading a VDB update from the Firepower Management Center to a managed device fails if it does not complete within 1 hour. Given dedicated network bandwidth, doubling the bandwidth available for the download approximately halves the amount of time required to complete the download. For example, the table below presents the bandwidths and times-to-download for a VDB package of 65 MB:

VDB update downloads occur asynchronously.

Caution: Installing a VDB update restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on the model of the managed device and how it handles traffic. See the Firepower Management Center Configuration Guide for more information.

Downloading Access Control Policy and Intrusion Rule Updates

The size of an access control policy and intrusion rule update varies depending on a number of factors, including the number of rules in the update, the conditions within the rules, the number of reusable objects the rules reference, and the number of intrusion policy-variable set combinations the rules reference. While no fixed formula can predict package size for access control policy and intrusion rule updates, the following table provides examples you can use to estimate your own package size. For each sample package, the table provides the minimum dedicated network bandwidth required between the two appliances to complete the download within the 5 minute timeout the system enforces.

The table depicts only a few example policy update scenarios. Policy update packages that include additional policies such as file or system policies will be larger and require additional bandwidth to download within the timeout the Firepower system enforces.

Caution: Deploying access control and intrusion rule updates may increase resource demands and result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on the model of the managed device and how it handles traffic. See the Firepower Management Center Configuration Guide for more information.

Downloading URL Lists

Due to memory limitations, some device models perform most URL filtering with a smaller, less granular, set of categories and reputations. Consequently URL list downloads vary in size depending on the device model; approximate sizes are shown in the following table:

Lower-memory devices include the 7100 Family and the following ASA models: ASA5506-X, ASA5506H-X, ASA5506W-X, ASA5508-X, ASA5512-X, ASA5515-X, ASA5516-X, and ASA5525-X. (For NGIPSv, see the Firepower System Virtual Installation Guide for information on allocating the correct amount of memory to perform category and reputation-based URL filtering.)

Downloading a URL list or URL list update ranging in size from 1 to 100 MB fails if it does not complete within 10 minutes (600 seconds). Downloading a URL list or URL list update ranging in size from 100 MB to 4 GB fails if it does not complete within 1 hour (3600 seconds).

Given dedicated network bandwidth, doubling the bandwidth available for the download approximately halves the amount of time required to complete the download, as shown in the examples below: 

Downloads of URL list updates occur asynchronously.