Caution

Do NOT push the FMC deployments over a VPN tunnel that is terminating directly on the Firepower Threat Defense. Pushing the FMC deployments can potentially inactivate the tunnel and disconnect the FMC and the Firepower Threat Defense. Recovering the device from this situation can be very disruptive and require executing the disaster recovery procedure. This procedure resets the Firepower Threat Defense configuration to factory defaults by changing manager from FMC to local and configuring the device from beginning. For more information, see Deploying the FMC Policy Configuration over VPN Tunnel.

After you configure your deployment, and any time you change that configuration, you must deploy the changes to affected devices. You can view deployment status in the Message Center.

Deploying updates the following components:

• Device and interface configurations

• Device-related policies: NAT, VPN, QoS, platform settings

• Access control and related policies: DNS, file, identity, intrusion, network analysis, prefilter, SSL

• Network discovery policy

• Intrusion rule updates

• Configurations and objects associated with any of these elements

You can configure the system to deploy automatically by scheduling a deploy task or by setting the system to deploy when importing intrusion rule updates. Automating policy deployment is especially useful if you allow intrusion rule updates to modify system-provided base policies for intrusion and network analysis. Intrusion rule updates can also modify default values for the advanced preprocessing and performance options in your access control policies.

In a multidomain deployment, you can deploy changes for any domain where your user account belongs:

• Switch to an ancestor domain to deploy changes to all subdomains at the same time.

• Switch to a leaf domain to deploy changes to only that domain.

To review policy changes for compliance with your organization's standards or to optimize system performance, you can examine the differences between two policies or between a saved policy and the running configuration.

You can compare the following policy types:

• DNS

• File

• Health

• Identity

• Intrusion (Only Snort 2 policies)

• Network Analysis

• SSL

The comparison view displays both policies in a side-by-side format. Differences between the two policies are highlighted:

• Blue indicates that the highlighted setting is different in the two policies, and the difference is noted in red text.

• Green indicates that the highlighted setting appears in one policy but not the other.

For most policies, you can generate two kinds of reports. A report on a single policy provides details on the policy's current saved configuration, while a comparison report lists only the differences between two policies. You can generate a single-policy report for all policy types except health.

Note	Intrusion policy reports combine the settings in the base policy with the settings of the policy layers, and make no distinction between which settings originated in the base policy or policy layer.

The Firepower System marks out-of-date policies with red status text that indicates how many of its targeted devices need a policy update. To clear this status, you must re-deploy the policy to the devices.

Configuration changes that require a policy re-deploy include:

• Modifying an access control policy: any changes to access control rules, the default action, policy targets, Security Intelligence filtering, advanced options including preprocessing, and so on.

• Modifying any of the policies that the access control policy invokes: the SSL policy, network analysis policies, intrusion policies, file policies, identity policies, or DNS policies.

• Changing any reusable object or configuration used in an access control policy or policies it invokes:

  • network, port, VLAN tag, URL, and geolocation objects

  • Security Intelligence lists and feeds

  • application filters or detectors

  • intrusion policy variable sets

  • file lists

  • decryption-related objects and security zones

• Updating the system software, intrusion rules, or the vulnerability database (VDB).

Keep in mind that you can change some of these configurations from multiple places in the web interface. For example, you can modify security zones using the object manager (Objects > Object Management), but modifying an interface type in a device’s configuration (Devices > Device Management) can also change a zone and require a policy re-deploy.

Note that the following updates do not require policy re-deploy:

• automatic updates to Security Intelligence feeds and additions to the Security Intelligence global Block or Do Not Block list using the context menu

• automatic updates to URL filtering data

• scheduled geolocation database (GeoDB) updates

Host, application, and user discovery data allow the system to create a complete, up-to-the-minute profile of your network. The system can also act as an intrusion detection and prevention system (IPS), analyzing network traffic for intrusions and exploits and, optionally, dropping offending packets.

Combining discovery and IPS gives context to your network activity and allows you to take advantage of many features, including:

• impact flags and indications of compromise, which can tell you which of your hosts are vulnerable to a particular exploit, attack, or piece of malware

• adaptive profile updates and Firepower recommendations, which allow you to examine traffic differently depending on the destination host

• correlation, which allows you to respond to intrusions (and other events) differently depending on the affected host

However, if your organization is interested in performing only IPS, or only discovery, there are a few configurations that can optimize the performance of the system.