Before you begin restoring your appliances to factory defaults, you should familiarize yourself with the expected
behavior of the system during the restore process.

Configuration and Event Backup Guidelines

Before you begin the restore process, Cisco recommends that you delete or move any backup files that reside on
your appliance, then back up current event and configuration data to an external location.

Restoring your appliance to factory defaults results in the loss of almost all configuration and event data on the
appliance. Although the restore utility can retain the appliance’s license, network, console, and Lights-Out
Management (LOM) settings, you must perform all other setup tasks after the restore process completes.

Traffic Flow During the Restore Process

To avoid disruptions in traffic flow on your network, Cisco recommends restoring your appliances during a
maintenance window or at a time when the interruption will have the least impact on your deployment.

Restoring a Firepower device that is deployed inline resets the device to a non-bypass (fail closed) configuration,
disrupting traffic on your network. Traffic is blocked until you configure bypass-enabled inline sets on the device.
For more information about editing your device configuration to configure bypass, see the Managing Devices
chapter of the Firepower Management Center Configuration Guide.

Understanding the Restore Process

To restore a Firepower device, you boot from the appliance’s internal flash drive and use an interactive menu to
download and install the ISO image on the appliance. For your convenience, you can install system software and
intrusion rule updates as part of the restore process.