Cisco Firepower 4100/9300 Chassis Platform Settings User Manual

Platform Settings
• Setting the Date and Time, page 1
• Configuring SSH, page 4
• Configuring Telnet, page 5
• Configuring SNMP, page 6
• Configuring HTTPS, page 12
• Configuring AAA, page 22
• Configuring Syslog, page 31
• Configuring DNS Servers, page 34
Setting the Date and Time
Use the NTP page to configure the network time protocol (NTP) on the system, to set the date and time
manually, or to view the current system time.
NTP settings are automatically synced between the Firepower 4100/9300 chassis and any logical devices
installed on the chassis.
Note
If you are deploying Firepower Threat Defense on the Firepower 4100/9300 chassis, you must configure
NTP on the Firepower 4100/9300 chassis so that Smart Licensing will work properly and to ensure proper
timestamps on device registrations. You should use the same NTP server for the Firepower 4100/9300
chassis and the Firepower Management Center.
If you are using NTP, you can view the overall synchronization status on the Current Time tab, or you can
view the synchronization status for each configured NTP server by looking at the Server Status field in the
NTP Server table on the Time Synchronization tab. If the system is unable to synchronize with a particular
NTP server, you can hover over the information icon next to the Server Status for more information.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
1
Platform Settings
Viewing the Configured Date and Time
Viewing the Configured Date and Time
Procedure
Step 1
Step 2
Choose Platform Settings > NTP.
Click the Current Time tab.
The system shows the date, time, and time zone that are configured on the device.
If you are using NTP, you can also view the overall synchronization status on the Current Time tab. You
can view the synchronization status for each configured NTP server by looking at the Server Status field in
the NTP Server table on the Time Synchronization tab. If the system is unable to synchronize with a particular
NTP server, you can hover over the information icon next to the Server Status for more information.
Setting the Time Zone
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > NTP.
Click the Current Time tab.
Choose the appropriate time zone for the Firepower chassis from the Time Zone drop-down list.
Setting the Date and Time Using NTP
NTP is used to implement a hierarchical system of servers that provide a precisely synchronized time among
network systems. This kind of accuracy is required for time-sensitive operations, such as validating CRLs,
which include a precise time stamp. You can configure up to four NTP servers.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Choose Platform Settings > NTP.
Click the Time Synchronization tab.
Under Set Time Source, click Use NTP Server.
For each NTP server you want to use, up to a maximum of four, enter the IP address or hostname of the NTP
server in the NTP Server field and click Add.
Click Save.
The Firepower chassis is configured with the NTP server information specified.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
2
Platform Settings
Deleting an NTP Server
You can view the synchronization status of each server by looking at the Server Status field in the NTP Server
table. If the system is unable to synchronize with a particular NTP server, you can hover over the information
icon next to the Server Status for more information.
Note
If you modify the system time by more than 10 minutes, the system will log you out and you will
need to log in to the Firepower Chassis Manager again.
Deleting an NTP Server
Procedure
Step 1
Choose Platform Settings > NTP.
Step 2
Step 3
Step 4
Click the Time Synchronization tab.
For each NTP server that you want to remove, click the Delete icon for that server in the NTP Server table.
Click Save.
Setting the Date and Time Manually
This section describes how to set the date and time manually on the Firepower chassis.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Choose Platform Settings > NTP.
Click the Time Synchronization tab.
Under Set Time Source, click Set Time Manually.
Click the Date drop-down list to display a calendar and then set the date using the controls available in the
calendar.
Use the corresponding drop-down lists to specify the time as hours, minutes, and AM/PM.
Tip
You can click Get System Time to set the date and time to match what is configured on the system
you are using to connect to the Firepower Chassis Manager.
Click Save.
The Firepower chassis is configured with the date and time specified.
Note
If you modify the system time by more than 10 minutes, the system will log you out and you will
need to log in to the Firepower Chassis Manager again.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
3
Platform Settings
Configuring SSH
Configuring SSH
The following procedure describes how to enable or disable SSH access to the Firepower chassis, and to
enable the FXOS chassis as an SSH client. SSH is enabled by default.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Choose Platform Settings > SSH > SSH Server.
To enable SSH access to the Firepower chassis, check the Enable SSH check box. To disable SSH access,
uncheck the Enable SSH check box.
For the server Encryption Algorithm, check the check boxes for each allowed encryption algorithm.
Note
3des-cbc is not supported in Common Criteria. If Common Criteria mode is enabled on the FXOS
chassis, you cannot use 3des-cbc as an encryption algorithm.
For the server Key Exchange Algorithm, check the check boxes for each allowed Diffie-Hellman (DH) key
exchange. The DH key exchange provides a shared secret that cannot be determined by either party alone.
The key exchange is combined with a signature and the host key to provide host authentication. This
key-exchange method provides explicit server authentication. For more information about using DH
key-exchange methods, see RFC 4253.
For the server Mac Algorithm, check the check boxes for each allowed integrity algorithm.
For the server Host Key, enter the modulus size for the RSA key pairs.
The modulus value (in bits) is in multiples of 8 from 1024 to 2048. The larger the key modulus size you
specify, the longer it takes to generate an RSA key pair. We recommend a value of 2048.
Step 7
For the server Volume Rekey Limit, set the amount of traffic in KB allowed over the connection before
FXOS disconnects from the session.
Step 8 For the server Time Rekey Limit, set the minutes for how long an SSH session can be idle before FXOS
disconnects the session.
Step 9 Click Save.
Step 10 Click the SSH Client tab to customize the FXOS chassis SSH client.
Step 11 For the Strict Host Keycheck, choose enable, disable, or prompt to control SSH host key checking.
• enable-The connection is rejected if the host key is not already in the FXOS known hosts file. You must
manually add hosts at the FXOS CLI using the enter ssh-host command in the system/services scope.
• prompt-You are prompted to accept or reject the host key if it is not already stored on the chassis.
• disable-(The default) The chassis accepts the host key automatically if it was not stored before.
Step 12 For the client Encryption Algorithm, check the check boxes for each allowed encryption algorithm.
Note
3des-cbc is not supported in Common Criteria. If Common Criteria mode is enabled on the FXOS
chassis, you cannot use 3des-cbc as an encryption algorithm.
Step 13 For the client Key Exchange Algorithm, check the check boxes for each allowed Diffie-Hellman (DH) key
exchange. The DH key exchange provides a shared secret that cannot be determined by either party alone.
The key exchange is combined with a signature and the host key to provide host authentication. This
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
4
Platform Settings
Configuring Telnet
Step 14
Step 15
Step 16
Step 17
key-exchange method provides explicit server authentication. For more information about using DH
key-exchange methods, see RFC 4253.
For the client Mac Algorithm, check the check boxes for each allowed integrity algorithm.
For the client Volume Rekey Limit, set the amount of traffic in KB allowed over the connection before FXOS
disconnects from the session.
For the client Time Rekey Limit, set the minutes for how long an SSH session can be idle before FXOS
disconnects the session.
Click Save.
Configuring Telnet
The following procedure describes how to enable or disable Telnet access to the Firepower chassis. Telnet is
disabled by default.
Note
Telnet configuration is currently only available using the CLI.
Procedure
Step 1
Enter system mode:
Firepower-chassis # scope system
Step 2
Enter system services mode:
Firepower-chassis /system # scope services
Step 3
To configure Telnet access to the Firepower chassis, do one of the following:
• To allow Telnet access to the Firepower chassis, enter the following command:
Firepower-chassis /system/services # enable telnet-server
• To disallow Telnet access to the Firepower chassis, enter the following command:
Firepower-chassis /system/services # disable telnet-server
Step 4
Commit the transaction to the system configuration:
Firepower /system/services # commit-buffer
The following example enables Telnet and commits the transaction:
Firepower-chassis# scope system
Firepower-chassis /system # scope services
Firepower-chassis /services # enable telnet-server
Firepower-chassis /services* # commit-buffer
Firepower-chassis /services #
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
5
Platform Settings
Configuring SNMP
Configuring SNMP
Use the SNMP page to configure the Simple Network Management Protocol (SNMP) on the Firepower chassis.
See the following topics for more information:
About SNMP
The Simple Network Management Protocol (SNMP) is an application-layer protocol that provides a message
format for communication between SNMP managers and agents. SNMP provides a standardized framework
and a common language used for the monitoring and management of devices in a network.
The SNMP framework consists of three parts:
• An SNMP manager—The system used to control and monitor the activities of network devices using
SNMP.
• An SNMP agent—The software component within the Firepower chassis that maintains the data for the
Firepower chassis and reports the data, as needed, to the SNMP manager. The Firepower chassis includes
the agent and a collection of MIBs. To enable the SNMP agent and create the relationship between the
manager and agent, enable and configure SNMP in the Firepower Chassis Manager or the FXOS CLI.
• A managed information base (MIB)—The collection of managed objects on the SNMP agent.
The Firepower chassis supports SNMPv1, SNMPv2c and SNMPv3. Both SNMPv1 and SNMPv2c use a
community-based form of security. SNMP is defined in the following:
• RFC 3410 (http://tools.ietf.org/html/rfc3410)
• RFC 3411 (http://tools.ietf.org/html/rfc3411)
• RFC 3412 (http://tools.ietf.org/html/rfc3412)
• RFC 3413 (http://tools.ietf.org/html/rfc3413)
• RFC 3414 (http://tools.ietf.org/html/rfc3414)
• RFC 3415 (http://tools.ietf.org/html/rfc3415)
• RFC 3416 (http://tools.ietf.org/html/rfc3416)
• RFC 3417 (http://tools.ietf.org/html/rfc3417)
• RFC 3418 (http://tools.ietf.org/html/rfc3418)
• RFC 3584 (http://tools.ietf.org/html/rfc3584)
SNMP Notifications
A key feature of SNMP is the ability to generate notifications from an SNMP agent. These notifications do
not require that requests be sent from the SNMP manager. Notifications can indicate improper user
authentication, restarts, the closing of a connection, loss of connection to a neighbor router, or other significant
events.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
6
Platform Settings
SNMP Security Levels and Privileges
The Firepower chassis generates SNMP notifications as either traps or informs. Traps are less reliable than
informs because the SNMP manager does not send any acknowledgment when it receives a trap, and the
Firepower chassis cannot determine if the trap was received. An SNMP manager that receives an inform
request acknowledges the message with an SNMP response protocol data unit (PDU). If the Firepower chassis
does not receive the PDU, it can send the inform request again.
SNMP Security Levels and Privileges
SNMPv1, SNMPv2c, and SNMPv3 each represent a different security model. The security model combines
with the selected security level to determine the security mechanism applied when the SNMP message is
processed.
The security level determines the privileges required to view the message associated with an SNMP trap. The
privilege level determines whether the message needs to be protected from disclosure or authenticated. The
supported security level depends upon which security model is implemented. SNMP security levels support
one or more of the following privileges:
• noAuthNoPriv—No authentication or encryption
• authNoPriv—Authentication but no encryption
• authPriv—Authentication and encryption
SNMPv3 provides for both security models and security levels. A security model is an authentication strategy
that is set up for a user and the role in which the user resides. A security level is the permitted level of security
within a security model. A combination of a security model and a security level determines which security
mechanism is employed when handling an SNMP packet.
Supported Combinations of SNMP Security Models and Levels
The following table identifies what the combinations of security models and levels mean.
Table 1: SNMP Security Models and Levels
Model
Level
Authentication
Encryption
What Happens
v1
noAuthNoPriv
Community string
No
Uses a community
string match for
authentication.
v2c
noAuthNoPriv
Community string
No
Uses a community
string match for
authentication.
v3
noAuthNoPriv
Username
No
Uses a username
match for
authentication.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
7
Platform Settings
SNMPv3 Security Features
Model
Level
Authentication
Encryption
What Happens
v3
authNoPriv
HMAC-SHA
No
Provides
authentication based
on the HMAC
Secure Hash
Algorithm (SHA).
v3
authPriv
HMAC-SHA
DES
Provides
authentication based
on the HMAC-SHA
algorithm. Provides
Data Encryption
Standard (DES)
56-bit encryption in
addition to
authentication based
on the Cipher Block
Chaining (CBC)
DES (DES-56)
standard.
SNMPv3 Security Features
SNMPv3 provides secure access to devices by a combination of authenticating and encrypting frames over
the network. SNMPv3 authorizes management operations only by configured users and encrypts SNMP
messages. The SNMPv3 User-Based Security Model (USM) refers to SNMP message-level security and offers
the following services:
• Message integrity—Ensures that messages have not been altered or destroyed in an unauthorized manner
and that data sequences have not been altered to an extent greater than can occur non-maliciously.
• Message origin authentication—Ensures that the claimed identity of the user on whose behalf received
data was originated is confirmed.
• Message confidentiality and encryption—Ensures that information is not made available or disclosed
to unauthorized individuals, entities, or processes.
SNMP Support
The Firepower chassis provides the following support for SNMP:
Support for MIBs
The Firepower chassis supports read-only access to MIBs.
Authentication Protocol for SNMPv3 Users
The Firepower chassis supports the HMAC-SHA-96 (SHA) authentication protocol for SNMPv3 users.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
8
Platform Settings
Enabling SNMP and Configuring SNMP Properties
AES Privacy Protocol for SNMPv3 Users
The Firepower chassis uses Advanced Encryption Standard (AES) as one of the privacy protocols for SNMPv3
message encryption and conforms with RFC 3826.
The privacy password, or priv option, offers a choice of DES or 128-bit AES encryption for SNMP security
encryption. If you enable AES-128 configuration and include a privacy password for an SNMPv3 user, the
Firepower chassis uses the privacy password to generate a 128-bit AES key. The AES privacy password can
have a minimum of eight characters. If the passphrases are specified in clear text, you can specify a maximum
of 64 characters.
Enabling SNMP and Configuring SNMP Properties
Procedure
Step 1
Step 2
Choose Platform Settings > SNMP.
In the SNMP area, complete the following fields:
Name
Description
Admin State check box
Whether SNMP is enabled or disabled. Enable this service only if your
system includes integration with an SNMP server.
Port field
The port on which the Firepower chassis communicates with the SNMP
host. You cannot change the default port.
Community/Username field
The default SNMP v1 or v2 community name or SNMP v3 username
the Firepower chassis includes on any trap messages it sends to the
SNMP host.
Enter an alphanumeric string between 1 and 32 characters. Do not use
@ (at sign), \ (backslash), " (double quote), ? (question mark) or an
empty space. The default is public.
Note that if the Community/Username field is already set, the text to
the right of the empty field reads Set: Yes. If the Community/Username
field is not yet populated with a value, the text to the right of the empty
field reads Set: No.
System Administrator Name field The contact person responsible for the SNMP implementation.
Enter a string of up to 255 characters, such as an email address or a
name and telephone number.
Location field
The location of the host on which the SNMP agent (server) runs.
Enter an alphanumeric string up to 510 characters.
Step 3
Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
9
Platform Settings
Creating an SNMP Trap
What to Do Next
Create SNMP traps and users.
Creating an SNMP Trap
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > SNMP.
In the SNMP Traps area, click Add.
In the Add SNMP Trap dialog box, complete the following fields:
Name
Description
Host Name field
The hostname or IP address of the SNMP host to which the Firepower
chassis should send the trap.
Community/Username field
The SNMP v1 or v2 community name or the SNMP v3 username the
Firepower chassis includes when it sends the trap to the SNMP host.
This must be the same as the community or username that is configured
for the SNMP service.
Enter an alphanumeric string between 1 and 32 characters. Do not use
@ (at sign), \ (backslash), " (double quote), ? (question mark) or an
empty space.
Port field
The port on which the Firepower chassis communicates with the SNMP
host for the trap.
Enter an integer between 1 and 65535.
Version field
The SNMP version and model used for the trap. This can be one of the
following:
• V1
• V2
• V3
Type field
If you select V2 or V3 for the version, the type of trap to send. This can
be one of the following:
• Traps
• Informs
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
10
Platform Settings
Deleting an SNMP Trap
Name
Description
v3 Privilege field
If you select V3 for the version, the privilege associated with the trap.
This can be one of the following:
• Auth—Authentication but no encryption
• Noauth—No authentication or encryption
• Priv—Authentication and encryption
Step 4
Click OK to close the Add SNMP Trap dialog box.
Step 5
Click Save.
Deleting an SNMP Trap
Procedure
Step 1
Step 2
Choose Platform Settings > SNMP.
In the SNMP Traps area, click the Delete icon in the row in the table that corresponds to the trap you want
to delete.
Creating an SNMPv3 User
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > SNMP.
In the SNMP Users area, click Add.
In the Add SNMP User dialog box, complete the following fields:
Name
Description
Name field
The username assigned to the SNMP user.
Enter up to 32 letters or numbers. The name must begin with a letter
and you can also specify _ (underscore), . (period), @ (at sign), and (hyphen).
Auth Type field
The authorization type: SHA.
Use AES-128 check box
If checked, this user uses AES-128 encryption.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
11
Platform Settings
Deleting an SNMPv3 User
Name
Description
Password field
The password for this user.
Confirm Password field
The password again for confirmation purposes.
Privacy Password field
The privacy password for this user.
Confirm Privacy Password field The privacy password again for confirmation purposes.
Step 4
Click OK to close the Add SNMP User dialog box.
Step 5
Click Save.
Deleting an SNMPv3 User
Procedure
Step 1
Step 2
Choose Platform Settings > SNMP.
In the SNMP Users area, click the Delete icon in the row in the table that corresponds to the user you want
to delete.
Configuring HTTPS
This section describes how to configure HTTPS on the Firepower 4100/9300 chassis.
Note
You can change the HTTPS port using Firepower Chassis Manager or the FXOS CLI. All other HTTPS
configuration can only be done using the FXOS CLI.
Certificates, Key Rings, and Trusted Points
HTTPS uses components of the Public Key Infrastructure (PKI) to establish secure communications between
two devices, such as a client's browser and the Firepower 4100/9300 chassis.
Encryption Keys and Key Rings
Each PKI device holds a pair of asymmetric Rivest-Shamir-Adleman (RSA) encryption keys, one kept private
and one made public, stored in an internal key ring. A message encrypted with either key can be decrypted
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
12
Platform Settings
Creating a Key Ring
with the other key. To send an encrypted message, the sender encrypts the message with the receiver's public
key, and the receiver decrypts the message using its own private key. A sender can also prove its ownership
of a public key by encrypting (also called 'signing') a known message with its own private key. If a receiver
can successfully decrypt the message using the public key in question, the sender's possession of the
corresponding private key is proven. Encryption keys can vary in length, with typical lengths from 512 bits
to 2048 bits. In general, a longer key is more secure than a shorter key. FXOS provides a default key ring
with an initial 2048-bit key pair, and allows you to create additional key rings.
The default key ring certificate must be manually regenerated if the cluster name changes or the certificate
expires.
Certificates
To prepare for secure communications, two devices first exchange their digital certificates. A certificate is a
file containing a device's public key along with signed information about the device's identity. To merely
support encrypted communications, a device can generate its own key pair and its own self-signed certificate.
When a remote user connects to a device that presents a self-signed certificate, the user has no easy method
to verify the identity of the device, and the user's browser will initially display an authentication warning. By
default, FXOS contains a built-in self-signed certificate containing the public key from the default key ring.
Trusted Points
To provide stronger authentication for FXOS, you can obtain and install a third-party certificate from a trusted
source, or trusted point, that affirms the identity of your device. The third-party certificate is signed by the
issuing trusted point, which can be a root certificate authority (CA) or an intermediate CA or trust anchor that
is part of a trust chain that leads to a root CA. To obtain a new certificate, you must generate a certificate
request through FXOS and submit the request to a trusted point.
Important
The certificate must be in Base64 encoded X.509 (CER) format.
Creating a Key Ring
FXOS supports a maximum of 8 key rings, including the default key ring.
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Create and name the key ring:
Firepower-chassis # create keyring keyring-name
Step 3
Set the SSL key length in bits:
Firepower-chassis # set modulus {mod1024 | mod1536 | mod2048 | mod512}
Step 4
Commit the transaction:
Firepower-chassis # commit-buffer
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
13
Platform Settings
Regenerating the Default Key Ring
The following example creates a keyring with a key size of 1024 bits:
Firepower-chassis# scope security
Firepower-chassis /security # create keyring kr220
Firepower-chassis /security/keyring* # set modulus mod1024
Firepower-chassis /security/keyring* # commit-buffer
Firepower-chassis /security/keyring #
What to Do Next
Create a certificate request for this key ring.
Regenerating the Default Key Ring
The default key ring certificate must be manually regenerated if the cluster name changes or the certificate
expires.
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Enter key ring security mode for the default key ring:
Firepower-chassis /security # scope keyring default
Step 3
Regenerate the default key ring:
Firepower-chassis /security/keyring # set regenerate yes
Step 4
Commit the transaction:
Firepower-chassis # commit-buffer
The following example regenerates the default key ring:
Firepower-chassis# scope security
Firepower-chassis /security # scope keyring default
Firepower-chassis /security/keyring* # set regenerate yes
Firepower-chassis /security/keyring* # commit-buffer
Firepower-chassis /security/keyring #
Creating a Certificate Request for a Key Ring
Creating a Certificate Request for a Key Ring with Basic Options
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Enter configuration mode for the key ring:
Firepower-chassis /security # scope keyring keyring-name
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
14
Platform Settings
Creating a Certificate Request for a Key Ring
Step 3
Create a certificate request using the IPv4 or IPv6 address specified, or the name of the fabric interconnect.
You are prompted to enter a password for the certificate request.
Firepower-chassis /security/keyring # create certreq {ip [ipv4-addr | ipv6-v6] |subject-name name}
Step 4
Commit the transaction:
Firepower-chassis /security/keyring/certreq # commit-buffer
Step 5
Display the certificate request, which you can copy and send to a trust anchor or certificate authority:
Firepower-chassis /security/keyring # show certreq
The following example creates and displays a certificate request with an IPv4 address for a key ring, with
basic options:
Firepower-chassis# scope security
Firepower-chassis /security # scope keyring kr220
Firepower-chassis /security/keyring # create certreq ip 192.168.200.123 subject-name sjc04
Certificate request password:
Confirm certificate request password:
Firepower-chassis /security/keyring* # commit-buffer
Firepower-chassis /security/keyring # show certreq
Certificate request subject name: sjc04
Certificate request ip address: 192.168.200.123
Certificate request e-mail name:
Certificate request country name:
State, province or county (full name):
Locality (eg, city):
Organization name (eg, company):
Organization Unit name (eg, section):
Request:
-----BEGIN CERTIFICATE REQUEST----MIIBfTCB5wIBADARMQ8wDQYDVQQDEwZzYW1jMDQwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBALpKn1t8qMZO4UGqILKFXQQc2c8b/vW2rnRF8OPhKbhghLA1YZ1F
JqcYEG5Yl1+vgohLBTd45s0GC8m4RTLJWHo4SwccAUXQ5Zngf45YtX1WsylwUWV4
0re/zgTk/WCd56RfOBvWR2Dtztu2pGA14sd761zLxt29K7R8mzj6CAUVAgMBAAGg
LTArBgkqhkiG9w0BCQ4xHjAcMBoGA1UdEQEB/wQQMA6CBnNhbWMwNIcECsEiXjAN
BgkqhkiG9w0BAQQFAAOBgQCsxN0qUHYGFoQw56RwQueLTNPnrndqUwuZHUO03Teg
nhsyu4satpyiPqVV9viKZ+spvc6x5PWIcTWgHhH8BimOb/0OKuG8kwfIGGsEDlAv
TTYvUP+BZ9OFiPbRIA718S+V8ndXr1HejiQGxlDNqoN+odCXPc5kjoXD0lZTL09H
BA==
-----END CERTIFICATE REQUEST----Firepower-chassis /security/keyring #
What to Do Next
• Copy the text of the certificate request, including the BEGIN and END lines, and save it in a file. Send
the file with the certificate request to a trust anchor or certificate authority to obtain a certificate for the
key ring.
• Create a trusted point and set the certificate chain for the certificate of trust received from the trust
anchor.
Creating a Certificate Request for a Key Ring with Advanced Options
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
15
Platform Settings
Creating a Certificate Request for a Key Ring
Step 2
Enter configuration mode for the key ring:
Firepower-chassis /security # scope keyring keyring-name
Step 3
Create a certificate request:
Firepower-chassis /security/keyring # create certreq
Step 4
Specify the country code of the country in which the company resides:
Firepower-chassis /security/keyring/certreq* # set country country name
Step 5
Specify the Domain Name Server (DNS) address associated with the request:
Firepower-chassis /security/keyring/certreq* # set dns DNS Name
Step 6
Specify the email address associated with the certificate request:
Firepower-chassis /security/keyring/certreq* # set e-mail E-mail name
Step 7
Specify the IP address of the Firepower 4100/9300 chassis:
Firepower-chassis /security/keyring/certreq* # set ip {certificate request ip-address|certificate request
ip6-address }
Step 8
Specify the city or town in which the company requesting the certificate is headquartered:
Firepower-chassis /security/keyring/certreq* # set locality locality name (eg, city)
Step 9
Specify the organization requesting the certificate:
Firepower-chassis /security/keyring/certreq* # set org-name organization name
Step 10 Specify the organizational unit:
Firepower-chassis /security/keyring/certreq* # set org-unit-name organizational unit name
Step 11 Specify an optional password for the certificate request:
Firepower-chassis /security/keyring/certreq* # set password certificate request password
Step 12 Specify the state or province in which the company requesting the certificate is headquartered:
Firepower-chassis /security/keyring/certreq* # set state state, province or county
Step 13 Specify the fully qualified domain name of the Firepower 4100/9300 chassis:
Firepower-chassis /security/keyring/certreq* # set subject-name certificate request name
Step 14 Commit the transaction:
Firepower-chassis /security/keyring/certreq # commit-buffer
Step 15 Display the certificate request, which you can copy and send to a trust anchor or certificate authority:
Firepower-chassis /security/keyring # show certreq
The following example creates and displays a certificate request with an IPv4 address for a key ring, with
advanced options:
Firepower-chassis# scope security
Firepower-chassis /security # scope keyring kr220
Firepower-chassis /security/keyring # create certreq
Firepower-chassis /security/keyring/certreq* # set ip 192.168.200.123
Firepower-chassis /security/keyring/certreq* # set subject-name sjc04
Firepower-chassis /security/keyring/certreq* # set country US
Firepower-chassis /security/keyring/certreq* # set dns bg1-samc-15A
Firepower-chassis /security/keyring/certreq* # set email [email protected]
Firepower-chassis /security/keyring/certreq* # set locality new york city
Firepower-chassis /security/keyring/certreq* # set org-name "Cisco Systems"
Firepower-chassis /security/keyring/certreq* # set org-unit-name Testing
Firepower-chassis /security/keyring/certreq* # set state new york
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
16
Platform Settings
Creating a Trusted Point
Firepower-chassis /security/keyring/certreq* # commit-buffer
Firepower-chassis /security/keyring/certreq # show certreq
Certificate request subject name: sjc04
Certificate request ip address: 192.168.200.123
Certificate request e-mail name: [email protected]
Certificate request country name: US
State, province or county (full name): New York
Locality name (eg, city): new york city
Organization name (eg, company): Cisco
Organization Unit name (eg, section): Testing
Request:
-----BEGIN CERTIFICATE REQUEST----MIIBfTCB5wIBADARMQ8wDQYDVQQDEwZzYW1jMDQwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBALpKn1t8qMZO4UGqILKFXQQc2c8b/vW2rnRF8OPhKbhghLA1YZ1F
JqcYEG5Yl1+vgohLBTd45s0GC8m4RTLJWHo4SwccAUXQ5Zngf45YtX1WsylwUWV4
0re/zgTk/WCd56RfOBvWR2Dtztu2pGA14sd761zLxt29K7R8mzj6CAUVAgMBAAGg
LTArBgkqhkiG9w0BCQ4xHjAcMBoGA1UdEQEB/wQQMA6CBnNhbWMwNIcECsEiXjAN
BgkqhkiG9w0BAQQFAAOBgQCsxN0qUHYGFoQw56RwQueLTNPnrndqUwuZHUO03Teg
nhsyu4satpyiPqVV9viKZ+spvc6x5PWIcTWgHhH8BimOb/0OKuG8kwfIGGsEDlAv
TTYvUP+BZ9OFiPbRIA718S+V8ndXr1HejiQGxlDNqoN+odCXPc5kjoXD0lZTL09H
BA==
-----END CERTIFICATE REQUEST----Firepower-chassis /security/keyring/certreq #
What to Do Next
• Copy the text of the certificate request, including the BEGIN and END lines, and save it in a file. Send
the file with the certificate request to a trust anchor or certificate authority to obtain a certificate for the
key ring.
• Create a trusted point and set the certificate chain for the certificate of trust received from the trust
anchor.
Creating a Trusted Point
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Create a trusted point:
Firepower-chassis /security # create trustpoint name
Step 3
Specify certificate information for this trusted point:
Firepower-chassis /security/trustpoint # set certchain [ certchain ]
If you do not specify certificate information in the command, you are prompted to enter a certificate or a list
of trustpoints defining a certification path to the root certificate authority (CA). On the next line following
your input, type ENDOFBUF to finish.
The certificate must be in Base64 encoded X.509 (CER)
format.
Commit the transaction:
Firepower-chassis /security/trustpoint # commit-buffer
Important
Step 4
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
17
Platform Settings
Importing a Certificate into a Key Ring
The following example creates a trusted point and provides a certificate for the trusted point:
Firepower-chassis# scope security
Firepower-chassis /security # create trustpoint tPoint10
Firepower-chassis /security/trustpoint* # set certchain
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Trustpoint Certificate Chain:
> -----BEGIN CERTIFICATE----> MIIDMDCCApmgAwIBAgIBADANBgkqhkiG9w0BAQQFADB0MQswCQYDVQQGEwJVUzEL
> BxMMU2FuIEpvc2UsIENBMRUwEwYDVQQKEwxFeGFtcGxlIEluYy4xEzARBgNVBAsT
> ClRlc3QgR3JvdXAxGTAXBgNVBAMTEHRlc3QuZXhhbXBsZS5jb20xHzAdBgkqhkiG
> 9w0BCQEWEHVzZXJAZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
> AoGBAMZw4nTepNIDhVzb0j7Z2Je4xAG56zmSHRMQeOGHemdh66u2/XAoLx7YCcYU
> ZgAMivyCsKgb/6CjQtsofvtrmC/eAehuK3/SINv7wd6Vv2pBt6ZpXgD4VBNKONDl
> GMbkPayVlQjbG4MD2dx2+H8EH3LMtdZrgKvPxPTE+bF5wZVNAgMBAAGgJTAjBgkq
> hkiG9w0BCQcxFhMUQSBjaGFsbGVuZ2UgcGFzc3dvcmQwDQYJKoZIhvcNAQEFBQAD
> gYEAG61CaJoJaVMhzCl903O6Mg51zq1zXcz75+VFj2I6rH9asckCld3mkOVx5gJU
> Ptt5CVQpNgNLdvbDPSsXretysOhqHmp9+CLv8FDuy1CDYfuaLtvlWvfhevskV0j6
> jtcEMyZ+f7+3yh421ido3nO4MIGeBgNVHSMEgZYwgZOAFLlNjtcEMyZ+f7+3yh42
> 1ido3nO4oXikdjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFDASBgNVBAcT
> C1NhbnRhIENsYXJhMRswGQYDVQQKExJOdW92YSBTeXN0ZW1zIEluYy4xFDASBgNV
> BAsTC0VuZ2luZWVyaW5nMQ8wDQYDVQQDEwZ0ZXN0Q0GCAQAwDAYDVR0TBAUwAwEB
> /zANBgkqhkiG9w0BAQQFAAOBgQAhWaRwXNR6B4g6Lsnr+fptHv+WVhB5fKqGQqXc
> wR4pYiO4z42/j9Ijenh75tCKMhW51az8copP1EBmOcyuhf5C6vasrenn1ddkkYt4
> PR0vxGc40whuiozBolesmsmjBbedUCwQgdFDWhDIZJwK5+N3x/kfa2EHU6id1avt
> 4YL5Jg==
> -----END CERTIFICATE----> ENDOFBUF
Firepower-chassis /security/trustpoint* # commit-buffer
Firepower-chassis /security/trustpoint #
What to Do Next
Obtain a key ring certificate from the trust anchor or certificate authority and import it into the key ring.
Importing a Certificate into a Key Ring
Before You Begin
• Configure a trusted point that contains the certificate chain for the key ring certificate.
• Obtain a key ring certificate from a trust anchor or certificate authority.
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Enter configuration mode for the key ring that will receive the certificate:
Firepower-chassis /security # scope keyring keyring-name
Step 3
Specify the trusted point for the trust anchor or certificate authority from which the key ring certificate was
obtained:
Firepower-chassis /security/keyring # set trustpoint name
Step 4
Launch a dialog for entering and uploading the key ring certificate:
Firepower-chassis /security/keyring # set cert
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
18
Platform Settings
Configuring HTTPS
At the prompt, paste the certificate text that you received from the trust anchor or certificate authority. On the
next line following the certificate, type ENDOFBUF to complete the certificate input.
The certificate must be in Base64 encoded X.509 (CER)
format.
Commit the transaction:
Firepower-chassis /security/keyring # commit-buffer
Important
Step 5
The following example specifies the trust point and imports a certificate into a key ring:
Firepower-chassis# scope security
Firepower-chassis /security # scope keyring kr220
Firepower-chassis /security/keyring # set trustpoint tPoint10
Firepower-chassis /security/keyring* # set cert
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Keyring certificate:
> -----BEGIN CERTIFICATE----> MIIB/zCCAWgCAQAwgZkxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UE
> BxMMU2FuIEpvc2UsIENBMRUwEwYDVQQKEwxFeGFtcGxlIEluYy4xEzARBgNVBAsT
> ClRlc3QgR3JvdXAxGTAXBgNVBAMTEHRlc3QuZXhhbXBsZS5jb20xHzAdBgkqhkiG
> 9w0BCQEWEHVzZXJAZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
> AoGBAMZw4nTepNIDhVzb0j7Z2Je4xAG56zmSHRMQeOGHemdh66u2/XAoLx7YCcYU
> ZgAMivyCsKgb/6CjQtsofvtrmC/eAehuK3/SINv7wd6Vv2pBt6ZpXgD4VBNKONDl
> GMbkPayVlQjbG4MD2dx2+H8EH3LMtdZrgKvPxPTE+bF5wZVNAgMBAAGgJTAjBgkq
> hkiG9w0BCQcxFhMUQSBjaGFsbGVuZ2UgcGFzc3dvcmQwDQYJKoZIhvcNAQEFBQAD
> gYEAG61CaJoJaVMhzCl903O6Mg51zq1zXcz75+VFj2I6rH9asckCld3mkOVx5gJU
> Ptt5CVQpNgNLdvbDPSsXretysOhqHmp9+CLv8FDuy1CDYfuaLtvlWvfhevskV0j6
> mK3Ku+YiORnv6DhxrOoqau8r/hyI/L43l7IPN1HhOi3oha4=
> -----END CERTIFICATE----> ENDOFBUF
Firepower-chassis /security/keyring* # commit-buffer
Firepower-chassis /security/keyring #
What to Do Next
Configure your HTTPS service with the key ring.
Configuring HTTPS
Caution
After you complete the HTTPS configuration, including changing the port and key ring to be used by
HTTPS, all current HTTP and HTTPS sessions are closed without warning as soon as you save or commit
the transaction.
Procedure
Step 1
Enter system mode:
Firepower-chassis# scope system
Step 2
Enter system services mode:
Firepower-chassis /system # scope services
Step 3
Enable the HTTPS service:
Firepower-chassis /system/services # enable https
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
19
Platform Settings
Changing the HTTPS Port
Step 4
(Optional) Specify the port to be used for the HTTPS connection:
Firepower-chassis /system/services # set https port port-num
Step 5
(Optional) Specify the name of the key ring you created for HTTPS:
Firepower-chassis /system/services # set https keyring keyring-name
Step 6
(Optional) Specify the level of Cipher Suite security used by the domain:
Firepower-chassis /system/services # set https cipher-suite-mode cipher-suite-mode
cipher-suite-mode can be one of the following keywords:
• high-strength
• medium-strength
• low-strength
• custom—Allows you to specify a user-defined Cipher Suite specification string.
Step 7
(Optional) If cipher-suite-mode is set to custom, specify a custom level of Cipher Suite security for the
domain:
Firepower-chassis /system/services # set https cipher-suite cipher-suite-spec-string
cipher-suite-spec-string can contain up to 256 characters and must conform to the OpenSSL Cipher Suite
specifications. You cannot use any spaces or special characters except ! (exclamation point), + (plus sign), (hyphen), and : (colon). For details, see http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite.
For example, the medium strength specification string FXOS uses as the default is:
ALL:!ADH:!EXPORT56:!LOW:RC4+RSA:+HIGH:+MEDIUM:+EXP:+eNULL
Note
Step 8
This option is ignored if cipher-suite-mode is set to anything other than custom.
Commit the transaction to the system configuration:
Firepower-chassis /system/services # commit-buffer
The following example enables HTTPS, sets the port number to 443, sets the key ring name to kring7984,
sets the Cipher Suite security level to high, and commits the transaction:
Firepower-chassis# scope system
Firepower-chassis /system # scope services
Firepower-chassis /system/services # enable https
Firepower-chassis /system/services* # set https port 443
Warning: When committed, this closes all the web sessions.
Firepower-chassis /system/services* # set https keyring kring7984
Firepower-chassis /system/services* # set https cipher-suite-mode high
Firepower-chassis /system/services* # commit-buffer
Firepower-chassis /system/services #
Changing the HTTPS Port
The HTTPS service is enabled on port 443 by default. You cannot disable HTTPS, but you can change the
port to use for HTTPS connections.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
20
Platform Settings
Deleting a Key Ring
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > HTTPS.
Enter the port to use for HTTPS connections in the Port field. Specify an integer between 1 and 65535. This
service is enabled on port 443 by default.
Click Save.
The Firepower chassis is configured with the HTTPS port specified.
After changing the HTTPS port, all current HTTPS sessions are closed. Users will need to log back in to the
Firepower Chassis Manager using the new port as follows:
https://<chassis_mgmt_ip_address>:<chassis_mgmt_port>
where <chassis_mgmt_ip_address> is the IP address or host name of the Firepower chassis that you entered
during initial configuration and <chassis_mgmt_port> is the HTTPS port you have just configured.
Deleting a Key Ring
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Delete the named key ring:
Firepower-chassis /security # delete keyring name
Step 3
Commits the transaction:
Firepower-chassis /security # commit-buffer
The following example deletes a key ring:
Firepower-chassis# scope security
Firepower-chassis /security # delete keyring key10
Firepower-chassis /security* # commit-buffer
Firepower-chassis /security #
Deleting a Trusted Point
Before You Begin
Ensure that the trusted point is not used by a key ring.
Procedure
Step 1
Enters security mode:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
21
Platform Settings
Disabling HTTPS
Firepower-chassis# scope security
Step 2
Delete the named trusted point:
Firepower-chassis /security # delete trustpoint name
Step 3
Commits the transaction:
Firepower-chassis /security # commit-buffer
The following example deletes a trusted point:
Firepower-chassis# scope security
Firepower-chassis /security # delete trustpoint tPoint10
Firepower-chassis /security* # commit-buffer
Firepower-chassis /security #
Disabling HTTPS
Procedure
Step 1
Enter system mode:
Firepower-chassis# scope system
Step 2
Enter system services mode:
Firepower-chassis /system # scope services
Step 3
Disable the HTTPS service:
Firepower-chassis /system/services # disable https
Step 4
Commit the transaction to the system configuration:
Firepower-chassis /system/services # commit-buffer
The following example disables HTTPS and commits the transaction:
Firepower-chassis# scope system
Firepower-chassis /system # scope services
Firepower-chassis /system/services # disable https
Firepower-chassis /system/services* # commit-buffer
Firepower-chassis /system/services #
Configuring AAA
This section describes authentication, authorization, and accounting. See the following topics for more
information:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
22
Platform Settings
About AAA
About AAA
AAA is a set of services for controlling access to computer resources, enforcing policies, assessing usage,
and providing the information necessary to bill for services. These processes are considered important for
effective network management and security.
Authentication
Authentication provides a way to identify a user, typically by having the user enter a valid username and valid
password before access is granted. The AAA server compares a user's authentication credentials with other
user credentials stored in a database. If the credentials match, the user is permitted access to the network. If
the credentials do not match, authentication fails and network access is denied.
You can configure the Firepower 4100/9300 chassis to authenticate administrative connections to the chassis,
including the following sessions:
• HTTPS
• SSH
• Serial console
Authorization
Authorization is the process of enforcing policies: determining what types of activities, resources, or services
a user is permitted to access. After a user is authenticated, that user may be authorized for different types of
access or activity.
Accounting
Accounting measures the resources a user consumes during access, which may include the amount of system
time or the amount of data that a user has sent or received during a session. Accounting is carried out through
the logging of session statistics and usage information, which is used for authorization control, billing, trend
analysis, resource utilization, and capacity planning activities.
Interaction Between Authentication, Authorization, and Accounting
You can use authentication alone or with authorization and accounting. Authorization always requires a user
to be authenticated first. You can use accounting alone, or with authentication and authorization.
AAA Servers
The AAA server is a network server that is used for access control. Authentication identifies the user.
Authorization implements policies that determine which resources and services an authenticated user may
access. Accounting keeps track of time and data resources that are used for billing and analysis.
Local Database Support
The Firepower chassis maintains a local database that you can populate with user profiles. You can use a local
database instead of AAA servers to provide user authentication, authorization, and accounting.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
23
Platform Settings
Configuring LDAP Providers
Configuring LDAP Providers
Configuring Properties for LDAP Providers
The properties that you configure in this task are the default settings for all provider connections of this type.
If an individual provider includes a setting for any of these properties, the Firepower eXtensible Operating
System uses that setting and ignores the default setting.
If you are using Active Directory as your LDAP server, create a user account in the Active Directory server
to bind with the Firepower eXtensible Operating System. This account should be given a non-expiring password.
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the LDAP tab.
In the Properties area, complete the following fields:
Name
Description
Timeout field
The length of time in seconds the system should spend trying to contact
the LDAP database before it times out.
Enter an integer from 1 to 60 seconds. The default value is 30 seconds.
This property is required.
Attribute field
An LDAP attribute that stores the values for the user roles and locales.
This property is always a name-value pair. The system queries the user
record for the value that matches this attribute name.
Base DN field
The specific distinguished name in the LDAP hierarchy where the server
should begin a search when a remote user logs in and the system attempts
to get the user's DN based on their username. The length of the base
DN can be set to a maximum of 255 characters minus the length of
CN=$userid, where $userid identifies the remote user attempting to
access the Firepower chassis using LDAP authentication.
This property is required. If you do not specify a base DN on this tab
then you must specify one for each LDAP provider that you define.
Filter field
The LDAP search is restricted to those user names that match the defined
filter.
This property is required. If you do not specify a filter on this tab then
you must specify one for each LDAP provider that you define.
Step 4
Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
24
Platform Settings
Configuring LDAP Providers
What to Do Next
Create an LDAP provider.
Creating an LDAP Provider
The Firepower eXtensible Operating System supports a maximum of 16 LDAP providers.
Before You Begin
If you are using Active Directory as your LDAP server, create a user account in the Active Directory server
to bind with the Firepower eXtensible Operating System. This account should be given a non-expiring password.
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the LDAP tab.
For each LDAP provider that you want to add:
a) In the LDAP Providers area, click Add.
b) In the Add LDAP Provider dialog box, complete the following fields:
Name
Description
Hostname/FDQN (or IP
Address) field
The hostname or IP address on which the LDAP provider resides. If
SSL is enabled, this field must exactly match a Common Name (CN)
in the security certificate of the LDAP database.
Order field
The order in which the Firepower eXtensible Operating System uses
this provider to authenticate users.
Enter an integer between 1 and 16, or enter lowest-available or 0
(zero) if you want the Firepower eXtensible Operating System to
assign the next available order based on the other providers defined
in Firepower Chassis Manager or the FXOS CLI.
Bind DN field
The distinguished name (DN) for an LDAP database account that has
read and search permissions for all objects under the base DN.
The maximum supported string length is 255 ASCII characters.
Base DN field
The specific distinguished name in the LDAP hierarchy where the
server should begin a search when a remote user logs in and the
system attempts to get the user's DN based on their username. The
length of the base DN can be set to a maximum of 255 characters
minus the length of CN=$userid, where $userid identifies the remote
user attempting to access Firepower Chassis Manager or the FXOS
CLI using LDAP authentication.
This value is required unless a default base DN has been set on the
LDAP tab.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
25
Platform Settings
Configuring LDAP Providers
Name
Description
Port field
The port through which Firepower Chassis Manager or the FXOS
CLI communicates with the LDAP database. The standard port
number is 389.
Enable SSL check box
If checked, encryption is required for communications with the LDAP
database. If unchecked, authentication information will be sent as
clear text.
LDAP uses STARTTLS. This allows encrypted communication using
port 389.
Filter field
The LDAP search is restricted to those user names that match the
defined filter.
This value is required unless a default filter has been set on the LDAP
tab.
Attribute field
An LDAP attribute that stores the values for the user roles and locales.
This property is always a name-value pair. The system queries the
user record for the value that matches this attribute name.
This value is required unless a default attribute has been set on the
LDAP tab.
Key field
The password for the LDAP database account specified in the Bind
DN field. You can enter any standard ASCII characters except for
space, § (section sign), ? (question mark), or = (equal sign).
Confirm Key field
The LDAP database password repeated for confirmation purposes.
Timeout field
The length of time in seconds the system should spend trying to
contact the LDAP database before it times out.
Enter an integer from 1 to 60 seconds, or enter 0 (zero) to use the
global timeout value specified on the LDAP tab. The default is 30
seconds.
Vendor field
This selection identifies the vendor that is providing the LDAP
provider or server details:
• If the LDAP provider is Microsoft Active Directory, select MS
AD.
• If the LDAP provider is not Microsoft Active Directory, select
Open LDAP.
The default is Open LDAP.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
26
Platform Settings
Configuring RADIUS Providers
c) Click OK to close the Add LDAP Provider dialog box.
Step 4
Step 5
Click Save.
(Optional) Enable the certification revocation list check:
Firepower-chassis /security/ldap/server # set revoke-policy {strict | relaxed}
Note
This configuration only takes effect if the SSL connection is
enabled.
Deleting an LDAP Provider
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the LDAP tab.
In the LDAP Providers area, click the Delete icon in the row in the table that corresponds to the LDAP
Provider you want to delete.
Configuring RADIUS Providers
Configuring Properties for RADIUS Providers
The properties that you configure in this task are the default settings for all provider connections of this type.
If an individual provider includes a setting for any of these properties, the Firepower eXtensible Operating
System uses that setting and ignores the default setting.
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the RADIUS tab.
In the Properties area, complete the following fields:
Name
Description
Timeout field
The length of time in seconds the system should spend trying to contact
the RADIUS database before it times out.
Enter an integer from 1 to 60 seconds. The default value is 5 seconds.
This property is required.
Retries field
The number of times to retry the connection before the request is
considered to have failed.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
27
Platform Settings
Configuring RADIUS Providers
Step 4
Click Save.
What to Do Next
Create a RADIUS provider.
Creating a RADIUS Provider
The Firepower eXtensible Operating System supports a maximum of 16 RADIUS providers.
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the RADIUS tab.
For each RADIUS provider that you want to add:
a) In the RADIUS Providers area, click Add.
b) In the Add RADIUS Provider dialog box, complete the following fields:
Name
Description
Hostname/FDQN (or IP
Address) field
The hostname or IP address on which the RADIUS provider resides.
Order field
The order in which the Firepower eXtensible Operating System uses
this provider to authenticate users.
Enter an integer between 1 and 16, or enter lowest-available or 0
(zero) if you want the Firepower eXtensible Operating System to
assign the next available order based on the other providers defined
in Firepower Chassis Manager or the FXOS CLI.
Key field
The SSL encryption key for the database.
Confirm Key field
The SSL encryption key repeated for confirmation purposes.
Authorization Port field
The port through which Firepower Chassis Manager or the FXOS
CLI communicates with the RADIUS database. The valid range is 1
to 65535. The standard port number is 1700.
Timeout field
The length of time in seconds the system should spend trying to
contact the RADIUS database before it times out.
Enter an integer from 1 to 60 seconds, or enter 0 (zero) to use the
global timeout value specified on the RADIUS tab. The default is 5
seconds.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
28
Platform Settings
Configuring TACACS+ Providers
Name
Description
Retries field
The number of times to retry the connection before the request is
considered to have failed.
If desired, enter an integer between 0 and 5. If you do not specify a
value, Firepower Chassis Manager uses the value specified on the
RADIUS tab.
c) Click OK to close the Add RADIUS Provider dialog box.
Step 4
Click Save.
Deleting a RADIUS Provider
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the RADIUS tab.
In the RADIUS Providers area, click the Delete icon in the row in the table that corresponds to the RADIUS
Provider you want to delete.
Configuring TACACS+ Providers
Configuring Properties for TACACS+ Providers
The properties that you configure in this task are the default settings for all provider connections of this type.
If an individual provider includes a setting for any of these properties, the Firepower eXtensible Operating
System uses that setting and ignores the default setting.
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the TACACS tab.
In the Properties area, complete the following fields:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
29
Platform Settings
Configuring TACACS+ Providers
Name
Description
Timeout field
The length of time in seconds the system should spend trying to contact
the TACACS+ database before it times out.
Enter an integer from 1 to 60 seconds. The default value is 5 seconds.
This property is required.
Step 4
Click Save.
What to Do Next
Create a TACACS+ provider.
Creating a TACACS+ Provider
The Firepower eXtensible Operating System supports a maximum of 16 TACACS+ providers.
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the TACACS tab.
For each TACACS+ provider that you want to add:
a) In the TACACS Providers area, click Add.
b) In the Add TACACS Provider dialog box, complete the following fields:
Name
Description
Hostname/FDQN (or IP
Address) field
The hostname or IP address on which the TACACS+ provider resides.
Order field
The order in which the Firepower eXtensible Operating System uses
this provider to authenticate users.
Enter an integer between 1 and 16, or enter lowest-available or 0
(zero) if you want the Firepower eXtensible Operating System to
assign the next available order based on the other providers defined
in Firepower Chassis Manager or the FXOS CLI.
Key field
The SSL encryption key for the database.
Confirm Key field
The SSL encryption key repeated for confirmation purposes.
Port field
The port through which Firepower Chassis Manager or the FXOS
CLI communicates with the TACACS+ database.
Enter an integer between 1 and 65535. The default port is 49.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
30
Platform Settings
Configuring Syslog
Name
Description
Timeout field
The length of time in seconds the system should spend trying to
contact the TACACS+ database before it times out.
Enter an integer from 1 to 60 seconds, or enter 0 (zero) to use the
global timeout value specified on the TACACS+ tab. The default is
5 seconds.
c) Click OK to close the Add TACACS Provider dialog box.
Step 4
Click Save.
Deleting a TACACS+ Provider
Procedure
Step 1
Step 2
Step 3
Choose Platform Settings > AAA.
Click the TACACS tab.
In the TACACS Providers area, click the Delete icon in the row in the table that corresponds to the TACACS+
Provider you want to delete.
Configuring Syslog
System logging is a method of collecting messages from devices to a server running a syslog daemon. Logging
to a central syslog server helps in aggregation of logs and alerts. A syslog service accepts messages and stores
them in files, or prints them according to a simple configuration file. This form of logging provides protected
long-term storage for logs. Logs are useful both in routine troubleshooting and in incident handling.
Procedure
Step 1
Step 2
Choose Platform Settings > Syslog.
Configure Local Destinations:
a) Click the Local Destinations tab.
b) On the Local Destinations tab, complete the following fields:
Name
Description
Console Section
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
31
Platform Settings
Configuring Syslog
Name
Description
Admin State field
Whether the Firepower chassis displays syslog messages on the
console.
Check the Enable check box if you want to have syslog messages
displayed on the console as well as added to the log. If the Enable
check box is unchecked, syslog messages are added to the log but are
not displayed on the console.
Level field
If you checked the Enable check box for Console - Admin State,
select the lowest message level that you want displayed on the console.
The Firepower chassis displays that level and above on the console.
This can be one of the following:
• Emergencies
• Alerts
• Critical
Monitor Section
Admin State field
Whether the Firepower chassis displays syslog messages on the
monitor.
Check the Enable check box if you want to have syslog messages
displayed on the monitor as well as added to the log. If the Enable
check box is unchecked, syslog messages are added to the log but are
not displayed on the monitor.
Level drop-down list
If you checked the Enable check box for Monitor - Admin State,
select the lowest message level that you want displayed on the
monitor. The system displays that level and above on the monitor.
This can be one of the following:
• Emergencies
• Alerts
• Critical
• Errors
• Warnings
• Notifications
• Information
• Debugging
c) Click Save.
Step 3
Configure Remote Destinations:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
32
Platform Settings
Configuring Syslog
a) Click the Remote Destinations tab.
b) On the Remote Destinations tab, complete the following fields for up to three external logs that can store
messages generated by the Firepower chassis:
By sending syslog messages to a remote destination, you can archive messages according to the available
disk space on the external syslog server, and manipulate logging data after it is saved. For example, you
could specify actions to be executed when certain types of syslog messages are logged, extract data from
the log and save the records to another file for reporting, or track statistics using a site-specific script.
Name
Description
Admin State field
Check the Enable check box if you want to have syslog messages
stored in a remote log file.
Level drop-down list
Select the lowest message level that you want the system to store.
The system stores that level and above in the remote file. This can
be one of the following:
• Emergencies
• Alerts
• Critical
• Errors
• Warnings
• Notifications
• Information
• Debugging
Hostname/IP Address field
The hostname or IP address on which the remote log file resides.
Note
Facility drop-down list
You must configure a DNS server if you use a hostname
rather than an IP address.
Choose a system log facility for syslog servers to use as a basis to
file messages. This can be one of the following:
• Local0
• Local1
• Local2
• Local3
• Local4
• Local5
• Local6
• Local7
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
33
Platform Settings
Configuring DNS Servers
c) Click Save.
Step 4
Configure Local Sources:
a) Click the Local Sources tab.
b) On the Local Sources tab, complete the following fields:
Name
Description
Faults Admin State field
Whether system fault logging is enabled or not. If the Enable check
box is checked, the Firepower chassis logs all system faults.
Audits Admin State field
Whether audit logging is enabled or not. If the Enable check box is
checked, the Firepower chassis logs all audit log events.
Events Admin State field
Whether system event logging is enabled or not. If the Enable check
box is checked, the Firepower chassis logs all system events.
c) Click Save.
Configuring DNS Servers
You need to specify a DNS server if the system requires resolution of host names to IP addresses. For example,
you cannot use a name such as www.cisco.com when you are configuring a setting on the Firepower chassis
if you do not configure a DNS server. You would need to use the IP address of the server, which can be either
an IPv4 or an IPv6 address. You can configure up to four DNS servers.
Note
When you configure multiple DNS servers, the system searches for the servers only in any random order.
If a local management command requires DNS server lookup, it can only search for three DNS servers in
random order.
Procedure
Step 1
Step 2
Step 3
Step 4
Choose Platform Settings > DNS.
Check the Enable DNS Server check box.
For each DNS server that you want to add, up to a maximum of four, enter the IP address of the DNS server
in the DNS Server field and click Add.
Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
34
">