Cisco FXOS Firepower Chassis Manager Firepower Security Appliance Configuration Guide
The Cisco FXOS Firepower Chassis Manager is a web-based interface that makes it easy to configure platform settings and interfaces, provision devices, and monitor system status. It provides a streamlined, visual representation of the current chassis status and simplified configuration of chassis features. You can easily monitor the status of the FXOS chassis, configure chassis settings for the following: date and time, SSH, SNMP, HTTPS, AAA, Syslog, and DNS, and manage the following settings: licensing, updates, and user management.
Advertisement
Advertisement
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
First Published: 2015-12-09
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright
©
1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http:// www.cisco.com/go/trademarks
. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
©
2015 Cisco Systems, Inc. All rights reserved.
C O N T E N T S
C H A P T E R 1
C H A P T E R 2
C H A P T E R 3
Introduction to the Firepower Security Appliance 1
About the Firepower Security Appliance
Firepower Chassis Manager Overview
Log In or Out of the Firepower Chassis Manager
About Smart Software Licensing
Smart Software Licensing for Applications on the FXOS Chassis
Smart Software Manager and Accounts
Licenses and Devices Managed per Virtual Account
Device Registration and Tokens
Periodic Communication with the License Authority
Smart Call Home Infrastructure
Prerequisites for Smart Software Licensing
Defaults for Smart Software Licensing
Configure Smart Software Licensing
(Optional) Configure the HTTP Proxy
Register the Firepower Security Appliance with the License Authority
Smart License Manager Satellite for the FXOS chassis
Configure a Smart License Satellite Server for the FXOS chassis
History for Smart Software Licensing
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3) iii
Contents
C H A P T E R 4
C H A P T E R 5
C H A P T E R 6
Guidelines for Remote Authentication
Password Profile for Locally Authenticated Users
Set the Maximum Number of Login Attempts
Activating or Deactivating a Local User Account
Downloading Images from Cisco.com
Uploading an Image to the Firepower Security Appliance
Verifying the Integrity of an Image
Upgrading the Firepower eXtensible Operating System Platform Bundle
Updating the Image Version for a Logical Device
Changing the Management IP Address
Setting the Date and Time Using NTP
Setting the Date and Time Manually
iv
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Contents
SNMP Security Levels and Privileges
Supported Combinations of SNMP Security Models and Levels
Enabling SNMP and Configuring SNMP Properties
Certificates, Key Rings, and Trusted Points
Regenerating the Default Key Ring
Creating a Certificate Request for a Key Ring
Creating a Certificate Request for a Key Ring with Basic Options
Creating a Certificate Request for a Key Ring with Advanced Options
Importing a Certificate into a Key Ring
Configuring Properties for LDAP Providers
Configuring Properties for RADIUS Providers
Configuring Properties for TACACS+ Providers
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3) v
Contents
C H A P T E R 7
C H A P T E R 8
About Firepower Security Appliance Interfaces
Change the Administrative State of an Interface
Create a Standalone Logical Device
Create a Standalone ASA Logical Device
About Clustering on the FXOS Chassis
Primary and Secondary Unit Roles
Size the Cluster Control Link for Inter-Chassis Clustering
Cluster Control Link Redundancy for Inter-Chassis Clustering
Cluster Control Link Reliability for Inter-Chassis Clustering
vi
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Contents
C H A P T E R 9
C H A P T E R 1 0
C H A P T E R 1 1
Examples for Inter-Site Clustering
Spanned EtherChannel Transparent Mode North-South Inter-Site Example
Spanned EtherChannel Transparent Mode East-West Inter-Site Example
Connect to the Console of the Application or Decorator
Change the ASA to Transparent Firewall Mode
Change an Interface on a Firepower Threat Defense Logical Device
Change an Interface on an ASA Logical Device
Security Module/Engine Management 97
About FXOS Security Modules/Security Engine
Decommissioning/Recommissioning a Security Module
Acknowledging a Security Module/Engine
Resetting a Security Module/Engine
Reinitializing a Security Module/Engine
Powering On/Off a Security Module/Engine
Configuration Import/Export 101
About Configuration Import/Export
Exporting a Configuration File
Importing a Configuration File
Creating or Editing a Packet Capture Session
Configuring Filters for Packet Capture
Starting and Stopping a Packet Capture Session
Downloading a Packet Capture File
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3) vii
Contents viii
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
1
Introduction to the Firepower Security Appliance
•
About the Firepower Security Appliance, page 1
•
Firepower Chassis Manager Overview, page 1
•
Monitoring the Chassis Status, page 2
About the Firepower Security Appliance
The Cisco FXOS chassis is a next-generation platform for network and content security solutions. The FXOS chassis is part of the Cisco Application Centric Infrastructure (ACI) Security Solution and provides an agile, open, secure platform that is built for scalability, consistent control, and simplified management.
The FXOS chassis provides the following features:
• Modular chassis-based security system—provides high performance, flexible input/output configurations, and scalability.
• Firepower Chassis Manager—graphical user interface provides streamlined, visual representation of current chassis status and simplified configuration of chassis features.
• FXOS CLI—provides command-based interface for configuring features, monitoring chassis status, and accessing advanced troubleshooting features.
• FXOS REST API—allows users to programmatically configure and manage their chassis.
Firepower Chassis Manager Overview
The Firepower eXtensible Operating System provides a web interface that makes it easy to configure platform settings and interfaces, provision devices, and monitor system status. The navigation bar at the top of the user interface provides access to the following:
• Overview—From the Overview page you can easily monitor the status of the Firepower chassis. For more information, see
Monitoring the Chassis Status, on page 2
.
• Interfaces—From the Interfaces page, you can view the status of the installed interfaces on the chassis, edit interface properties, enable or disable an interface, and create port channels. For more information, see
Interface Management, on page 69
.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
1
Introduction to the Firepower Security Appliance
Monitoring the Chassis Status
• Logical Devices—From the Logical Devices page, you can create, edit, and delete logical devices. For more information, see
.
• Security Modules/Security Engine—From the Security Modules/Security Engine page, you can view the status of and can perform various functions on a security module/engine, such as power cycling, reinitializing, acknowledging, and decommissioning. For more information, see
.
• Platform Settings—From the Platform Settings page, you can configure chassis settings for the following: date and time, SSH, SNMP, HTTPS, AAA, Syslog, and DNS. For more information, see
.
• System Settings—From the System menu, you can manage the following settings:
◦Licensing—From the Licensing page, you can configure Smart Call Home settings and register your Firepower chassis with the Licensing Authority. For more information, see
.
◦Updates—From the Updates page, you can upload Platform Bundle and Application images to the
Firepower chassis. For more information, see
.
◦User Management—From the User Management page you can configure user settings and define user accounts for the FXOS chassis. For more information, see
.
Monitoring the Chassis Status
From the Overview page you can easily monitor the status of the FXOS chassis. The Overview page provides the following elements:
• Device Information—The top of the Overview page contains the following information about the FXOS chassis:
◦Chassis name—shows the name assigned to the chassis during initial configuration.
◦IP address—shows the management IP address assigned to the chassis during initial configuration.
◦Model—shows the FXOS chassis model.
◦Version—shows the version number of the FXOS running on the chassis.
◦Operational State—shows the operable status for the chassis.
◦Chassis uptime—shows the elapsed time since the system was last restarted.
Tip
You can hover over the icon to the right of the Chassis uptime field to see uptime for a security module/engine.
• Visual Status Display—Below the Device Information section is a visual representation of the chassis that shows the components that are installed in the chassis and provides a general status for those components. You can hover over the ports that are shown in the Visual Status Display to get additional information such as interface name, speed, type, admin state, and operational state. For models with multiple security modules, you can hover over the security modules that are shown in the Visual Status
2
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Introduction to the Firepower Security Appliance
Monitoring the Chassis Status
Display to get additional information such as device name, template type, admin state, and operational state.
• Detailed Status Information—Below the Visual Status Display is a table containing detailed status information for the chassis. The status information is broken up into five sections: Faults, Interfaces,
Devices, License, and Inventory. You can see a summary for each of those sections above the table and you can see additional details for each of those sections by clicking on the summary area for the information you want to view.
The system provides the following detailed status information for the chassis:
◦Faults—Lists the faults that have been generated in the system. The faults are sorted by severity:
Critical, Major, Minor, Warning, and Info. For each fault that is listed, you can see the severity, a description of the fault, the cause, the number of occurrences, and the time of the most recent occurrence. You can also see whether the fault has been acknowledged or not.
You can click on any of the faults to see additional details for the fault or to acknowledge the fault.
Note
Once the underlying cause of the fault has been addressed, the fault will automatically be cleared from the listing during the next polling interval. If a user is working on a resolution for a specific fault, they can acknowledge the fault to let other users know that the fault is currently being addressed.
◦Interfaces—Lists the interfaces installed in the system and shows the interface name, operational status, administrative status, number of received bytes, and number of transmitted bytes.
◦Devices— Lists the logical devices configured in the system and provides the following details for each logical device: device name, device state, application template type, operational state, administrative state, image version, management IP address, and ASDM URL.
◦License— Shows whether smart licensing is enabled, provides the current registration status of your Firepower license, and shows license authorization information for the chassis.
◦Inventory—Lists the components installed in the chassis and provides relevant details for those components, such as: component name, number of cores, installation location, operational status, operability, capacity, power, thermal, serial number, model number, part number, and vendor.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
3
Monitoring the Chassis Status
Introduction to the Firepower Security Appliance
4
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
2
Getting Started
•
•
•
Log In or Out of the Firepower Chassis Manager, page 8
•
Accessing the FXOS CLI, page 8
Task Flow
The following procedure shows the basic tasks that should be completed when configuring your FXOS chassis.
Procedure
Step 1
Configure the FXOS chassis hardware (see the Cisco Firepower Security Appliance Hardware Installation
Guide ).
Step 2
Complete the initial configuration (see
Initial Configuration, on page 6
).
Step 3
Log in to the Firepower Chassis Manager (see
Log In or Out of the Firepower Chassis Manager, on page
8 ).
Step 4
Set the Date and Time (see
Setting the Date and Time, on page 37
).
Step 5
Configure a DNS server (see
Configuring DNS Servers, on page 68
).
Step 6
Register your product license (see
License Management, on page 11
).
Step 7
Configure users (see
).
Step 8
Perform software updates as required (see
).
Step 9
Configure additional platform settings (see
).
Step 10 Configure interfaces (see
Interface Management, on page 69
).
Step 11 Create logical devices (see
).
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
5
Getting Started
Initial Configuration
Initial Configuration
Before you can use Firepower Chassis Manager or the FXOS CLI to configure and manage your system, you must perform some initial configuration tasks using the FXOS CLI accessed through the console port. The first time that you access the FXOS chassis using the FXOS CLI, you will encounter a setup wizard that you can use to configure the system.
You can choose to either restore the system configuration from an existing backup file, or manually set up the system by going through the Setup wizard. If you choose to restore the system, the backup file must be reachable from the management network.
You must specify only one IPv4 address, gateway, and subnet mask, or only one IPv6 address, gateway, and network prefix for the single management port on the FXOS chassis. You can configure either an IPv4 or an
IPv6 address for the management port IP address.
Before You Begin
1
Verify the following physical connections on the FXOS chassis:
• The console port is physically connected to a computer terminal or console server.
• The 1 Gbps Ethernet management port is connected to an external hub, switch, or router.
For more information, refer to the Cisco Firepower Security Appliance Hardware Installation Guide .
2
Verify that the console port parameters on the computer terminal (or console server) attached to the console port are as follows:
• 9600 baud
• 8 data bits
• No parity
• 1 stop bit
Procedure
Step 1
Connect to the console port.
Step 2
Power on the FXOS chassis.
You will see the power on self-test messages as the FXOS chassis boots.
Step 3
When the unconfigured system boots, a setup wizard prompts you for the following information required to configure the system:
• Setup mode (restore from full system backup or initial setup)
• Strong password enforcement policy (for strong password guidelines, see
)
• Admin password
• System name
• Management port IPv4 address and subnet mask, or IPv6 address and prefix
6
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Getting Started
Initial Configuration
• Default gateway IPv4 or IPv6 address
• DNS Server IPv4 or IPv6 address
• Default domain name
Step 4
Review the setup summary and enter yes to save and apply the settings, or enter no to go through the Setup wizard again to change some of the settings.
If you choose to go through the Setup wizard again, the values you previously entered appear in brackets. To accept previously entered values, press Enter.
The following example sets up a configuration using IPv4 management addresses:
Enter the setup mode; setup newly or restore from backup. (setup/restore) ?
setup
You have chosen to setup a new Fabric interconnect. Continue? (y/n):
y
Enforce strong password? (y/n) [y]:
n
Enter the password for "admin":
adminpassword%958
Confirm the password for "admin":
adminpassword%958
Enter the system name:
foo
Physical Switch Mgmt0 IP address :
192.168.10.10
Physical Switch Mgmt0 IPv4 netmask:
255.255.255.0
IPv4 address of the default gateway:
192.168.10.1
Configure the DNS Server IP address? (yes/no) [n]:
yes
DNS IP address:
20.10.20.10
Configure the default domain name? (yes/no) [n]:
yes
Default domain name:
domainname.com
Following configurations will be applied:
Switch Fabric=A
System Name=foo
Enforce Strong Password=no
Physical Switch Mgmt0 IP Address=192.168.10.10
Physical Switch Mgmt0 IP Netmask=255.255.255.0
Default Gateway=192.168.10.1
IPv6 value=0
DNS Server=20.10.20.10
Domain Name=domainname.com
Apply and save the configuration (select 'no' if you want to re-enter)? (yes/no):
yes
The following example sets up a configuration using IPv6 management addresses:
Enter the setup mode; setup newly or restore from backup. (setup/restore) ?
setup
You have chosen to setup a new Fabric interconnect. Continue? (y/n):
y
Enforce strong password? (y/n) [y]:
n
Enter the password for "admin":
adminpassword%652
Confirm the password for "admin":
adminpassword%652
Enter the system name:
foo
Physical Switch Mgmt0 IP address :
2001::107
Physical Switch Mgmt0 IPv6 prefix:
64
IPv6 address of the default gateway:
2001::1
Configure the DNS Server IPv6 address? (yes/no) [n]:
yes
DNS IP address:
2001::101
Configure the default domain name? (yes/no) [n]:
yes
Default domain name:
domainname.com
Following configurations will be applied:
Switch Fabric=A
System Name=foo
Enforced Strong Password=no
Physical Switch Mgmt0 IPv6 Address=2001::107
Physical Switch Mgmt0 IPv6 Prefix=64
Default Gateway=2001::1
Ipv6 value=1
DNS Server=2001::101
Domain Name=domainname.com
Apply and save the configuration (select 'no' if you want to re-enter)? (yes/no):
yes
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
7
Getting Started
Log In or Out of the Firepower Chassis Manager
Log In or Out of the Firepower Chassis Manager
Procedure
Step 1
To log in to the Firepower Chassis Manager: a) Using a supported browser, enter the following URL in the address bar: https://<chassis_mgmt_ip_address> where <chassis_mgmt_ip_address> is the IP address or host name of the FXOS chassis that you entered during initial configuration.
Note
For information on supported browsers, refer to the release notes for the version you are using
(see http://www.cisco.com/c/en/us/support/security/firepower-9000-series/ products-release-notes-list.html
).
b) Enter your username and password.
c) Click Login.
You are logged in and the Firepower Chassis Manager opens to show the Overview page.
Step 2
To log out of the Firepower Chassis Manager, point at your username in the navigation bar and then select
Logout.
You are logged out of the Firepower Chassis Manager and are returned to the login screen.
Accessing the FXOS CLI
You can connect to the FXOS CLI using a terminal plugged into the console port. Verify that the console port parameters on the computer terminal (or console server) attached to the console port are as follows:
• 9600 baud
• 8 data bits
• No parity
• 1 stop bit
You can also connect to the FXOS CLI using SSH and Telnet. The Firepower eXtensible Operating System supports up to eight simultaneous SSH connections. To connect with SSH, you need to know the hostname or IP address of the FXOS chassis.
Use one of the following syntax examples to log in with SSH, Telnet, or Putty:
Note
SSH log in is case-sensitive.
From a Linux terminal using SSH:
• ssh ucs-auth-domain\\username@{UCSM-ip-address|UCMS-ipv6-address}
ssh ucs-example\\[email protected]
ssh ucs-example\\jsmith@2001::1
8
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Getting Started
Accessing the FXOS CLI
• ssh -l ucs-auth-domain\\username {UCSM-ip-address| UCSM-ipv6-address| UCSM-host-name}
ssh -l ucs-example\\jsmith 192.0.20.11
ssh -l ucs-example\\jsmith 2001::1
• ssh {UCSM-ip-address | UCSM-ipv6-address | UCSM-host-name} -l ucs-auth-domain\\username
ssh 192.0.20.11 -l ucs-example\\jsmith ssh 2001::1 -l ucs-example\\jsmith
• ssh ucs-auth-domain\\username@{UCSM-ip-address|UCSM-ipv6-address}
ssh ucs-ldap23\\[email protected]
ssh ucs-ldap23\\jsmith@2001::1
From a Linux terminal using Telnet:
Note
Telnet is disabled by default. See
Configuring Telnet, on page 39
for instructions on enabling Telnet.
• telnet ucs-UCSM-host-name ucs-auth-domain\username
telnet ucs-qa-10
login:
ucs-ldap23\blradmin
• telnet ucs-{UCSM-ip-address|UCSM-ipv6-address}ucs-auth-domain\username
telnet 10.106.19.12 2052
ucs-qa-10-A login:
ucs-ldap23\blradmin
From a Putty client:
• Login as: ucs-auth-domain\username
Login as:
ucs-example\jsmith
Note
If the default authentication is set to local, and the console authentication is set to LDAP, you can log in to the fabric interconnect from a Putty client using ucs-local\admin, where admin is the name of the local account.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
9
Accessing the FXOS CLI
Getting Started
10
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
3
License Management
Cisco Smart Software Licensing lets you purchase and manage a pool of licenses centrally. You can easily deploy or retire devices without having to manage each unit’s license key. Smart Software Licensing also lets you see your license usage and needs at a glance.
•
About Smart Software Licensing, page 11
•
Prerequisites for Smart Software Licensing, page 13
•
Defaults for Smart Software Licensing, page 14
•
Configure Smart Software Licensing, page 14
•
Smart License Manager Satellite for the FXOS chassis, page 15
•
History for Smart Software Licensing, page 16
About Smart Software Licensing
This section describes how Smart Software Licensing works.
Note
This section only applies to ASA logical devices on the FXOS chassis. For more information on licensing for Firepower Threat Defense logical devices, see the Firepower Management Center Configuration Guide.
Smart Software Licensing for Applications on the FXOS Chassis
For the application on the FXOS chassis, Smart Software Licensing configuration is split between the FXOS chassis supervisor and the application.
• FXOS chassis—Configure all Smart Software Licensing infrastructure in the supervisor, including parameters for communicating with the License Authority. The FXOS chassis itself does not require any licenses to operate.
For offline licensing, you can deploy a Cisco Smart Software Manager satellite server that is accessible to your local network, and that syncs with the License Authority on demand or on a schedule you set.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
11
License Management
Smart Software Manager and Accounts
• Application—Configure all license entitlements in the application.
Smart Software Manager and Accounts
When you purchase 1 or more licenses for the device, you manage them in the Cisco Smart Software Manager: https://software.cisco.com/#module/SmartLicensing
The Smart Software Manager lets you create a master account for your organization.
Note
If you do not yet have an account, click the link to set up a new account . The Smart Software Manager lets you create a master account for your organization.
By default, your licenses are assigned to the Default Virtual Account under your master account. As the account administrator, you can optionally create additional virtual accounts; for example, you can create accounts for regions, departments, or subsidiaries. Multiple virtual accounts let you more easily manage large numbers of licenses and devices.
Licenses and Devices Managed per Virtual Account
Licenses and devices are managed per virtual account: only that virtual account’s devices can use the licenses assigned to the account. If you need additional licenses, you can transfer an unused license from another virtual account. You can also transfer devices between virtual accounts.
Only the FXOS chassis registers as a device, while the applications in the chassis request their own licenses.
For example, for a Firepower 9300 chassis with 3 security modules, the chassis counts as one device, but the modules use 3 separate licenses.
Device Registration and Tokens
For each virtual account, you can create a registration token. This token is valid for 30 days by default. Enter this token ID plus entitlement levels when you deploy each device, or when you register an existing device.
You can create a new token if an existing token is expired.
Note
Device registration is configured in the FXOS chassis supervisor, not on the security module.
At startup after deployment, or after you manually configure these parameters on an existing device, the device registers with the Cisco License Authority. When the device registers with the token, the License Authority issues an ID certificate for communication between the device and the License Authority. This certificate is valid for 1 year, although it will be renewed every 6 months.
12
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
License Management
Periodic Communication with the License Authority
Periodic Communication with the License Authority
The device communicates with the License Authority every 30 days. If you make changes in the Smart Software
Manager, you can refresh the authorization on the device so the change takes place immediately. Or you can wait for the device to communicate as scheduled.
You can optionally configure an HTTP proxy.
The FXOS chassis must have Internet access either directly or through an HTTP proxy at least every 90 days.
Normal license communication occurs every 30 days, but with the grace period, your device will operate for up to 90 days without calling home. After the grace period, you must contact the Licensing Authority, or you will not be able to make configuration changes to features requiring special licenses; operation is otherwise unaffected.
Note
Offline licensing is not supported.
Out-of-Compliance State
The device can become out of compliance in the following situations:
• Over-utilization—When the device uses unavailable licenses.
• License expiration—When a time-based license expires.
• Lack of communication—When the device cannot reach the Licensing Authority for re-authorization.
To verify whether your account is in, or approaching, an Out-of-Compliance state, you must compare the entitlements currently in use by your FXOS chassis against those in your Smart Account.
In an out-of-compliance state, the device will be limited in some way, depending on the application.
Smart Call Home Infrastructure
By default, a Smart Call Home profile exists in the configuration that specifies the URL for the Licensing
Authority. You cannot remove this profile. Note that the only configurable option for the License profile is the destination address URL for the License Authority. Unless directed by Cisco TAC, you should not change the License Authority URL.
You cannot disable Smart Call Home for Smart Software Licensing.
Prerequisites for Smart Software Licensing
• Create a master account on the Cisco Smart Software Manager: https://software.cisco.com/#module/SmartLicensing
If you do not yet have an account, click the link to set up a new account . The Smart Software Manager lets you create a master account for your organization.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
13
License Management
Defaults for Smart Software Licensing
• Purchase 1 or more licenses from Cisco Software Central.
• Ensure Internet access or HTTP proxy access from the device, so the device can contact the Licensing
Authority. Offline licensing is not supported.
• Configure a DNS server so the device can resolve the name of the licensing authority server.
• Set the clock for the device.
• Note that this section only applies to ASA logical devices on the FXOS chassis. For more information on licensing for Firepower Threat Defense logical devices, see the Firepower Management Center
Configuration Guide.
Defaults for Smart Software Licensing
The FXOS chassis default configuration includes a Smart Call Home profile called “SLProf” that specifies the URL for the Licensing Authority.
Configure Smart Software Licensing
To communicate with the Cisco License Authority, you can optionally configure an HTTP proxy. To register with the License Authority, you must enter the registration token ID on the FXOS chassis that you obtained from your Smart Software License account.
Procedure
Step 1
(Optional) Configure the HTTP Proxy, on page 14
.
Step 2
Register the Firepower Security Appliance with the License Authority, on page 15
.
(Optional) Configure the HTTP Proxy
If your network uses an HTTP proxy for Internet access, you must configure the proxy address for Smart
Software Licensing. This proxy is also used for Smart Call Home in general.
Note
HTTP proxy with authentication is not supported.
Procedure
Step 1
Choose System > Licensing > Call Home.
The Call Home page provides fields for configuring the destination address URL for the License Authority and for configuring an HTTP proxy.
Note
Unless directed by Cisco TAC, you should not change the License Authority
URL.
14
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
License Management
Register the Firepower Security Appliance with the License Authority
Step 2
In the Server Enable drop-down list, select on.
Step 3
Enter the proxy IP address and port in the Server URL and Server Port fields. For example, enter port 443 for an HTTPS server.
Step 4
Click Save.
Register the Firepower Security Appliance with the License Authority
When you register the FXOS chassis, the License Authority issues an ID certificate for communication between the FXOS chassis and the License Authority. It also assigns the FXOS chassis to the appropriate virtual account. Normally, this procedure is a one-time instance. However, you might need to later re-register the
FXOS chassis if the ID certificate expires because of a communication problem, for example.
Procedure
Step 1
In the Smart Software Manager, request and copy a registration token for the virtual account to which you want to add this FXOS chassis.
Step 2
In Firepower Chassis Manager, choose System > Licensing > Smart License.
Step 3
Enter the registration token in the Enter Product Instance Registration Token field.
Step 4
Click Register.
The FXOS chassis attempts to register with the License Authority.
To unregister the device, click Unregister.
Deregistering the FXOS chassis removes the device from your account. All license entitlements and certificates on the device are removed. You might want to deregister to free up a license for a new FXOS chassis.
Alternatively, you can remove the device from the Smart Software Manager.
Smart License Manager Satellite for the FXOS chassis
Cisco Smart Software Manager satellite is a component of Cisco Smart Licensing that works in conjunction with Cisco Smart Software Manager (SSM) . It helps you intelligently manage customer product licenses, providing near real-time visibility and reporting of Cisco licenses that customers purchase and consume.
Customers who, either for policy or network reachability reasons, do not want to manage their Cisco products directly using the Cisco Smart Software Manager residing at software.cisco.com, can choose to install the
Cisco Smart Software Manager satellite on-premises. When enabled, the FXOS chassis sends report license consumption to the Smart Software Manager satellite as though it were a replicate of the Cisco Smart Software
Manager hosted within your premises.
Once you download and deploy the satellite application, you can perform the following functions without sending data to Cisco SSM using the Internet:
• Activate or register a license
• View your company's licenses
• Transfer licenses between company entities
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
15
License Management
Configure a Smart License Satellite Server for the FXOS chassis
For more information, see the Smart Software Manager satellite installation and configuration guides on Smart
Account Manager satellite .
Configure a Smart License Satellite Server for the FXOS chassis
The following procedure shows how to configure the FXOS chassis to use a Smart Licence Manager satellite.
Before You Begin
• Complete all prerequisites listed in the
Prerequisites for Smart Software Licensing, on page 13
.
• Download the Smart License Satellite OVA file from Cisco.com and install and configure it on a
VMwareESXi server. For more information, see the Smart Software Manager satellite Install Guide .
Procedure
Step 1
Choose System > Licensing > Call Home.
Step 2
Under Call home Configuration, replace the default URL in the Address field with the satellite URL.
Step 3
Create a new trust point using the CLI. (See the Smart License Satellite manager configuration steps in the
FXOS CLI Configuration Guide for more information).
Step 4
Register the Firepower Security Appliance with the License Authority, on page 15
. Note that you must request and copy the registration token from the Smart License Manager satellite.
History for Smart Software Licensing
Feature Name Description
Cisco Smart Software Licensing for the FXOS chassis
Platform
Releases
1.1(1) Smart Software Licensing lets you purchase and manage a pool of licenses. Smart licenses are not tied to a specific serial number. You can easily deploy or retire devices without having to manage each unit’s license key. Smart Software Licensing also lets you see your license usage and needs at a glance. Smart
Software Licensing configuration is split between the FXOS chassis supervisor and the security module.
We introduced the following screens:
System > Licensing > Call Home
System > Licensing > Smart License
16
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
4
User Management
•
•
Guidelines for Usernames, page 18
•
Guidelines for Passwords, page 19
•
Guidelines for Remote Authentication, page 19
•
•
Password Profile for Locally Authenticated Users, page 22
•
Configuring User Settings, page 23
•
Set the Maximum Number of Login Attempts, page 25
•
Creating a Local User Account, page 26
•
Deleting a Local User Account, page 28
•
Activating or Deactivating a Local User Account, page 28
User Accounts
User accounts are used to access the system. You can configure up to 48 local user accounts. Each user account must have a unique username and password.
Admin Account
The admin account is a default user account and cannot be modified or deleted. This account is the system administrator or superuser account and has full privileges. There is no default password assigned to the admin account; you must choose the password during the initial system setup.
The admin account is always active and does not expire. You cannot configure the admin account as inactive.
Locally Authenticated User Accounts
A locally authenticated user account is authenticated directly through the chassis and can be enabled or disabled by anyone with admin or AAA privileges. Once a local user account is disabled, the user cannot log in.
Configuration details for disabled local user accounts are not deleted by the database. If you reenable a disabled
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
17
User Management
Guidelines for Usernames
local user account, the account becomes active again with the existing configuration, including username and password.
Remotely Authenticated User Accounts
A remotely authenticated user account is any user account that is authenticated through LDAP, RADIUS, or
TACACS+.
If a user maintains a local user account and a remote user account simultaneously, the roles defined in the local user account override those maintained in the remote user account.
See the following topics for more information on guidelines for remote authentication, and how to configure and delete remote authentication providers:
•
Guidelines for Remote Authentication, on page 19
•
Configuring LDAP Providers, on page 58
•
Configuring RADIUS Providers, on page 61
•
Configuring TACACS+ Providers, on page 63
Expiration of User Accounts
You can configure user accounts to expire at a predefined time. When the expiration time is reached, the user account is disabled.
By default, user accounts do not expire.
After you configure a user account with an expiration date, you cannot reconfigure the account to not expire.
You can, however, configure the account with the latest expiration date available.
Guidelines for Usernames
The username is also used as the login ID for Firepower Chassis Manager and the FXOS CLI. When you assign login IDs to user accounts, consider the following guidelines and restrictions:
• The login ID can contain between 1 and 32 characters, including the following:
◦Any alphabetic character
◦Any digit
◦_ (underscore)
◦- (dash)
◦. (dot)
• The login ID must be unique.
• The login ID must start with an alphabetic character. It cannot start with a number or a special character, such as an underscore.
• The login ID is case-sensitive.
• You cannot create an all-numeric login ID.
18
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
User Management
Guidelines for Passwords
• After you create a user account, you cannot change the login ID. You must delete the user account and create a new one.
Guidelines for Passwords
A password is required for each locally authenticated user account. A user with admin or AAA privileges can configure the system to perform a password strength check on user passwords. If the password strength check is enabled, each user must have a strong password.
We recommend that each user have a strong password. If you enable the password strength check for locally authenticated users, the Firepower eXtensible Operating System rejects any password that does not meet the following requirements:
• Must contain a minimum of 8 characters and a maximum of 80 characters.
• Must contain at least three of the following:
◦At least one uppercase alphabetic character
◦At least one lowercase alphabetic character
◦At least one non-alphanumeric (special) character
◦Digits
• Must not contain a character that is repeated more than 3 times consecutively, such as aaabbb.
• Must not contain three consecutive numbers or letters in any order, such as passwordABC or password321.
• Must not be identical to the username or the reverse of the username.
• Must pass a password dictionary check. For example, the password must not be based on a standard dictionary word.
• Must not contain the following symbols: $ (dollar sign), ? (question mark), and = (equals sign).
• Must not be blank for local user and admin accounts.
Guidelines for Remote Authentication
If a system is configured for one of the supported remote authentication services, you must create a provider for that service to ensure that the FXOS chassis can communicate with the system. The following guidelines impact user authorization:
User Accounts in Remote Authentication Services
User accounts can exist locally in the FXOS chassis or in the remote authentication server.
You can view the temporary sessions for users who log in through remote authentication services from the FXOS Chassis Manager GUI and from the FXOS CLI.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
19
User Management
Guidelines for Remote Authentication
User Roles in Remote Authentication Services
If you create user accounts in the remote authentication server, you must ensure that the accounts include the roles those users require for working in the FXOS chassis and that the names of those roles match the names used in FXOS. Based on the role policy, a user might not be allowed to log in, or is granted only read-only privileges.
User Attributes in Remote Authentication Providers
For RADIUS and TACAS+ configurations, you must configure a user attribute for the FXOS chassis in each remote authentication provider through which users log in to Firepower Chassis Manager and the FXOS CLI.
This user attribute holds the roles and locales assigned to each user.
When a user logs in, FXOS does the following:
1
Queries the remote authentication service.
2
Validates the user.
3
If the user is validated, checks the roles and locales assigned to that user.
The following table contains a comparison of the user attribute requirements for the remote authentication providers supported by FXOS:
Authenication Provider
LDAP
Custom Attribute
Optional
Schema Extension Attribute ID Requirements
You can choose to do one of the following:
The Cisco LDAP implementation requires a unicode type attribute.
• Do not extend the
LDAP schema and configure an existing, unused attribute that meets the requirements.
If you choose to create the
CiscoAVPair custom attribute, use the following attribute ID:
1.3.6.1.4.1.9.287247.1
A sample OID is provided in the following section.
• Extend the LDAP schema and create a custom attribute with a unique name, such as
CiscoAVPair.
20
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
User Management
Guidelines for Remote Authentication
Authenication Provider
RADIUS
TACAS
Custom Attribute
Optional
Required
Schema Extension Attribute ID Requirements
You can choose to do one of the following:
• Do not extend the
RADIUS schema and use an existing, unused attribute that meets the requirements.
• Extend the
RADIUS schema and create a custom attribute with a unique name, such as cisco-avpair.
The vendor ID for the
Cisco RADIUS implementation is 009 and the vendor ID for the attribute is 001.
The following syntax example shows how to specify multiples user roles and locales if you choose to create the cisco-avpair attribute: shell:roles="admin,aaa" shell:locales="L1,abc"
.
Use a comma "," as the delimiter to separate multiple values.
You must extend the schema and create a custom attribute with the name cisco-av-pair.
The cisco-av-pair name is the string that provides the attribute ID for the
TACACS+ provider.
The following syntax example shows how to specify multiples user roles and locales when you create the cisco-av-pair attribute: cisco-av-pair=shell:roles="admin aaa" shell:locales*"L1 abc"
. Using an asterisk
(*) in the cisco-av-pair attribute syntax flags the locale as optional, preventing authentication failures for other Cisco devices that use the same authorization profile. Use a space as the delimiter to separate multiple values.
Sample OID for LDAP User Attribute
The following is a sample OID for a custom CiscoAVPair attribute:
CN=CiscoAVPair,CN=Schema,
CN=Configuration,CN=X
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
21
User Management
User Roles
objectClass: top objectClass: attributeSchema cn: CiscoAVPair distinguishedName: CN=CiscoAVPair,CN=Schema,CN=Configuration,CN=X instanceType: 0x4 uSNCreated: 26318654 attributeID: 1.3.6.1.4.1.9.287247.1
attributeSyntax: 2.5.5.12
isSingleValued: TRUE showInAdvancedViewOnly: TRUE adminDisplayName: CiscoAVPair adminDescription: UCS User Authorization Field oMSyntax: 64 lDAPDisplayName: CiscoAVPair name: CiscoAVPair objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,CN=X
User Roles
The system contains the following user roles:
Administrator
Complete read-and-write access to the entire system. The default admin account is assigned this role by default and it cannot be changed.
Read-Only
Read-only access to system configuration with no privileges to modify the system state.
Password Profile for Locally Authenticated Users
The password profile contains the password history and password change interval properties for all locally authenticated users. You cannot specify a different password profile for each locally authenticated user.
Password History Count
The password history count allows you to prevent locally authenticated users from reusing the same password over and over again. When this property is configured, the Firepower chassis stores passwords that were previously used by locally authenticated users up to a maximum of 15 passwords. The passwords are stored in reverse chronological order with the most recent password first to ensure that the only the oldest password can be reused when the history count threshold is reached.
A user must create and use the number of passwords configured in the password history count before being able to reuse one. For example, if you set the password history count to 8, a locally authenticated user cannot reuse the first password until after the ninth password has expired.
By default, the password history is set to 0. This value disables the history count and allows users to reuse previously passwords at any time.
If necessary, you can clear the password history count for a locally authenticated user and enable reuse of previous passwords.
22
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
User Management
Configuring User Settings
Password Change Interval
The password change interval enables you to restrict the number of password changes a locally authenticated user can make within a given number of hours. The following table describes the two configuration options for the password change interval.
Interval Configuration
No password change allowed
Description
This option does not allow passwords for locally authenticated users to be changed within a specified number of hours after a password change.
You can specify a no change interval between 1 and 745 hours. By default, the no change interval is 24 hours.
Example
For example, to prevent passwords from being changed within 48 hours after a locally authenticated user changes his or her password, set the following:
• Change during interval to disable
• No change interval to 48
Password changes allowed within change interval
This option specifies the maximum number of times that passwords for locally authenticated users can be changed within a pre-defined interval.
You can specify a change interval between 1 and 745 hours and a maximum number of password changes between 0 and 10. By default, a locally authenticated user is permitted a maximum of 2 password changes within a 48 hour interval.
For example, to allow a password to be changed a maximum of once within 24 hours after a locally authenticated user changes his or her password, set the following:
• Change during interval to enable
• Change count to 1
• Change interval to 24
Configuring User Settings
Procedure
Step 1
Choose System > User Management.
Step 2
Click the Settings tab.
Step 3
Complete the following fields with the required information:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
23
User Management
Configuring User Settings
Name
Default Authentication field
Description
The default method by which a user is authenticated during remote login. This can be one of the following:
• Local—The user account must be defined locally on the Firepower chassis.
• Radius—The user account must be defined on the RADIUS server specified for the Firepower chassis.
• TACACS—The user account must be defined on the TACACS+ server specified for the Firepower chassis.
• LDAP—The user account must be defined on the LDAP/MS-AD server specified for the Firepower chassis.
• None—If the user account is local to the Firepower chassis, no password is required when the user logs in remotely.
Remote User Settings
Remote User Role Policy Controls what happens when a user attempts to log in and the remote authentication provider does not supply a user role with the authentication information:
• Assign Default Role—The user is allowed to log in with a read-only user role.
• No-Login—The user is not allowed to log in to the system, even if the username and password are correct.
Local User Settings
Password Strength Check check box
If checked, all local user passwords must conform to the guidelines for a strong password (see
Guidelines for Passwords, on page 19
).
History Count field The number of unique passwords a user must create before the user can reuse a previously used password. The history count is in reverse chronological order with the most recent password first to ensure that only the oldest password can be reused when the history count threshold is reached.
This value can be anywhere from 0 to 15.
You can set the History Count field to 0 to disable the history count and allow users to reuse previously used passwords at any time.
24
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
User Management
Set the Maximum Number of Login Attempts
Name
Change During Interval field
Description
Controls when a locally authenticated user can change his or her password. This can be:
• Enable—Locally authenticated users can change their passwords based on the settings for Change Interval and Change Count.
• Disable—Locally authenticated users cannot change their passwords for the period of time specified for No Change Interval.
Change Interval field
Change Count field
No Change Interval field
The number of hours over which the number of password changes specified in the Change Count field are enforced.
This value can be anywhere from 1 to 745 hours.
For example, if this field is set to 48 and the Change Count field is set to 2, a locally authenticated user can make no more than 2 password changes within a 48 hour period.
The maximum number of times a locally authenticated user can change his or her password during the Change Interval.
This value can be anywhere from 0 to 10.
The minimum number of hours that a locally authenticated user must wait before changing a newly created password.
This value can be anywhere from 1 to 745 hours.
This interval is ignored if the Change During Interval property is not set to Disable.
Step 4
Click Save.
Set the Maximum Number of Login Attempts
You can configure the maximum number of failed login attempts allowed before a user is locked out of the
FXOS chassis for a specified amount of time. If a user exceeds the set maximum number of login attempts, the user is locked out of the system. No notification appears indicating that the user is locked out. In this event, the user must wait the specified amount of time before attempting to log in.
Perform these steps to configure the maximum number of login attempts.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
25
User Management
Creating a Local User Account
Note
•
• The default maximum number of unsuccessful login attempts is 3. The default amount of time the user is locked out of the system after exceeding the maximum number of login attemps is 30 minutes
(3600 seconds).
Procedure
Step 1
From the FXOS CLI, enter security mode:
scope system scope security
Step 2
Set the maximum number of unsuccessful login attempts.
set max-login-attempts
max_login
Step 3
Specify the amount of time (in seconds) the user should remain locked out of the system after reaching the maximum number of login attempts:
set user-account-unlock-time
unlock_time
Step 4
Commit the configuration:
commit-buffer
Creating a Local User Account
Procedure
Step 1
Choose System > User Management.
Step 2
Click the Local Users tab.
Step 3
Click Add User to open the Add User dialog box.
Step 4
Complete the following fields with the required information about the user:
Name Description
User Name field The account name that is used when logging into this account. This name must be unique and meet the guidelines and restrictions for user account names (see
Guidelines for Usernames, on page 18
).
After you save the user, the login ID cannot be changed. You must delete the user account and create a new one.
First Name field The first name of the user. This field can contain up to 32 characters.
26
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
User Management
Creating a Local User Account
Name
Last Name field
Email field
Phone Number field
Password field
Confirm Password field
Account Status field
User Role drop-down list
Account Expires check box
Expiry Date field
Description
The last name of the user. This field can contain up to 32 characters.
The email address for the user.
The telephone number for the user.
The password associated with this account. If password strength check is enabled, a user's password must be strong and the Firepower eXtensible Operating System rejects any password that does not meet the strength check requirements (see
Guidelines for Passwords, on page
19 ).
The password a second time for confirmation purposes.
If the status is set to Active, a user can log into Firepower Chassis
Manager and the FXOS CLI with this login ID and password.
The role that represents the privileges you want to assign to the user account (see
).
Note
Changes in user roles and privileges do not take effect until the next time the user logs in. If a user is logged in when you assign a new role to or remove an existing role from a user account, the active session continues with the previous roles and privileges.
If checked, this account expires and cannot be used after the date specified in the Expiration Date field.
Note
After you configure a user account with an expiration date, you cannot reconfigure the account to not expire. You can, however, configure the account with the latest expiration date available.
The date on which the account expires. The date should be in the format yyyy-mm-dd.
Click the calendar icon at the end of this field to view a calendar that you can use to select the expiration date.
Step 5
Click Add.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
27
User Management
Deleting a Local User Account
Deleting a Local User Account
Procedure
Step 1
Choose System > User Management.
Step 2
Click the Local Users tab.
Step 3
In the row for the user account that you want to delete, click Delete.
Step 4
In the Confirm dialog box, click Yes.
Activating or Deactivating a Local User Account
You must be a user with admin or AAA privileges to activate or deactivate a local user account.
Procedure
Step 1
Choose System > User Management.
Step 2
Click the Local Users tab.
Step 3
In the row for the user account that you want to activate or deactivate, click Edit (pencil icon).
Step 4
In the Edit User dialog box, do one of the following:
• To activate a user account, click the Active radio button in the Account Status field.
• To deactivate a user account, click the Inactive radio button in the Account Status field.
The admin user account is always set to active. It cannot be modified.
Step 5
Click Save.
28
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
5
Image Management
•
About Image Management, page 29
•
Downloading Images from Cisco.com, page 30
•
Uploading an Image to the Firepower Security Appliance, page 30
•
Verifying the Integrity of an Image, page 30
•
Upgrading the Firepower eXtensible Operating System Platform Bundle, page 31
•
Updating the Image Version for a Logical Device, page 31
•
About Image Management
The FXOS chassis uses two basic types of images:
Note
All images are digitally signed and validated through Secure Boot. Do not modify the image in any way or you will receive a validation error.
• Platform Bundle—The Firepower platform bundle is a collection of multiple independent images that operate on the Firepower Supervisor and Firepower security module/engine. The platform bundle is a
Firepower eXtensible Operating System software package.
• Application—Application images are the software images you want to deploy on the security module/engine of the FXOS chassis. Application images are delivered as Cisco Secure Package files
(CSP) and are stored on the supervisor until deployed to a security module/engine as part of logical device creation or in preparation for later logical device creation. You can have multiple different versions of the same application image type stored on the Firepower Supervisor.
Note
If you are upgrading both the Platform Bundle image and one or more Application images, you must upgrade the Platform Bundle first.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
29
Image Management
Downloading Images from Cisco.com
Downloading Images from Cisco.com
Before You Begin
You must have a Cisco.com account.
Procedure
Step 1
Choose System > Updates.
The Available Updates page shows a list of the FXOS platform bundle images and application images that are available on the chassis.
Step 2
Click the Download latest updates from CCO link at the bottom of the page.
The software download page for the FXOS chassis is opened in a new tab within the browser.
Step 3
Find and then download the appropriate software image to your local computer.
Uploading an Image to the Firepower Security Appliance
Before You Begin
Make sure the image you want to upload is available on your local computer.
Procedure
Step 1
Choose System > Updates.
The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.
Step 2
Click Upload Image to open the Upload Image dialog box.
Step 3
Click Browse to navigate to and select the image that you want to upload.
Step 4
Click Upload.
The selected image is uploaded to the FXOS chassis.
Step 5
For certain software images you will be presented with an end-user license agreement after uploading the image. Follow the system prompts to accept the end-user license agreement.
Verifying the Integrity of an Image
The integrity of the image is automatically verified when a new image is added to the FXOS chassis. If needed, you can use the following procedure to manually verify the integrity of an image.
30
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Image Management
Upgrading the Firepower eXtensible Operating System Platform Bundle
Procedure
Step 1
Choose System > Updates.
The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.
Step 2
Click Verify (check mark icon) for the image you want to verify.
The system will verify the integrity of the image and display the staus in the Image Integrity field.
Upgrading the Firepower eXtensible Operating System Platform
Bundle
Before You Begin
Download the platform bundle software image from Cisco.com (see
Downloading Images from Cisco.com,
on page 30 ) and then upload that image to the FXOS chassis (see
Uploading an Image to the Firepower
Security Appliance, on page 30
).
Procedure
Step 1
Choose System > Updates.
The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.
Step 2
Click Upgrade for the FXOS platform bundle to which you want to upgrade.
The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package.
It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.
Step 3
Click Yes to confirm that you want to proceed with installation, or click No to cancel the installation.
The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components.
Updating the Image Version for a Logical Device
Before You Begin
Download the application image you want to use for the logical device from Cisco.com (see
Images from Cisco.com, on page 30
) and then upload that image to the FXOS chassis (see
Image to the Firepower Security Appliance, on page 30
).
If you are upgrading both the Platform Bundle image and one or more Application images, you must upgrade the Platform Bundle first.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
31
Image Management
Firmware Upgrade
Procedure
Step 1
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 2
Click Update Version for the logical device that you want to update to open the Update Image Version dialog box.
Step 3
For the New Version, choose the software version to which you want to update.
Step 4
Click OK.
Firmware Upgrade
Use the following procedure to upgrade the firmware on your FXOS chassis.
Procedure
Step 1
Using a web browser, navigate to http://www.cisco.com/go/firepower9300-software or http://www.cisco.com/ go/firepower4100-software .
The software download page for the FXOS chassis is opened in the browser.
Step 2
Find and then download the appropriate firmware package from Cisco.com to a server that you can access from the FXOS chassis.
Step 3
On the FXOS chassis, enter firmware mode: fxos-chassis # scope firmware
Step 4
Download the FXOS firmware image to the FXOS chassis: fxos-chassis /firmware # download image URL
Specify the URL for the file being imported using one of the following syntax:
• ftp:// username@hostname / path
• scp:// username@hostname / path
• sftp:// username@hostname / path
• tftp:// hostname : port-num / path
Step 5
To monitor the download process: fxos-chassis /firmware # show download task image_name detail
Step 6
After the download has completed, you can enter the following command to view the contents of the firmware package: fxos-chassis /firmware # show package image_name expand
Step 7
You can enter the following command to view the version number of the firmware package: fxos-chassis /firmware # show package
This version number is used in the following step when installing the firmware package.
32
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Image Management
Firmware Upgrade
Step 8
To install the firmware package: a) Enter firmware-install mode: fxos-chassis /firmware # scope firmware-install b) Install the firmware package: fxos-chassis /firmware/firmware-install # install firmware pack-version version_number
The system will verify the firmware package and will notify you that the verification process can take several minutes to complete.
c) Enter yes to proceed with the verification.
After verifying the firmware package, the system will notify you that the installation process can take several minutes to complete and that the system will reboot during the update process.
d) Enter yes to proceed with the installation. Do not power cycle the FXOS chassis during the upgrade process.
Step 9
To monitor the upgrade process: fxos-chassis /firmware/firmware-install # show detail
Step 10 After the installation has completed, you can enter the following commands to view the current firmware version: fxos-chassis /firmware/firmware-install # top fxos-chassis # scope chassis 1 fxos-chassis /firmware # show sup version
The following example upgrades the firmware to version 1.0.10: fxos-chassis#
scope firmware
fxos-chassis /firmware #
download image tftp://10.10.10.1/fxos-k9-fpr9k-firmware.1.0.10.SPA
fxos-chassis /firmware #
show download-task fxos-k9-fpr9k-firmware.1.0.10.SPA detail
Download task:
File Name: fxos-k9-fpr9k-firmware.1.0.10.SPA
Protocol: Tftp
Server: 10.10.10.1
Port: 0
Userid:
Path:
Downloaded Image Size (KB): 2104
Time stamp: 2015-12-04T23:51:57.846
State: Downloading
Transfer Rate (KB/s): 263.000000
Current Task: unpacking image fxos-k9-fpr9k-firmware.1.0.10.SPA on primary(
FSM-STAGE:sam:dme:FirmwareDownloaderDownload:UnpackLocal) fxos-chassis /firmware #
show package fxos-k9-fpr9k-firmware.1.0.10.SPA expand
Package fxos-k9-fpr9k-firmware.1.0.10.SPA:
Images: fxos-k9-fpr9k-fpga.1.0.5.bin
fxos-k9-fpr9k-rommon.1.0.10.bin
fxos-chassis /firmware #
show package
Name Version
--------------------------------------------- ------fxos-k9-fpr9k-firmware.1.0.10.SPA
1.0.10
fxos-chassis /firmware #
scope firmware-install
fxos-chassis /firmware/firmware-install #
install firmware pack-version 1.0.10
Verifying FXOS firmware package 1.0.10. Verification could take several minutes.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
33
Image Management
Firmware Upgrade
Do you want to proceed? (yes/no):yes
FXOS SUP ROMMON: Upgrade from 1.0.10 to 1.0.10
FXOS SUP FPGA : Upgrade from 1.04 to 1.05
This operation upgrades SUP firmware on Security Platform.
Here is the checklist of things that are recommended before starting the install operation
(1) Review current critical/major faults
(2) Initiate a configuration backup
Attention:
The system will be reboot to upgrade the SUP firmware.
The upgrade operation will take several minutes to complete.
PLEASE DO NOT POWER RECYCLE DURING THE UPGRADE.
Do you want to proceed? (yes/no):yes
Upgrading FXOS SUP firmware software package version 1.0.10
command executed
34
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
6
Platform Settings
•
Changing the Management IP Address, page 35
•
Setting the Date and Time, page 37
•
•
•
•
•
•
•
Configuring DNS Servers, page 68
Changing the Management IP Address
Before You Begin
You can change the management IP address on the FXOS chassis from the FXOS CLI.
Note
After changing the management IP address, you will need to reestablish any connections to Firepower
Chassis Manager or the FXOS CLI using the new address.
Procedure
Step 1
Connect to the FXOS CLI (see
Accessing the FXOS CLI, on page 8
).
Step 2
To configure an IPv4 management IP address: a) Set the scope for fabric-interconnect a:
Firepower-chassis# scope fabric-interconnect a b) To view the current management IP address, enter the following command:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
35
Platform Settings
Changing the Management IP Address
Firepower-chassis /fabric-interconnect # show c) Enter the following command to configure a new management IP address and gateway:
Firepower-chassis /fabric-interconnect # set out-of-band ip ip_address netmask network_mask gw
gateway_ip_address
d) Commit the transaction to the system configuration:
Firepower-chassis /fabric-interconnect* # commit-buffer
Step 3
To configure an IPv6 management IP address: a) Set the scope for fabric-interconnect a:
Firepower-chassis# scope fabric-interconnect a b) Set the scope for management IPv6 configuration:
Firepower-chassis /fabric-interconnect # scope ipv6-config c) To view the current management IPv6 address, enter the following command:
Firepower-chassis /fabric-interconnect/ipv6-config # show ipv6-if d) Enter the following command to configure a new management IP address and gateway:
Firepower-chassis /fabric-interconnect/ipv6-config # set out-of-band ipv6 ipv6_address ipv6-prefix
prefix_length ipv6-gw gateway_address e) Commit the transaction to the system configuration:
Firepower-chassis /fabric-interconnect/ipv6-config* # commit-buffer
The following example configures an IPv4 management interface and gateway:
Firepower-chassis#
scope fabric-interconnect a
Firepower-chassis /fabric-interconnect #
show
Fabric Interconnect:
ID OOB IP Addr OOB Gateway OOB Netmask OOB IPv6 Address OOB IPv6 Gateway
Prefix Operability
---- --------------- --------------- --------------- ---------------- ----------------
------ -----------
64
A 192.0.2.112
Operable
192.0.2.1
255.255.255.0
:: ::
Firepower-chassis /fabric-interconnect # set out-of-band ip 192.0.2.111 netmask 255.255.255.0
gw 192.0.2.1
Warning: When committed, this change may disconnect the current CLI session
Firepower-chassis /fabric-interconnect* #
commit-buffer
Firepower-chassis /fabric-interconnect #
The following example configures an IPv6 management interface and gateway:
Firepower-chassis#
scope fabric-interconnect a
Firepower-chassis /fabric-interconnect #
scope ipv6-config
Firepower-chassis /fabric-interconnect/ipv6-config #
show ipv6-if
Management IPv6 Interface:
IPv6 Address Prefix IPv6 Gateway
----------------------------------- ---------- ------------
2001::8998 64 2001::1
Firepower-chassis /fabric-interconnect/ipv6-config # set out-of-band ipv6 2001::8999 ipv6-prefix 64 ipv6-gw 2001::1
Firepower-chassis /fabric-interconnect/ipv6-config* #
commit-buffer
Firepower-chassis /fabric-interconnect/ipv6-config #
36
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Setting the Date and Time
Setting the Date and Time
Use the NTP page to configure the network time protocol (NTP) on the system, to set the date and time manually, or to view the current system time.
NTP settings are automatically synced between the FXOS chassis and any logical devices installed on the chassis.
Setting the Time Zone
Procedure
Step 1
Choose Platform Settings > NTP.
Step 2
Choose the appropriate time zone for the Firepower chassis from the Time Zone drop-down list.
Setting the Date and Time Using NTP
NTP is used to implement a hierarchical system of servers that provide a precisely synchronized time among network systems. This kind of accuracy is required for time-sensitive operations, such as validating CRLs, which include a precise time stamp.
Procedure
Step 1
Choose Platform Settings > NTP.
Step 2
Under Set Time Source, click Use NTP Server and then enter the IP address or hostname of the NTP server you want to use in the NTP Server field.
Step 3
Click Save.
The Firepower chassis is configured with the NTP server information specified.
Note
If you modify the system time by more than 10 minutes, the system will log you out and you will need to log in to the Firepower Chassis Manager again.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
37
Platform Settings
Deleting an NTP Server
Deleting an NTP Server
Procedure
Step 1
Choose Platform Settings > NTP.
Step 2
To stop using the NTP server, configure the system to use a manually configured date and time (see
Setting the Date and Time Manually, on page 38
).
Step 3
Click Save.
Setting the Date and Time Manually
This section describes how to set the date and time manually on the Firepower chassis.
Procedure
Step 1
Choose Platform Settings > NTP.
Step 2
Under Set Time Source, click Set Time Manually.
Step 3
Click the Date drop-down list to display a calendar and then set the date using the controls available in the calendar.
Step 4
Use the corresponding drop-down lists to specify the time as hours, minutes, and AM/PM.
Tip
You can click Get System Time to set the date and time to match what is configured on the system you are using to connect to the Firepower Chassis Manager.
Step 5
Click Save.
The Firepower chassis is configured with the date and time specified.
Note
If you modify the system time by more than 10 minutes, the system will log you out and you will need to log in to the Firepower Chassis Manager again.
Configuring SSH
The following procedure describes how to enable or disable SSH access to the Firepower chassis. SSH is enabled by default.
38
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Configuring Telnet
Procedure
Step 1
Choose Platform Settings > SSH.
Step 2
To enable SSH access to the Firepower chassis, check the Enable SSH check box. To disable SSH access, uncheck the Enable SSH check box.
Step 3
Click Save.
Configuring Telnet
The following procedure describes how to enable or disable Telnet access to the Firepower chassis. Telnet is disabled by default.
Note
Telnet configuration is currently only available using the CLI.
Procedure
Step 1
Enter system mode:
Firepower-chassis # scope system
Step 2
Enter system services mode:
Firepower-chassis /system # scope services
Step 3
To configure Telnet access to the Firepower chassis, do one of the following:
• To allow Telnet access to the Firepower chassis, enter the following command:
Firepower-chassis /system/services # enable telnet-server
• To disallow Telnet access to the Firepower chassis, enter the following command:
Firepower-chassis /system/services # disable telnet-server
Step 4
Commit the transaction to the system configuration:
Firepower /system/services # commit-buffer
The following example enables Telnet and commits the transaction:
Firepower-chassis#
scope system
Firepower-chassis /system #
scope services
Firepower-chassis /services #
enable telnet-server
Firepower-chassis /services* #
commit-buffer
Firepower-chassis /services #
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
39
Platform Settings
Configuring SNMP
Configuring SNMP
Use the SNMP page to configure the Simple Network Management Protocol (SNMP) on the Firepower chassis.
See the following topics for more information:
About SNMP
The Simple Network Management Protocol (SNMP) is an application-layer protocol that provides a message format for communication between SNMP managers and agents. SNMP provides a standardized framework and a common language used for the monitoring and management of devices in a network.
The SNMP framework consists of three parts:
• An SNMP manager—The system used to control and monitor the activities of network devices using
SNMP.
• An SNMP agent—The software component within the Firepower chassis that maintains the data for the
Firepower chassis and reports the data, as needed, to the SNMP manager. The Firepower chassis includes the agent and a collection of MIBs. To enable the SNMP agent and create the relationship between the manager and agent, enable and configure SNMP in the Firepower Chassis Manager or the FXOS CLI.
• A managed information base (MIB)—The collection of managed objects on the SNMP agent.
The Firepower chassis supports SNMPv1, SNMPv2c and SNMPv3. Both SNMPv1 and SNMPv2c use a community-based form of security. SNMP is defined in the following:
• RFC 3410 ( http://tools.ietf.org/html/rfc3410 )
• RFC 3411 ( http://tools.ietf.org/html/rfc3411 )
• RFC 3412 ( http://tools.ietf.org/html/rfc3412 )
• RFC 3413 ( http://tools.ietf.org/html/rfc3413 )
• RFC 3414 ( http://tools.ietf.org/html/rfc3414 )
• RFC 3415 ( http://tools.ietf.org/html/rfc3415 )
• RFC 3416 ( http://tools.ietf.org/html/rfc3416 )
• RFC 3417 ( http://tools.ietf.org/html/rfc3417 )
• RFC 3418 ( http://tools.ietf.org/html/rfc3418 )
• RFC 3584 ( http://tools.ietf.org/html/rfc3584 )
SNMP Notifications
A key feature of SNMP is the ability to generate notifications from an SNMP agent. These notifications do not require that requests be sent from the SNMP manager. Notifications can indicate improper user authentication, restarts, the closing of a connection, loss of connection to a neighbor router, or other significant events.
40
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
SNMP Security Levels and Privileges
The Firepower chassis generates SNMP notifications as either traps or informs. Traps are less reliable than informs because the SNMP manager does not send any acknowledgment when it receives a trap, and the
Firepower chassis cannot determine if the trap was received. An SNMP manager that receives an inform request acknowledges the message with an SNMP response protocol data unit (PDU). If the Firepower chassis does not receive the PDU, it can send the inform request again.
SNMP Security Levels and Privileges
SNMPv1, SNMPv2c, and SNMPv3 each represent a different security model. The security model combines with the selected security level to determine the security mechanism applied when the SNMP message is processed.
The security level determines the privileges required to view the message associated with an SNMP trap. The privilege level determines whether the message needs to be protected from disclosure or authenticated. The supported security level depends upon which security model is implemented. SNMP security levels support one or more of the following privileges:
• noAuthNoPriv—No authentication or encryption
• authNoPriv—Authentication but no encryption
• authPriv—Authentication and encryption
SNMPv3 provides for both security models and security levels. A security model is an authentication strategy that is set up for a user and the role in which the user resides. A security level is the permitted level of security within a security model. A combination of a security model and a security level determines which security mechanism is employed when handling an SNMP packet.
Supported Combinations of SNMP Security Models and Levels
The following table identifies what the combinations of security models and levels mean.
Table 1: SNMP Security Models and Levels
Model
v1
Level
noAuthNoPriv
Authentication
Community string
Encryption
No v2c v3 noAuthNoPriv noAuthNoPriv
Community string No
Username No
What Happens
Uses a community string match for authentication.
Uses a community string match for authentication.
Uses a username match for authentication.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
41
Platform Settings
SNMPv3 Security Features
Model
v3 v3
Level
authNoPriv
Authentication
HMAC-SHA
Encryption
No authPriv HMAC-SHA DES
What Happens
Provides authentication based on the HMAC
Secure Hash
Algorithm (SHA).
Provides authentication based on the HMAC-SHA algorithm. Provides
Data Encryption
Standard (DES)
56-bit encryption in addition to authentication based on the Cipher Block
Chaining (CBC)
DES (DES-56) standard.
SNMPv3 Security Features
SNMPv3 provides secure access to devices by a combination of authenticating and encrypting frames over the network. SNMPv3 authorizes management operations only by configured users and encrypts SNMP messages. The SNMPv3 User-Based Security Model (USM) refers to SNMP message-level security and offers the following services:
• Message integrity—Ensures that messages have not been altered or destroyed in an unauthorized manner and that data sequences have not been altered to an extent greater than can occur non-maliciously.
• Message origin authentication—Ensures that the claimed identity of the user on whose behalf received data was originated is confirmed.
• Message confidentiality and encryption—Ensures that information is not made available or disclosed to unauthorized individuals, entities, or processes.
SNMP Support
The Firepower chassis provides the following support for SNMP:
Support for MIBs
The Firepower chassis supports read-only access to MIBs.
Authentication Protocol for SNMPv3 Users
The Firepower chassis supports the HMAC-SHA-96 (SHA) authentication protocol for SNMPv3 users.
42
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Enabling SNMP and Configuring SNMP Properties
AES Privacy Protocol for SNMPv3 Users
The Firepower chassis uses Advanced Encryption Standard (AES) as one of the privacy protocols for SNMPv3 message encryption and conforms with RFC 3826.
The privacy password, or priv option, offers a choice of DES or 128-bit AES encryption for SNMP security encryption. If you enable AES-128 configuration and include a privacy password for an SNMPv3 user, the
Firepower chassis uses the privacy password to generate a 128-bit AES key. The AES privacy password can have a minimum of eight characters. If the passphrases are specified in clear text, you can specify a maximum of 64 characters.
Enabling SNMP and Configuring SNMP Properties
Procedure
Step 1
Choose Platform Settings > SNMP.
Step 2
In the SNMP area, complete the following fields:
Name Description
Admin State check box Whether SNMP is enabled or disabled. Enable this service only if your system includes integration with an SNMP server.
Port field
The port on which the Firepower chassis communicates with the SNMP host. You cannot change the default port.
Community/Username field The default SNMP v1 or v2 community name or SNMP v3 username the Firepower chassis includes on any trap messages it sends to the
SNMP host.
Enter an alphanumeric string between 1 and 32 characters. Do not use
@ (at sign), \ (backslash), " (double quote), ? (question mark) or an empty space. The default is public.
Note that if the Community/Username field is already set, the text to the right of the empty field reads Set: Yes. If the Community/Username field is not yet populated with a value, the text to the right of the empty field reads Set: No.
System Administrator Name field The contact person responsible for the SNMP implementation.
Enter a string of up to 255 characters, such as an email address or a name and telephone number.
Location field The location of the host on which the SNMP agent (server) runs.
Enter an alphanumeric string up to 510 characters.
Step 3
Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
43
Platform Settings
Creating an SNMP Trap
What to Do Next
Create SNMP traps and users.
Creating an SNMP Trap
Procedure
Step 1
Choose Platform Settings > SNMP.
Step 2
In the SNMP Traps area, click Add.
Step 3
In the Add SNMP Trap dialog box, complete the following fields:
Name Description
Host Name field
The hostname or IP address of the SNMP host to which the Firepower chassis should send the trap.
Community/Username field
Port field
The SNMP v1 or v2 community name or the SNMP v3 username the
Firepower chassis includes when it sends the trap to the SNMP host.
This must be the same as the community or username that is configured for the SNMP service.
Enter an alphanumeric string between 1 and 32 characters. Do not use
@ (at sign), \ (backslash), " (double quote), ? (question mark) or an empty space.
The port on which the Firepower chassis communicates with the SNMP host for the trap.
Enter an integer between 1 and 65535.
Version field The SNMP version and model used for the trap. This can be one of the following:
• V1
• V2
• V3
Type field If you select V2 or V3 for the version, the type of trap to send. This can be one of the following:
• Traps
• Informs
44
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Deleting an SNMP Trap
Name
v3 Privilege field
Description
If you select V3 for the version, the privilege associated with the trap.
This can be one of the following:
• Auth—Authentication but no encryption
• Noauth—No authentication or encryption
• Priv—Authentication and encryption
Step 4
Click OK to close the Add SNMP Trap dialog box.
Step 5
Click Save.
Deleting an SNMP Trap
Procedure
Step 1
Choose Platform Settings > SNMP.
Step 2
In the SNMP Traps area, click the Delete icon in the row in the table that corresponds to the trap you want to delete.
Creating an SNMPv3 User
Procedure
Step 1
Choose Platform Settings > SNMP.
Step 2
In the SNMP Users area, click Add.
Step 3
In the Add SNMP User dialog box, complete the following fields:
Name Description
Name field The username assigned to the SNMP user.
Enter up to 32 letters or numbers. The name must begin with a letter and you can also specify _ (underscore), . (period), @ (at sign), and -
(hyphen).
Auth Type field
Use AES-128 check box
The authorization type: SHA.
If checked, this user uses AES-128 encryption.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
45
Platform Settings
Deleting an SNMPv3 User
Name
Password field
Confirm Password field
Privacy Password field
Description
The password for this user.
The password again for confirmation purposes.
The privacy password for this user.
Confirm Privacy Password field The privacy password again for confirmation purposes.
Step 4
Click OK to close the Add SNMP User dialog box.
Step 5
Click Save.
Deleting an SNMPv3 User
Procedure
Step 1
Choose Platform Settings > SNMP.
Step 2
In the SNMP Users area, click the Delete icon in the row in the table that corresponds to the user you want to delete.
Configuring HTTPS
This section describes how to configure HTTPS on the FXOS chassis.
Note
You can change the HTTPS port using Firepower Chassis Manager or the FXOS CLI. All other HTTPS configuration can only be done using the FXOS CLI.
Certificates, Key Rings, and Trusted Points
HTTPS uses components of the Public Key Infrastructure (PKI) to establish secure communications between two devices, such as a client's browser and the FXOS chassis.
Encryption Keys and Key Rings
Each PKI device holds a pair of asymmetric Rivest-Shamir-Adleman (RSA) encryption keys, one kept private and one made public, stored in an internal key ring. A message encrypted with either key can be decrypted
46
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Creating a Key Ring
with the other key. To send an encrypted message, the sender encrypts the message with the receiver's public key, and the receiver decrypts the message using its own private key. A sender can also prove its ownership of a public key by encrypting (also called 'signing') a known message with its own private key. If a receiver can successfully decrypt the message using the public key in question, the sender's possession of the corresponding private key is proven. Encryption keys can vary in length, with typical lengths from 512 bits to 2048 bits. In general, a longer key is more secure than a shorter key. FXOS provides a default key ring with an initial 2048-bit key pair, and allows you to create additional key rings.
The default key ring certificate must be manually regenerated if the cluster name changes or the certificate expires.
Certificates
To prepare for secure communications, two devices first exchange their digital certificates. A certificate is a file containing a device's public key along with signed information about the device's identity. To merely support encrypted communications, a device can generate its own key pair and its own self-signed certificate.
When a remote user connects to a device that presents a self-signed certificate, the user has no easy method to verify the identity of the device, and the user's browser will initially display an authentication warning. By default, FXOS contains a built-in self-signed certificate containing the public key from the default key ring.
Trusted Points
To provide stronger authentication for FXOS, you can obtain and install a third-party certificate from a trusted source, or trusted point, that affirms the identity of your device. The third-party certificate is signed by the issuing trusted point, which can be a root certificate authority (CA) or an intermediate CA or trust anchor that is part of a trust chain that leads to a root CA. To obtain a new certificate, you must generate a certificate request through FXOS and submit the request to a trusted point.
Important
The certificate must be in Base64 encoded X.509 (CER) format.
Creating a Key Ring
FXOS supports a maximum of 8 key rings, including the default key ring.
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Create and name the key ring:
Firepower-chassis # create keyring keyring-name
Step 3
Set the SSL key length in bits:
Firepower-chassis # set modulus {mod1024 | mod1536 | mod2048 | mod512}
Step 4
Commit the transaction:
Firepower-chassis # commit-buffer
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
47
Platform Settings
Regenerating the Default Key Ring
The following example creates a keyring with a key size of 1024 bits:
Firepower-chassis#
scope security
Firepower-chassis /security #
create keyring kr220
Firepower-chassis /security/keyring* #
set modulus mod1024
Firepower-chassis /security/keyring* #
commit-buffer
Firepower-chassis /security/keyring #
What to Do Next
Create a certificate request for this key ring.
Regenerating the Default Key Ring
The default key ring certificate must be manually regenerated if the cluster name changes or the certificate expires.
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Enter key ring security mode for the default key ring:
Firepower-chassis /security # scope keyring default
Step 3
Regenerate the default key ring:
Firepower-chassis /security/keyring # set regenerate yes
Step 4
Commit the transaction:
Firepower-chassis # commit-buffer
The following example regenerates the default key ring:
Firepower-chassis#
scope security
Firepower-chassis /security #
scope keyring default
Firepower-chassis /security/keyring* #
set regenerate yes
Firepower-chassis /security/keyring* #
commit-buffer
Firepower-chassis /security/keyring #
Creating a Certificate Request for a Key Ring
Creating a Certificate Request for a Key Ring with Basic Options
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Enter configuration mode for the key ring:
Firepower-chassis /security # scope keyring keyring-name
48
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Creating a Certificate Request for a Key Ring
Step 3
Create a certificate request using the IPv4 or IPv6 address specified, or the name of the fabric interconnect.
You are prompted to enter a password for the certificate request.
Firepower-chassis /security/keyring # create certreq {ip [ipv4-addr | ipv6-v6] |subject-name name}
Step 4
Commit the transaction:
Firepower-chassis /security/keyring/certreq # commit-buffer
Step 5
Display the certificate request, which you can copy and send to a trust anchor or certificate authority:
Firepower-chassis /security/keyring # show certreq
The following example creates and displays a certificate request with an IPv4 address for a key ring, with basic options:
Firepower-chassis#
scope security
Firepower-chassis /security #
scope keyring kr220
Firepower-chassis /security/keyring #
create certreq ip 192.168.200.123 subject-name sjc04
Certificate request password:
Confirm certificate request password:
Firepower-chassis /security/keyring* #
commit-buffer
Firepower-chassis /security/keyring #
show certreq
Certificate request subject name: sjc04
Certificate request ip address: 192.168.200.123
Certificate request e-mail name:
Certificate request country name:
State, province or county (full name):
Locality (eg, city):
Organization name (eg, company):
Organization Unit name (eg, section):
Request:
-----BEGIN CERTIFICATE REQUEST-----
MIIBfTCB5wIBADARMQ8wDQYDVQQDEwZzYW1jMDQwgZ8wDQYJKoZIhvcNAQEBBQAD gY0AMIGJAoGBALpKn1t8qMZO4UGqILKFXQQc2c8b/vW2rnRF8OPhKbhghLA1YZ1F
JqcYEG5Yl1+vgohLBTd45s0GC8m4RTLJWHo4SwccAUXQ5Zngf45YtX1WsylwUWV4
0re/zgTk/WCd56RfOBvWR2Dtztu2pGA14sd761zLxt29K7R8mzj6CAUVAgMBAAGg
LTArBgkqhkiG9w0BCQ4xHjAcMBoGA1UdEQEB/wQQMA6CBnNhbWMwNIcECsEiXjAN
BgkqhkiG9w0BAQQFAAOBgQCsxN0qUHYGFoQw56RwQueLTNPnrndqUwuZHUO03Teg nhsyu4satpyiPqVV9viKZ+spvc6x5PWIcTWgHhH8BimOb/0OKuG8kwfIGGsEDlAv
TTYvUP+BZ9OFiPbRIA718S+V8ndXr1HejiQGxlDNqoN+odCXPc5kjoXD0lZTL09H
BA==
-----END CERTIFICATE REQUEST-----
Firepower-chassis /security/keyring #
What to Do Next
• Copy the text of the certificate request, including the BEGIN and END lines, and save it in a file. Send the file with the certificate request to a trust anchor or certificate authority to obtain a certificate for the key ring.
• Create a trusted point and set the certificate chain for the certificate of trust received from the trust anchor.
Creating a Certificate Request for a Key Ring with Advanced Options
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
49
Platform Settings
Creating a Certificate Request for a Key Ring
Step 2
Enter configuration mode for the key ring:
Firepower-chassis /security # scope keyring keyring-name
Step 3
Create a certificate request:
Firepower-chassis /security/keyring # create certreq
Step 4
Specify the country code of the country in which the company resides:
Firepower-chassis /security/keyring/certreq* # set country country name
Step 5
Specify the Domain Name Server (DNS) address associated with the request:
Firepower-chassis /security/keyring/certreq* # set dns DNS Name
Step 6
Specify the email address associated with the certificate request:
Firepower-chassis /security/keyring/certreq* # set e-mail E-mail name
Step 7
Specify the IP address of the FXOS chassis:
Firepower-chassis /security/keyring/certreq* # set ip {certificate request ip-address|certificate request
ip6-address }
Step 8
Specify the city or town in which the company requesting the certificate is headquartered:
Firepower-chassis /security/keyring/certreq* # set locality locality name (eg, city)
Step 9
Specify the organization requesting the certificate:
Firepower-chassis /security/keyring/certreq* # set org-name organization name
Step 10 Specify the organizational unit:
Firepower-chassis /security/keyring/certreq* # set org-unit-name organizational unit name
Step 11 Specify an optional password for the certificate request:
Firepower-chassis /security/keyring/certreq* # set password certificate request password
Step 12 Specify the state or province in which the company requesting the certificate is headquartered:
Firepower-chassis /security/keyring/certreq* # set state state, province or county
Step 13 Specify the fully qualified domain name of the FXOS chassis:
Firepower-chassis /security/keyring/certreq* # set subject-name certificate request name
Step 14 Commit the transaction:
Firepower-chassis /security/keyring/certreq # commit-buffer
Step 15 Display the certificate request, which you can copy and send to a trust anchor or certificate authority:
Firepower-chassis /security/keyring # show certreq
The following example creates and displays a certificate request with an IPv4 address for a key ring, with advanced options:
Firepower-chassis#
scope security
Firepower-chassis /security #
scope keyring kr220
Firepower-chassis /security/keyring #
create certreq
Firepower-chassis /security/keyring/certreq* #
set ip 192.168.200.123
Firepower-chassis /security/keyring/certreq* #
set subject-name sjc04
Firepower-chassis /security/keyring/certreq* #
set country US
Firepower-chassis /security/keyring/certreq* #
set dns bg1-samc-15A
Firepower-chassis /security/keyring/certreq* #
set email [email protected]
Firepower-chassis /security/keyring/certreq* #
set locality new york city
Firepower-chassis /security/keyring/certreq* #
set org-name "Cisco Systems"
Firepower-chassis /security/keyring/certreq* #
set org-unit-name Testing
Firepower-chassis /security/keyring/certreq* #
set state new york
50
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Creating a Trusted Point
Firepower-chassis /security/keyring/certreq* #
commit-buffer
Firepower-chassis /security/keyring/certreq #
show certreq
Certificate request subject name: sjc04
Certificate request ip address: 192.168.200.123
Certificate request e-mail name: [email protected]
Certificate request country name: US
State, province or county (full name): New York
Locality name (eg, city): new york city
Organization name (eg, company): Cisco
Organization Unit name (eg, section): Testing
Request:
-----BEGIN CERTIFICATE REQUEST-----
MIIBfTCB5wIBADARMQ8wDQYDVQQDEwZzYW1jMDQwgZ8wDQYJKoZIhvcNAQEBBQAD gY0AMIGJAoGBALpKn1t8qMZO4UGqILKFXQQc2c8b/vW2rnRF8OPhKbhghLA1YZ1F
JqcYEG5Yl1+vgohLBTd45s0GC8m4RTLJWHo4SwccAUXQ5Zngf45YtX1WsylwUWV4
0re/zgTk/WCd56RfOBvWR2Dtztu2pGA14sd761zLxt29K7R8mzj6CAUVAgMBAAGg
LTArBgkqhkiG9w0BCQ4xHjAcMBoGA1UdEQEB/wQQMA6CBnNhbWMwNIcECsEiXjAN
BgkqhkiG9w0BAQQFAAOBgQCsxN0qUHYGFoQw56RwQueLTNPnrndqUwuZHUO03Teg nhsyu4satpyiPqVV9viKZ+spvc6x5PWIcTWgHhH8BimOb/0OKuG8kwfIGGsEDlAv
TTYvUP+BZ9OFiPbRIA718S+V8ndXr1HejiQGxlDNqoN+odCXPc5kjoXD0lZTL09H
BA==
-----END CERTIFICATE REQUEST-----
Firepower-chassis /security/keyring/certreq #
What to Do Next
• Copy the text of the certificate request, including the BEGIN and END lines, and save it in a file. Send the file with the certificate request to a trust anchor or certificate authority to obtain a certificate for the key ring.
• Create a trusted point and set the certificate chain for the certificate of trust received from the trust anchor.
Creating a Trusted Point
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Create a trusted point:
Firepower-chassis /security # create trustpoint name
Step 3
Specify certificate information for this trusted point:
Firepower-chassis /security/trustpoint # set certchain [ certchain ]
If you do not specify certificate information in the command, you are prompted to enter a certificate or a list of trustpoints defining a certification path to the root certificate authority (CA). On the next line following your input, type ENDOFBUF to finish.
Important
The certificate must be in Base64 encoded X.509 (CER) format.
Step 4
Commit the transaction:
Firepower-chassis /security/trustpoint # commit-buffer
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
51
Platform Settings
Importing a Certificate into a Key Ring
The following example creates a trusted point and provides a certificate for the trusted point:
Firepower-chassis#
scope security
Firepower-chassis /security #
create trustpoint tPoint10
Firepower-chassis /security/trustpoint* #
set certchain
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Trustpoint Certificate Chain:
>
-----BEGIN CERTIFICATE-----
>
MIIDMDCCApmgAwIBAgIBADANBgkqhkiG9w0BAQQFADB0MQswCQYDVQQGEwJVUzEL
>
BxMMU2FuIEpvc2UsIENBMRUwEwYDVQQKEwxFeGFtcGxlIEluYy4xEzARBgNVBAsT
>
ClRlc3QgR3JvdXAxGTAXBgNVBAMTEHRlc3QuZXhhbXBsZS5jb20xHzAdBgkqhkiG
>
9w0BCQEWEHVzZXJAZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
>
AoGBAMZw4nTepNIDhVzb0j7Z2Je4xAG56zmSHRMQeOGHemdh66u2/XAoLx7YCcYU
>
ZgAMivyCsKgb/6CjQtsofvtrmC/eAehuK3/SINv7wd6Vv2pBt6ZpXgD4VBNKONDl
>
GMbkPayVlQjbG4MD2dx2+H8EH3LMtdZrgKvPxPTE+bF5wZVNAgMBAAGgJTAjBgkq
>
hkiG9w0BCQcxFhMUQSBjaGFsbGVuZ2UgcGFzc3dvcmQwDQYJKoZIhvcNAQEFBQAD
>
gYEAG61CaJoJaVMhzCl903O6Mg51zq1zXcz75+VFj2I6rH9asckCld3mkOVx5gJU
>
Ptt5CVQpNgNLdvbDPSsXretysOhqHmp9+CLv8FDuy1CDYfuaLtvlWvfhevskV0j6
>
jtcEMyZ+f7+3yh421ido3nO4MIGeBgNVHSMEgZYwgZOAFLlNjtcEMyZ+f7+3yh42
>
1ido3nO4oXikdjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFDASBgNVBAcT
>
C1NhbnRhIENsYXJhMRswGQYDVQQKExJOdW92YSBTeXN0ZW1zIEluYy4xFDASBgNV
>
BAsTC0VuZ2luZWVyaW5nMQ8wDQYDVQQDEwZ0ZXN0Q0GCAQAwDAYDVR0TBAUwAwEB
>
/zANBgkqhkiG9w0BAQQFAAOBgQAhWaRwXNR6B4g6Lsnr+fptHv+WVhB5fKqGQqXc
>
wR4pYiO4z42/j9Ijenh75tCKMhW51az8copP1EBmOcyuhf5C6vasrenn1ddkkYt4
>
PR0vxGc40whuiozBolesmsmjBbedUCwQgdFDWhDIZJwK5+N3x/kfa2EHU6id1avt
>
4YL5Jg==
>
-----END CERTIFICATE-----
>
ENDOFBUF
Firepower-chassis /security/trustpoint* #
commit-buffer
Firepower-chassis /security/trustpoint #
What to Do Next
Obtain a key ring certificate from the trust anchor or certificate authority and import it into the key ring.
Importing a Certificate into a Key Ring
Before You Begin
• Configure a trusted point that contains the certificate chain for the key ring certificate.
• Obtain a key ring certificate from a trust anchor or certificate authority.
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Enter configuration mode for the key ring that will receive the certificate:
Firepower-chassis /security # scope keyring keyring-name
Step 3
Specify the trusted point for the trust anchor or certificate authority from which the key ring certificate was obtained:
Firepower-chassis /security/keyring # set trustpoint name
Step 4
Launch a dialog for entering and uploading the key ring certificate:
Firepower-chassis /security/keyring # set cert
52
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Configuring HTTPS
At the prompt, paste the certificate text that you received from the trust anchor or certificate authority. On the next line following the certificate, type ENDOFBUF to complete the certificate input.
Important
The certificate must be in Base64 encoded X.509 (CER) format.
Step 5
Commit the transaction:
Firepower-chassis /security/keyring # commit-buffer
The following example specifies the trust point and imports a certificate into a key ring:
Firepower-chassis#
scope security
Firepower-chassis /security #
scope keyring kr220
Firepower-chassis /security/keyring #
set trustpoint tPoint10
Firepower-chassis /security/keyring* #
set cert
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Keyring certificate:
>
-----BEGIN CERTIFICATE-----
>
MIIB/zCCAWgCAQAwgZkxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UE
>
BxMMU2FuIEpvc2UsIENBMRUwEwYDVQQKEwxFeGFtcGxlIEluYy4xEzARBgNVBAsT
>
ClRlc3QgR3JvdXAxGTAXBgNVBAMTEHRlc3QuZXhhbXBsZS5jb20xHzAdBgkqhkiG
>
9w0BCQEWEHVzZXJAZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
>
AoGBAMZw4nTepNIDhVzb0j7Z2Je4xAG56zmSHRMQeOGHemdh66u2/XAoLx7YCcYU
>
ZgAMivyCsKgb/6CjQtsofvtrmC/eAehuK3/SINv7wd6Vv2pBt6ZpXgD4VBNKONDl
>
GMbkPayVlQjbG4MD2dx2+H8EH3LMtdZrgKvPxPTE+bF5wZVNAgMBAAGgJTAjBgkq
>
hkiG9w0BCQcxFhMUQSBjaGFsbGVuZ2UgcGFzc3dvcmQwDQYJKoZIhvcNAQEFBQAD
>
gYEAG61CaJoJaVMhzCl903O6Mg51zq1zXcz75+VFj2I6rH9asckCld3mkOVx5gJU
>
Ptt5CVQpNgNLdvbDPSsXretysOhqHmp9+CLv8FDuy1CDYfuaLtvlWvfhevskV0j6
>
mK3Ku+YiORnv6DhxrOoqau8r/hyI/L43l7IPN1HhOi3oha4=
>
-----END CERTIFICATE-----
>
ENDOFBUF
Firepower-chassis /security/keyring* #
commit-buffer
Firepower-chassis /security/keyring #
What to Do Next
Configure your HTTPS service with the key ring.
Configuring HTTPS
Caution
After you complete the HTTPS configuration, including changing the port and key ring to be used by
HTTPS, all current HTTP and HTTPS sessions are closed without warning as soon as you save or commit the transaction.
Procedure
Step 1
Enter system mode:
Firepower-chassis# scope system
Step 2
Enter system services mode:
Firepower-chassis /system # scope services
Step 3
Enable the HTTPS service:
Firepower-chassis /system/services # enable https
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
53
Platform Settings
Changing the HTTPS Port
Step 4
(Optional) Specify the port to be used for the HTTPS connection:
Firepower-chassis /system/services # set https port port-num
Step 5
(Optional) Specify the name of the key ring you created for HTTPS:
Firepower-chassis /system/services # set https keyring keyring-name
Step 6
(Optional) Specify the level of Cipher Suite security used by the domain:
Firepower-chassis /system/services # set https cipher-suite-mode cipher-suite-mode
cipher-suite-mode can be one of the following keywords:
• high-strength
• medium-strength
• low-strength
• custom—Allows you to specify a user-defined Cipher Suite specification string.
Step 7
(Optional) If cipher-suite-mode is set to custom, specify a custom level of Cipher Suite security for the domain:
Firepower-chassis /system/services # set https cipher-suite cipher-suite-spec-string
cipher-suite-spec-string can contain up to 256 characters and must conform to the OpenSSL Cipher Suite specifications. You cannot use any spaces or special characters except ! (exclamation point), + (plus sign), -
(hyphen), and : (colon). For details, see http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite .
For example, the medium strength specification string FXOS uses as the default is:
ALL:!ADH:!EXPORT56:!LOW:RC4+RSA:+HIGH:+MEDIUM:+EXP:+eNULL
Note
This option is ignored if cipher-suite-mode is set to anything other than custom.
Step 8
Commit the transaction to the system configuration:
Firepower-chassis /system/services # commit-buffer
The following example enables HTTPS, sets the port number to 443, sets the key ring name to kring7984, sets the Cipher Suite security level to high, and commits the transaction:
Firepower-chassis#
scope system
Firepower-chassis /system #
scope services
Firepower-chassis /system/services #
enable https
Firepower-chassis /system/services* #
set https port 443
Warning: When committed, this closes all the web sessions.
Firepower-chassis /system/services* #
set https keyring kring7984
Firepower-chassis /system/services* #
set https cipher-suite-mode high
Firepower-chassis /system/services* #
commit-buffer
Firepower-chassis /system/services #
Changing the HTTPS Port
The HTTPS service is enabled on port 443 by default. You cannot disable HTTPS, but you can change the port to use for HTTPS connections.
54
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Deleting a Key Ring
Procedure
Step 1
Choose Platform Settings > HTTPS.
Step 2
Enter the port to use for HTTPS connections in the Port field. Specify an integer between 1 and 65535. This service is enabled on port 443 by default.
Step 3
Click Save.
The Firepower chassis is configured with the HTTPS port specified.
After changing the HTTPS port, all current HTTPS sessions are closed. Users will need to log back in to the
Firepower Chassis Manager using the new port as follows: https://<chassis_mgmt_ip_address>:<chassis_mgmt_port> where <chassis_mgmt_ip_address> is the IP address or host name of the Firepower chassis that you entered during initial configuration and <chassis_mgmt_port> is the HTTPS port you have just configured.
Deleting a Key Ring
Procedure
Step 1
Enter security mode:
Firepower-chassis # scope security
Step 2
Delete the named key ring:
Firepower-chassis /security # delete keyring name
Step 3
Commits the transaction:
Firepower-chassis /security # commit-buffer
The following example deletes a key ring:
Firepower-chassis#
scope security
Firepower-chassis /security #
delete keyring key10
Firepower-chassis /security* #
commit-buffer
Firepower-chassis /security #
Deleting a Trusted Point
Before You Begin
Ensure that the trusted point is not used by a key ring.
Procedure
Step 1
Enters security mode:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
55
Platform Settings
Disabling HTTPS
Firepower-chassis# scope security
Step 2
Delete the named trusted point:
Firepower-chassis /security # delete trustpoint name
Step 3
Commits the transaction:
Firepower-chassis /security # commit-buffer
The following example deletes a trusted point:
Firepower-chassis#
scope security
Firepower-chassis /security #
delete trustpoint tPoint10
Firepower-chassis /security* #
commit-buffer
Firepower-chassis /security #
Disabling HTTPS
Procedure
Step 1
Enter system mode:
Firepower-chassis# scope system
Step 2
Enter system services mode:
Firepower-chassis /system # scope services
Step 3
Disable the HTTPS service:
Firepower-chassis /system/services # disable https
Step 4
Commit the transaction to the system configuration:
Firepower-chassis /system/services # commit-buffer
The following example disables HTTPS and commits the transaction:
Firepower-chassis#
scope system
Firepower-chassis /system #
scope services
Firepower-chassis /system/services #
disable https
Firepower-chassis /system/services* #
commit-buffer
Firepower-chassis /system/services #
Configuring AAA
This section describes authentication, authorization, and accounting. See the following topics for more information:
56
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
About AAA
About AAA
AAA is a set of services for controlling access to computer resources, enforcing policies, assessing usage, and providing the information necessary to bill for services. These processes are considered important for effective network management and security.
Authentication
Authentication provides a way to identify a user, typically by having the user enter a valid username and valid password before access is granted. The AAA server compares a user's authentication credentials with other user credentials stored in a database. If the credentials match, the user is permitted access to the network. If the credentials do not match, authentication fails and network access is denied.
You can configure the FXOS chassis to authenticate administrative connections to the chassis, including the following sessions:
• HTTPS
• SSH
• Serial console
Authorization
Authorization is the process of enforcing policies: determining what types of activities, resources, or services a user is permitted to access. After a user is authenticated, that user may be authorized for different types of access or activity.
Accounting
Accounting measures the resources a user consumes during access, which may include the amount of system time or the amount of data that a user has sent or received during a session. Accounting is carried out through the logging of session statistics and usage information, which is used for authorization control, billing, trend analysis, resource utilization, and capacity planning activities.
Interaction Between Authentication, Authorization, and Accounting
You can use authentication alone or with authorization and accounting. Authorization always requires a user to be authenticated first. You can use accounting alone, or with authentication and authorization.
AAA Servers
The AAA server is a network server that is used for access control. Authentication identifies the user.
Authorization implements policies that determine which resources and services an authenticated user may access. Accounting keeps track of time and data resources that are used for billing and analysis.
Local Database Support
The Firepower chassis maintains a local database that you can populate with user profiles. You can use a local database instead of AAA servers to provide user authentication, authorization, and accounting.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
57
Platform Settings
Configuring LDAP Providers
Configuring LDAP Providers
Configuring Properties for LDAP Providers
The properties that you configure in this task are the default settings for all provider connections of this type.
If an individual provider includes a setting for any of these properties, the Firepower eXtensible Operating
System uses that setting and ignores the default setting.
If you are using Active Directory as your LDAP server, create a user account in the Active Directory server to bind with the Firepower eXtensible Operating System. This account should be given a non-expiring password.
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the LDAP tab.
Step 3
In the Properties area, complete the following fields:
Name Description
Timeout field The length of time in seconds the system should spend trying to contact the LDAP database before it times out.
Enter an integer from 1 to 60 seconds. The default value is 30 seconds.
This property is required.
Attribute field
Base DN field
Filter field
An LDAP attribute that stores the values for the user roles and locales.
This property is always a name-value pair. The system queries the user record for the value that matches this attribute name.
The specific distinguished name in the LDAP hierarchy where the server should begin a search when a remote user logs in and the system attempts to get the user's DN based on their username. The length of the base
DN can be set to a maximum of 255 characters minus the length of
CN=$userid, where $userid identifies the remote user attempting to access the Firepower chassis using LDAP authentication.
This property is required. If you do not specify a base DN on this tab then you must specify one for each LDAP provider that you define.
The LDAP search is restricted to those user names that match the defined filter.
This property is required. If you do not specify a filter on this tab then you must specify one for each LDAP provider that you define.
Step 4
Click Save.
58
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Configuring LDAP Providers
What to Do Next
Create an LDAP provider.
Creating an LDAP Provider
The Firepower eXtensible Operating System supports a maximum of 16 LDAP providers.
Before You Begin
If you are using Active Directory as your LDAP server, create a user account in the Active Directory server to bind with the Firepower eXtensible Operating System. This account should be given a non-expiring password.
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the LDAP tab.
Step 3
For each LDAP provider that you want to add: a) In the LDAP Providers area, click Add.
b) In the Add LDAP Provider dialog box, complete the following fields:
Name Description
Hostname/FDQN (or IP
Address) field
The hostname or IP address on which the LDAP provider resides. If
SSL is enabled, this field must exactly match a Common Name (CN) in the security certificate of the LDAP database.
Order field
Bind DN field
Base DN field
The order in which the Firepower eXtensible Operating System uses this provider to authenticate users.
Enter an integer between 1 and 16, or enter lowest-available or 0
(zero) if you want the Firepower eXtensible Operating System to assign the next available order based on the other providers defined in Firepower Chassis Manager or the FXOS CLI.
The distinguished name (DN) for an LDAP database account that has read and search permissions for all objects under the base DN.
The maximum supported string length is 255 ASCII characters.
The specific distinguished name in the LDAP hierarchy where the server should begin a search when a remote user logs in and the system attempts to get the user's DN based on their username. The length of the base DN can be set to a maximum of 255 characters minus the length of CN=$userid, where $userid identifies the remote user attempting to access Firepower Chassis Manager or the FXOS
CLI using LDAP authentication.
This value is required unless a default base DN has been set on the
LDAP tab.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
59
Platform Settings
Configuring LDAP Providers
Name
Port field
Enable SSL check box
Filter field
Attribute field
Key field
Confirm Key field
Timeout field
Vendor field
Description
The port through which Firepower Chassis Manager or the FXOS
CLI communicates with the LDAP database. The standard port number is 389.
If checked, encryption is required for communications with the LDAP database. If unchecked, authentication information will be sent as clear text.
LDAP uses STARTTLS. This allows encrypted communication using port 389.
The LDAP search is restricted to those user names that match the defined filter.
This value is required unless a default filter has been set on the LDAP tab.
An LDAP attribute that stores the values for the user roles and locales.
This property is always a name-value pair. The system queries the user record for the value that matches this attribute name.
This value is required unless a default attribute has been set on the
LDAP tab.
The password for the LDAP database account specified in the Bind
DN field. You can enter any standard ASCII characters except for space, § (section sign), ? (question mark), or = (equal sign).
The LDAP database password repeated for confirmation purposes.
The length of time in seconds the system should spend trying to contact the LDAP database before it times out.
Enter an integer from 1 to 60 seconds, or enter 0 (zero) to use the global timeout value specified on the LDAP tab. The default is 30 seconds.
This selection identifies the vendor that is providing the LDAP provider or server details:
• If the LDAP provider is Microsoft Active Directory, select MS
AD.
• If the LDAP provider is not Microsoft Active Directory, select
Open LDAP.
The default is Open LDAP.
60
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Configuring RADIUS Providers
c) Click OK to close the Add LDAP Provider dialog box.
Step 4
Click Save.
Deleting an LDAP Provider
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the LDAP tab.
Step 3
In the LDAP Providers area, click the Delete icon in the row in the table that corresponds to the LDAP
Provider you want to delete.
Configuring RADIUS Providers
Configuring Properties for RADIUS Providers
The properties that you configure in this task are the default settings for all provider connections of this type.
If an individual provider includes a setting for any of these properties, the Firepower eXtensible Operating
System uses that setting and ignores the default setting.
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the RADIUS tab.
Step 3
In the Properties area, complete the following fields:
Name Description
Timeout field The length of time in seconds the system should spend trying to contact the RADIUS database before it times out.
Enter an integer from 1 to 60 seconds. The default value is 5 seconds.
This property is required.
Retries field The number of times to retry the connection before the request is considered to have failed.
Step 4
Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
61
Platform Settings
Configuring RADIUS Providers
What to Do Next
Create a RADIUS provider.
Creating a RADIUS Provider
The Firepower eXtensible Operating System supports a maximum of 16 RADIUS providers.
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the RADIUS tab.
Step 3
For each RADIUS provider that you want to add: a) In the RADIUS Providers area, click Add.
b) In the Add RADIUS Provider dialog box, complete the following fields:
Name Description
Hostname/FDQN (or IP
Address) field
The hostname or IP address on which the RADIUS provider resides.
Order field
Key field
Confirm Key field
Authorization Port field
The order in which the Firepower eXtensible Operating System uses this provider to authenticate users.
Enter an integer between 1 and 16, or enter lowest-available or 0
(zero) if you want the Firepower eXtensible Operating System to assign the next available order based on the other providers defined in Firepower Chassis Manager or the FXOS CLI.
The SSL encryption key for the database.
The SSL encryption key repeated for confirmation purposes.
The port through which Firepower Chassis Manager or the FXOS
CLI communicates with the RADIUS database. The valid range is 1 to 65535. The standard port number is 1700.
Timeout field
Retries field
The length of time in seconds the system should spend trying to contact the RADIUS database before it times out.
Enter an integer from 1 to 60 seconds, or enter 0 (zero) to use the global timeout value specified on the RADIUS tab. The default is 5 seconds.
The number of times to retry the connection before the request is considered to have failed.
If desired, enter an integer between 0 and 5. If you do not specify a value, Firepower Chassis Manager uses the value specified on the
RADIUS tab.
62
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Configuring TACACS+ Providers
c) Click OK to close the Add RADIUS Provider dialog box.
Step 4
Click Save.
Deleting a RADIUS Provider
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the RADIUS tab.
Step 3
In the RADIUS Providers area, click the Delete icon in the row in the table that corresponds to the RADIUS
Provider you want to delete.
Configuring TACACS+ Providers
Configuring Properties for TACACS+ Providers
The properties that you configure in this task are the default settings for all provider connections of this type.
If an individual provider includes a setting for any of these properties, the Firepower eXtensible Operating
System uses that setting and ignores the default setting.
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the TACACS tab.
Step 3
In the Properties area, complete the following fields:
Name Description
Timeout field
The length of time in seconds the system should spend trying to contact the TACACS+ database before it times out.
Enter an integer from 1 to 60 seconds. The default value is 5 seconds.
This property is required.
Step 4
Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
63
Platform Settings
Configuring TACACS+ Providers
What to Do Next
Create a TACACS+ provider.
Creating a TACACS+ Provider
The Firepower eXtensible Operating System supports a maximum of 16 TACACS+ providers.
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the TACACS tab.
Step 3
For each TACACS+ provider that you want to add: a) In the TACACS Providers area, click Add.
b) In the Add TACACS Provider dialog box, complete the following fields:
Name Description
Hostname/FDQN (or IP
Address) field
The hostname or IP address on which the TACACS+ provider resides.
Order field The order in which the Firepower eXtensible Operating System uses this provider to authenticate users.
Enter an integer between 1 and 16, or enter lowest-available or 0
(zero) if you want the Firepower eXtensible Operating System to assign the next available order based on the other providers defined in Firepower Chassis Manager or the FXOS CLI.
Key field
Confirm Key field
Port field
Timeout field
The SSL encryption key for the database.
The SSL encryption key repeated for confirmation purposes.
The port through which Firepower Chassis Manager or the FXOS
CLI communicates with the TACACS+ database.
Enter an integer between 1 and 65535. The default port is 49.
The length of time in seconds the system should spend trying to contact the TACACS+ database before it times out.
Enter an integer from 1 to 60 seconds, or enter 0 (zero) to use the global timeout value specified on the TACACS+ tab. The default is
5 seconds.
c) Click OK to close the Add TACACS Provider dialog box.
Step 4
Click Save.
64
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Configuring Syslog
Deleting a TACACS+ Provider
Procedure
Step 1
Choose Platform Settings > AAA.
Step 2
Click the TACACS tab.
Step 3
In the TACACS Providers area, click the Delete icon in the row in the table that corresponds to the TACACS+
Provider you want to delete.
Configuring Syslog
System logging is a method of collecting messages from devices to a server running a syslog daemon. Logging to a central syslog server helps in aggregation of logs and alerts. A syslog service accepts messages and stores them in files, or prints them according to a simple configuration file. This form of logging provides protected long-term storage for logs. Logs are useful both in routine troubleshooting and in incident handling.
Procedure
Step 1
Choose Platform Settings > Syslog.
Step 2
Configure Local Destinations: a) Click the Local Destinations tab.
b) On the Local Destinations tab, complete the following fields:
Name Description
Console Section
Admin State field
Level field
Whether the Firepower chassis displays syslog messages on the console.
Check the Enable check box if you want to have syslog messages displayed on the console as well as added to the log. If the Enable check box is unchecked, syslog messages are added to the log but are not displayed on the console.
If you checked the Enable check box for Console - Admin State, select the lowest message level that you want displayed on the console.
The Firepower chassis displays that level and above on the console.
This can be one of the following:
• Emergencies
• Alerts
• Critical
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
65
Platform Settings
Configuring Syslog
Name
Monitor Section
Admin State field
Level drop-down list
Description
Whether the Firepower chassis displays syslog messages on the monitor.
Check the Enable check box if you want to have syslog messages displayed on the monitor as well as added to the log. If the Enable check box is unchecked, syslog messages are added to the log but are not displayed on the monitor.
If you checked the Enable check box for Monitor - Admin State, select the lowest message level that you want displayed on the monitor. The system displays that level and above on the monitor.
This can be one of the following:
• Emergencies
• Alerts
• Critical
• Errors
• Warnings
• Notifications
• Information
• Debugging c) Click Save.
Step 3
Configure Remote Destinations: a) Click the Remote Destinations tab.
b) On the Remote Destinations tab, complete the following fields for up to three external logs that can store messages generated by the Firepower chassis:
By sending syslog messages to a remote destination, you can archive messages according to the available disk space on the external syslog server, and manipulate logging data after it is saved. For example, you could specify actions to be executed when certain types of syslog messages are logged, extract data from the log and save the records to another file for reporting, or track statistics using a site-specific script.
Name
Admin State field
Description
Check the Enable check box if you want to have syslog messages stored in a remote log file.
66
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Platform Settings
Configuring Syslog
Name
Level drop-down list
Hostname/IP Address field
Facility drop-down list
Description
Select the lowest message level that you want the system to store.
The system stores that level and above in the remote file. This can be one of the following:
• Emergencies
• Alerts
• Critical
• Errors
• Warnings
• Notifications
• Information
• Debugging
The hostname or IP address on which the remote log file resides.
Note
You must configure a DNS server if you use a hostname rather than an IP address.
Choose a system log facility for syslog servers to use as a basis to file messages. This can be one of the following:
• Local0
• Local1
• Local2
• Local3
• Local4
• Local5
• Local6
• Local7 c) Click Save.
Step 4
Configure Local Sources: a) Click the Local Sources tab.
b) On the Local Sources tab, complete the following fields:
Name Description
Faults Admin State field Whether system fault logging is enabled or not. If the Enable check box is checked, the Firepower chassis logs all system faults.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
67
Platform Settings
Configuring DNS Servers
Name
Audits Admin State field
Events Admin State field
Description
Whether audit logging is enabled or not. If the Enable check box is checked, the Firepower chassis logs all audit log events.
Whether system event logging is enabled or not. If the Enable check box is checked, the Firepower chassis logs all system events.
c) Click Save.
Configuring DNS Servers
You need to specify a DNS server if the system requires resolution of host names to IP addresses. For example, you cannot use a name such as www.cisco.com when you are configuring a setting on the Firepower chassis if you do not configure a DNS server. You would need to use the IP address of the server, which can be either an IPv4 or an IPv6 address. You can configure up to four DNS servers.
Note
When you configure multiple DNS servers, the system searches for the servers only in any random order.
If a local management command requires DNS server lookup, it can only search for three DNS servers in random order.
Procedure
Step 1
Choose Platform Settings > DNS.
Step 2
Check the Enable DNS Server check box.
Step 3
For each DNS server that you want to add, up to a maximum of four, enter the IP address of the DNS server in the DNS Server field and click Add.
Step 4
Click Save.
68
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
7
Interface Management
•
About Firepower Security Appliance Interfaces, page 69
•
Edit Interface Properties, page 70
•
Change the Administrative State of an Interface, page 71
•
Create a Port Channel, page 71
•
Configuring Breakout Cables, page 72
About Firepower Security Appliance Interfaces
The FXOS chassis supports single interfaces as well as EtherChannel (port-channel) Interfaces. EtherChannel interfaces can include up to 16 member interfaces of the same type.
Interfaces Page
From the Interfaces page of the Firepower Chassis Manager, you can view the status of the installed interfaces on the chassis, edit interface properties, enable or disable an interface, and create port channels.
The Interfaces page is made up of two sections:
• The upper section shows a visual representation of the interfaces that are installed in the Firepower chassis. You can hover over any of the interfaces to get additional information about the interface.
The interfaces are color coded to indicate their current status:
◦Green—The interface is installed and enabled.
◦Dark Grey—The interface is installed but disabled.
◦Red—There is a problem with the operational state of the interface.
◦Light Grey—The interface is not installed.
• The lower section contains a table of the interfaces installed in the Firepower chassis. For each interface, you can enable or disable the interface. You can also click Edit to edit the properties of an interface, such as speed and interface type.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
69
Interface Management
Interface Types
Note
The port-channel 48 cluster type interface shows the Operation State as failed if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not require any member interfaces, and you can ignore this Operational State.
Interface Types
Each interface can be one of the following types:
• Data (the default)--Data interfaces cannot be shared between logical devices.
• Management--Management interfaces can be shared between logical devices. You can only assign one management interface per logical device.
• Cluster--Special interface type used for a clustered logical device. This type is automatically assigned to the cluster control link for inter-unit cluster communications. By default, the cluster control link is automatically created on Port-channel 48.
Jumbo Frame Support
The FXOS chassis has support for jumbo frames enabled by default. To enable jumbo frame support on a specific logical device installed on the FXOS chassis, you will need to configure the appropriate MTU settings for the interfaces on the logical device.
The maximum MTU that is supported for the application on the FXOS chassis is 9000.
Edit Interface Properties
Procedure
Step 1
Choose Interfaces to open the Interfaces page.
The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.
Step 2
Click Edit in the row for the interface you want to edit to open the Edit Interface dialog box.
Step 3
To enable the interface, check the Enable check box. To disable the interface, uncheck the Enable check box.
Step 4
(Optional) From the Type drop-down list, choose data to configure this interface as a data interface, or choose
mgmt to configure the interface as a management interface.
Note
Do not choose the Cluster type.
Step 5
(Optional) Select the speed of the interface from the Speed drop-down list.
Step 6
Click OK.
70
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Interface Management
Change the Administrative State of an Interface
Change the Administrative State of an Interface
Procedure
Step 1
Choose Interfaces to open the Interfaces page.
The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.
Step 2
For each interface whose administrative state you want to change, do one of the following:
• To set the administrative state of the interface to enabled, click the Disabled switch in the State column for the interface you want to enable to change the setting to Enabled. Click Yes to confirm the change.
The administrative state of the interface is changed to enabled. The corresponding interface in the visual representation changes from gray to green.
• To set the administrative state of the interface to disabled, click the Enabled switch in the State column for the interface you want to disable to change the setting to Disabled. Click Yes to confirm the change.
The administrative state of the interface is changed to disabled. The corresponding interface in the visual representation changes from green to gray.
Create a Port Channel
An EtherChannel (also known as a port-channel) can include up to 16 member interfaces of the same type.
When the FXOS chassis creates an EtherChannel, the EtherChannel stays in a Suspended state until you assign it to a logical device, even if the physical link is up. The EtherChannel will be brought out of this
Suspended state in the following situations:
• The EtherChannel is added as a data or management port for a standalone logical device
• The EtherChannell is added as a management or CCL port for a logical device that is part of a cluster
• The EtherChannell is added as a data port for a logical device that is part of a cluster and at least one security module has joined the cluster
Note that the EtherChannel does not come up until you assign it to a logical device. If the EtherChannel is removed from the logical device or the logical device is deleted, the EtherChannel will revert to a Suspended state.
Before You Begin
The FXOS chassis only supports EtherChannels in Active Link Aggregation Control Protocol (LACP) mode.
We suggest setting the connecting switch ports to Active mode for the best compatibility.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
71
Interface Management
Configuring Breakout Cables
Procedure
Step 1
Choose Interfaces to open the Interfaces page.
The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.
Step 2
Click Add Port Channel above the interfaces table to open the Add Port Channel dialog box.
Step 3
Enter an ID for the port channel in the Port Channel ID field. Valid values are between 1 and 47.
Port-channel 48 is reserved for the cluster control link when you deploy a clustered logical device. If you do not want to use Port-channel 48 for the cluster control link, you can configure an EtherChannel with a different
ID and choose the Cluster type for the interface. Do not assign any interfaces to the Cluster EtherChannel.
Step 4
To enable the port channel, check the Enable check box. To disable the port channel, uncheck the Enable check box.
Step 5
Select the type of port channel from the Type drop-down list: Data, Mgmt, or Cluster.
Step 6
If not selected, click the Interfaces tab.
Step 7
To add an interface to the port channel, select the interface in the Available Interface list and click Add
Interface to move the interface to the Member ID list. You can add up to 16 interfaces of the same type and speed.
Tip
You can add multiple interfaces at one time. To select multiple individual interfaces, click on the desired interfaces while holding down the Ctrl key. To select a range of interfaces, select the first interface in the range, and then, while holding down the Shift key, click to select the last interface in the range.
Step 8
To remove an interface from the port channel, click the Delete button to the right of the interface in the Member
ID list.
Step 9
Click the Settings tab.
Step 10 Select the speed of the port channel from the Speed drop-down list.
Step 11 Click OK.
Configuring Breakout Cables
The following procedure shows how to configure breakout cables for use with the FXOS chassis. You can use a breakout cable to provide four 10 Gbps ports in place of a single 40 Gbps port.
Procedure
Step 1
Choose Interfaces to open the Interfaces page.
The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.
The interfaces that are capable of supporting breakout cables but are not currently configured as such are indicated by a Breakout Port icon in the row for that interface. For interfaces that have already been configured as using a breakout cable, the individual breakout interfaces are listed separately (for example, Ethernet 2/1/1,
2/1/2, 2/1/3, and 2/1/4).
72
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Interface Management
Configuring Breakout Cables
Step 2
To convert a 40 Gbps interface into four 10 Gbps interfaces: a) Click the Breakout Port icon for the interface that you want to convert.
The Breakout Port Creation dialog box opens asking you to confirm that you want to proceed and warning you that the chassis will be rebooted.
b) Click Yes to confirm.
The Firepower chassis reboots and the specified interface is converted into four 10 Gbps interfaces.
Step 3
To convert the four 10 Gbps breakout interfaces back into a single 40 Gbps interface: a) Click Delete for any of the breakout interfaces.
A confirmation dialog box opens asking you to confirm that you want to proceed and warning you that all four breakout interfaces will be deleted and that the chassis will be rebooted.
b) Click Yes to confirm.
The Firepower chassis reboots and the specified interfaces are converted into a single 40 Gbps interface.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
73
Configuring Breakout Cables
Interface Management
74
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
8
Logical Devices
•
About Logical Devices, page 75
•
Create a Standalone Logical Device, page 77
•
•
Manage Logical Devices, page 91
About Logical Devices
When you create a logical device, the FXOS chassis supervisor deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine, or in the case of an intra-chassis cluster, to all security modules installed in the Firepower chassis.
You can create either of the following two types of logical devices:
• Standalone—You can create a standalone logical device for each security module/engine installed in the Firepower chassis.
• Cluster—Clustering lets you group multiple security modules together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. Multiple module devices, like the Firepower 9300, support intra-chassis clustering.
Note
On an FXOS chassis that supports multiple security modules, you can only create one type of logical device, standalone or cluster. In other words, if you have three security modules installed, you cannot create a standalone logical device on one security module and then create a cluster using the remaining two logical devices.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
75
Logical Devices
Logical Devices Page
Note
If you are configuring standalone logical devices, you must install the same software type on all modules in the chassis; different software types are not supported at this time. Note that modules can run different versions of a particular device type, but all modules must be configured as the same type of logical device.
Logical Devices Page
Use the Logical Devices page of the Firepower Chassis Manager to create, edit, and delete logical devices.
The Logical Devices page includes an informational area for the logical device(s) installed on each FXOS chassis security module/engine.
The header for each logical device area provides the following information:
• The unique name of the logical device.
• The name of the main application installed on the security module/engine, either ASA or FTD.
• The logical device mode, either Standalone or Clustered.
• Status—Shows the state of the logical device:
◦ok—The logical device configuration is complete.
◦incomplete-configuration—The logical device configuration is incomplete.
Each logical device area provides the following information:
• Security Module—Shows the security module.
• Ports—Shows the ports assigned to the application instance.
• Application—Shows the application running on the security module.
• Version—Shows the software version number of the application running on the security module.
• Management IP—Shows the local IP address assigned as the logical device Management IP.
• Management URL—Shows the management URL assigned to the application instance.
• Gateway—Shows the network gateway address assigned to the application instance.
• Management Port—Shows the management port assigned to the application instance.
• Status—Shows the state of the application instance:
◦Online—The application is running and operating.
◦Offline—The application is stopped and inoperable.
◦Installing—The application installation is in progress.
◦Not Installed—The application is not installed.
◦Install Failed—The application installation failed.
◦Starting—The application is starting up.
◦Start Failed—The application failed to start up.
76
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
Create a Standalone Logical Device
◦Started—The application started successfully, and is waiting for app agent heartbeat.
◦Stopping—The application is in the process of stopping.
◦Stop Failed—The application was unable to be brought offline.
◦Not Responding—The application is unresponsive.
◦Updating—The application software upgrade is in progress.
◦Update Failed—The application software upgrade failed.
◦Update Succeeded—The application software upgrade succeeded.
Create a Standalone Logical Device
You can create a standalone logical device for each security module/engine installed in the Firepower chassis.
Create a Standalone ASA Logical Device
You can create a standalone logical device for each security module/engine installed in the FXOS chassis.
On multiple module devices, like the Firepower 9300, you cannot create standalone logical devices if you have a cluster configured. You will need to delete the cluster before you can configure a standalone device.
Before You Begin
• If the security module/engine that you want to use for the logical device already has a logical device configured on it, you must first delete the existing logical device (see
Delete a Logical Device, on page
93 ).
• Download the application image you want to use for the logical device from Cisco.com (see
Images from Cisco.com, on page 30
) and then upload that image to the FXOS chassis (see
Uploading an Image to the Firepower Security Appliance, on page 30
).
• Configure a management interface to use with the logical device.
• You can only deploy a routed firewall mode ASA from the FXOS chassis. To change the ASA to transparent firewall mode, complete this procedure, and then see
Change the ASA to Transparent Firewall
.
Procedure
Step 1
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
77
Logical Devices
Deploy a Cluster
Step 2
Click Add Device to open the Add Device dialog box.
Step 3
For the Device Name, provide a name for the logical device.
Step 4
For the Template, choose Cisco Adaptive Security Appliance.
Step 5
For the Image Version, choose the ASA software version.
Step 6
For the Device Mode, click the Standalone radio button.
Step 7
Click OK.
You see the Provisioning - device name window.
Step 8
Expand the Data Ports area, and click each port that you want to assign to the device.
Step 9
Click the device icon in the center of the screen.
The ASA Configuration dialog box appears.
Step 10 On the General Information tab, complete the following: a) On multiple module devices, like the Firepower 9300, choose the security module that you want to use for this logical device by clicking on it under Security Module Selection.
b) Select the management interface to use with the logical device from the Management Interface drop-down list.
c) Under DEFAULT, configure the management interface:
This information is used to configure a management interface in the security module/engine configuration.
This management IP address is also the IP address you will use to connect to ASDM.
1
Select the type of address from the Address Type drop-down list.
2
In the Management IP field, configure a local IP address.
3
Enter a Network Mask or Prefix Length.
4
Enter a Network Gateway address.
Step 11 On the Settings tab, enter a password for the "admin" user in the Password field.
Step 12 Click OK to close the ASA Configuration dialog box.
Step 13 Click Save.
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine.
Deploy a Cluster
Clustering lets you group multiple devices together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. The Firepower 9300, which includes multiple modules, supports intra-chassis clustering where you group all modules within a single chassis into a cluster. You can also use inter-chassis clustering, where multiple chassis are grouped together.
78
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
About Clustering on the FXOS Chassis
Note
The Firepower Threat Defense does not support a cluster across multiple chassis (inter-chassis); only intra-chassis clustering is supported.
About Clustering on the FXOS Chassis
The cluster consists of multiple devices acting as a single logical unit. When you deploy a cluster on the FXOS chassis, it does the following:
• Creates a cluster-control link (by default, port-channel 48) for unit-to-unit communication. For intra-chassis clustering, this link utilizes the Firepower 9300 backplane for cluster communications. For inter-chassis clustering, you need to manually assign physical interface(s) to this EtherChannel for communications between chassis.
• Creates the cluster bootstrap configuration within the application.
When you deploy the cluster, the FXOS chassis supervisor pushes a minimal bootstrap configuration to each unit that includes the cluster name, cluster control link interface, and other cluster settings. Some parts of the bootstrap configuration may be user-configurable within the application if you want to customize your clustering environment.
• Assigns data interfaces to the cluster as Spanned interfaces.
For intra-chassis clustering, spanned interfaces are not limited to EtherChannels, like it is for inter-chassis clustering.The Firepower 9300 supervisor uses EtherChannel technology internally to load-balance traffic to multiple modules on a shared interface, so any data interface type works for Spanned mode.
For inter-chassis clustering, you must use Spanned EtherChannels for all data interfaces.
Note
Individual interfaces are not supported, with the exception of a management interface.
• Assigns a management interface to all units in the cluster.
The following sections provide more detail about clustering concepts and implementation.
Primary and Secondary Unit Roles
One member of the cluster is the primary unit. The primary unit is determined automatically. All other members are secondary units.
You must perform all configuration on the primary unit only; the configuration is then replicated to the secondary units.
Cluster Control Link
The cluster control link is automatically created using the Port-channel 48 interface. For intra-chassis clustering, this interface has no member interfaces. For inter-chassis clustering, you must add one or more interfaces to the EtherChannel. This Cluster type EtherChannel utilizes the Firepower 9300 backplane for cluster communications for intra-chassis clustering.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
79
Logical Devices
About Clustering on the FXOS Chassis
For a 2-member inter-chassis cluster, do not directly connect the cluster control link from one chassis to the other chassis. If you directly connect the interfaces, then when one unit fails, the cluster control link fails, and thus the remaining healthy unit fails. If you connect the cluster control link through a switch, then the cluster control link remains up for the healthy unit.
Cluster control link traffic includes both control and data traffic.
Size the Cluster Control Link for Inter-Chassis Clustering
If possible, you should size the cluster control link to match the expected throughput of each chassis so the cluster-control link can handle the worst-case scenarios.
Cluster control link traffic is comprised mainly of state update and forwarded packets. The amount of traffic at any given time on the cluster control link varies. The amount of forwarded traffic depends on the load-balancing efficacy or whether there is a lot of traffic for centralized features. For example:
• NAT results in poor load balancing of connections, and the need to rebalance all returning traffic to the correct units.
• When membership changes, the cluster needs to rebalance a large number of connections, thus temporarily using a large amount of cluster control link bandwidth.
A higher-bandwidth cluster control link helps the cluster to converge faster when there are membership changes and prevents throughput bottlenecks.
Note
If your cluster has large amounts of asymmetric (rebalanced) traffic, then you should increase the cluster control link size.
Cluster Control Link Redundancy for Inter-Chassis Clustering
The following diagram shows how to use an EtherChannel as a cluster control link in a Virtual Switching
System (VSS) or Virtual Port Channel (vPC) environment. All links in the EtherChannel are active. When the switch is part of a VSS or vPC, then you can connect FXOS chassis interfaces within the same EtherChannel to separate switches in the VSS or vPC. The switch interfaces are members of the same EtherChannel port-channel interface, because the separate switches act like a single switch. Note that this EtherChannel is device-local, not a Spanned EtherChannel.
80
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
About Clustering on the FXOS Chassis
Cluster Control Link Reliability for Inter-Chassis Clustering
To ensure cluster control link functionality, be sure the round-trip time (RTT) between units is less than 20 ms. This maximum latency enhances compatibility with cluster members installed at different geographical sites. To check your latency, perform a ping on the cluster control link between units.
The cluster control link must be reliable, with no out-of-order or dropped packets; for example, for inter-site deployment, you should use a dedicated link.
Cluster Control Link Network
The FXOS chassis auto-generates the cluster control link interface IP address for each unit based on the chassis
ID and slot ID: 127.2.chassis_id.slot_id. You cannot set this IP address manually, either in FXOS or within the application. The cluster control link network cannot include any routers between units; only Layer 2 switching is allowed. For inter-site traffic, Cisco recommends using Overlay Transport Virtualization (OTV).
Management Network
We recommend connecting all units to a single management network. This network is separate from the cluster control link.
Management Interface
You can assign a Management type interface to the cluster. This interface is a special individual interface as opposed to a Spanned interface. The management interface lets you connect directly to each unit.
For the ASA, the Main cluster IP address is a fixed address for the cluster that always belongs to the current primary unit. You also configure a range of addresses so that each unit, including the current primary unit, can use a Local address from the range. The Main cluster IP address provides consistent management access to an address; when a primary unit changes, the Main cluster IP address moves to the new primary unit, so management of the cluster continues seamlessly. The Local IP address is used for routing, and is also useful for troubleshooting. For example, you can manage the cluster by connecting to the Main cluster IP address, which is always attached to the current primary unit. To manage an individual member, you can connect to the Local IP address. For outbound management traffic such as TFTP or syslog, each unit, including the primary unit, uses the Local IP address to connect to the server.
Spanned EtherChannels
You can group one or more interfaces per chassis into an EtherChannel that spans all chassis in the cluster.
The EtherChannel aggregates the traffic across all the available active interfaces in the channel. A Spanned
EtherChannel can be configured in both routed and transparent firewall modes. In routed mode, the
EtherChannel is configured as a routed interface with a single IP address. In transparent mode, the IP address is assigned to the BVI, not to the bridge group member interface. The EtherChannel inherently provides load balancing as part of basic operation.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
81
Logical Devices
Prerequisites for Clustering
Inter-Site Clustering
For inter-site installations, you can take advantage of clustering as long as you follow the recommended guidelines.
You can configure each cluster chassis to belong to a separate site ID.
Site IDs work with site-specific MAC addresses. Packets sourced from the cluster use a site-specific MAC address, while packets received by the cluster use a global MAC address. This feature prevents the switches from learning the same global MAC address from both sites on two different ports, which causes MAC flapping; instead, they only learn the site MAC address. Site-specific MAC addresses are supported for routed mode using Spanned EtherChannels only.
Site IDs are also used to enable flow mobility using LISP inspection.
See the following sections for more information about inter-site clustering:
• Sizing the Data Center Interconnect—
Prerequisites for Clustering, on page 82
• Inter-Site Guidelines—
Guidelines for Clustering, on page 84
• Inter-Site Examples— Examples for Inter-Site Clustering, on page 89
Prerequisites for Clustering
Inter-Chassis Hardware and Software Requirements
All chassis in a cluster:
• All security modules must be the same type. You can have different quantities of installed security modules in each chassis, although all modules present in the chassis must belong to the cluster including any empty slots.
82
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
Prerequisites for Clustering
• Must run the identical FXOS software except at the time of an image upgrade.
• Must include the same interface configuration for interfaces you assign to the cluster, such as the same
Management interface, EtherChannels, active interfaces, speed and duplex, and so on. You can use different network module types on the chassis as long as the capacity matches for the same interface
IDs and interfaces can successfully bundle in the same spanned EtherChannel. Note that all data interfaces must be EtherChannels in inter-chassis clustering.
• Must use the same NTP server. Do not set the time manually.
• Must be registered with the License Authority when using the ASA; for Firepower Threat Defense, all licensing is handled by the Firepower Management Center.
Switch Prerequisites for Inter-Chassis Clustering
• Be sure to complete the switch configuration and successfully connect all the EtherChannels from the chassis to the switch(es) before you configure clustering on the FXOS chassis.
• For a list of supported switches, see Cisco FXOS Compatibility .
Sizing the Data Center Interconnect for Inter-Site Clustering
You should reserve bandwidth on the data center interconnect (DCI) for cluster control link traffic equivalent to the following calculation:
If the number of members differs at each site, use the larger number for your calculation. The minimum bandwidth for the DCI should not be less than the size of the cluster control link for one member.
For example:
• For 4 members at 2 sites:
◦4 cluster members total
◦2 members at each site
◦5 Gbps cluster control link per member
Reserved DCI bandwidth = 5 Gbps (2/2 x 5 Gbps).
• For 6 members at 3 sites, the size increases:
◦6 cluster members total
◦3 members at site 1, 2 members at site 2, and 1 member at site 3
◦10 Gbps cluster control link per member
Reserved DCI bandwidth = 15 Gbps (3/2 x 10 Gbps).
• For 2 members at 2 sites:
◦2 cluster members total
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
83
Logical Devices
Guidelines for Clustering
◦1 member at each site
◦10 Gbps cluster control link per member
Reserved DCI bandwidth = 10 Gbps (1/2 x 10 Gbps = 5 Gbps; but the minimum bandwidth should not be less than the size of the cluster control link (10 Gbps)).
Guidelines for Clustering
Switches for Inter-Chassis Clustering
• For the ASR 9006, if you want to set a non-default MTU, set the ASR interface MTU to be 14 bytes higher than the cluster device MTU. Otherwise, OSPF adjacency peering attempts may fail unless the
mtu-ignore option is used. Note that the cluster device MTU should match the ASR IPv4 MTU.
• On the switch(es) for the cluster control link interfaces, you can optionally enable Spanning Tree PortFast on the switch ports connected to the cluster unit to speed up the join process for new units.
• When you see slow bundling of a Spanned EtherChannel on the switch, you can enable LACP rate fast for an individual interface on the switch.
• On the switch, we recommend that you use one of the following EtherChannel load-balancing algorithms:
source-dest-ip or source-dest-ip-port (see the Cisco Nexus OS and Cisco IOS port-channel
load-balance command). Do not use a vlan keyword in the load-balance algorithm because it can cause unevenly distributed traffic to the devices in a cluster. Do not change the load-balancing algorithm from the default on the cluster device.
• If you change the load-balancing algorithm of the EtherChannel on the switch, the EtherChannel interface on the switch temporarily stops forwarding traffic, and the Spanning Tree Protocol restarts. There will be a delay before traffic starts flowing again.
• Switches on the cluster control link path should not verify the L4 checksum. Redirected traffic over the cluster control link does not have a correct L4 checksum. Switches that verify the L4 checksum could cause traffic to be dropped.
• Port-channel bundling downtime should not exceed the configured keepalive interval.
• On Supervisor 2T EtherChannels, the default hash distribution algorithm is adaptive. To avoid asymmetric traffic in a VSS design, change the hash algorithm on the port-channel connected to the cluster device to fixed: router(config)# port-channel id hash-distribution fixed
Do not change the algorithm globally; you may want to take advantage of the adaptive algorithm for the
VSS peer link.
EtherChannels for Inter-Chassis Clustering
• For connecting switches, set the EtherChannel mode to Active; On mode is not supported on the FXOS chassis, even for the cluster control link.
• FXOS EtherChannels have the LACP rate set to normal by default. This setting can make port-channel members take more than 30 seconds to bundle, which can cause the cluster interface health check to fail
84
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
Guidelines for Clustering
causing the unit to be removed from the cluster. We recommend that you change the LACP rate to fast.
The following example modifies the "default" lacp policy: firepower#
scope org
firepower /org #
scope lacppolicy default
firepower /org/lacppolicy#
set lacp-rate fast
firepower /org* #
commit-buffer
• In Catalyst 3750-X Cisco IOS software versions earlier than 15.1(1)S2, the cluster unit did not support connecting an EtherChannel to a switch stack. With default switch settings, if the cluster unit EtherChannel is connected cross stack, and if the master switch is powered down, then the EtherChannel connected to the remaining switch will not come up. To improve compatibility, set the stack-mac persistent timer command to a large enough value to account for reload time; for example, 8 minutes or 0 for indefinite.
Or, you can upgrade to more a more stable switch software version, such as 15.1(1)S2.
• Spanned vs. Device-Local EtherChannel Configuration—Be sure to configure the switch appropriately for Spanned EtherChannels vs. Device-local EtherChannels.
◦Spanned EtherChannels—For cluster unit Spanned EtherChannels, which span across all members of the cluster, the interfaces are combined into a single EtherChannel on the switch. Make sure each interface is in the same channel group on the switch.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
85
Defaults for Clustering
Logical Devices
◦Device-local EtherChannels—For cluster unit Device-local EtherChannels including any
EtherChannels configured for the cluster control link, be sure to configure discrete EtherChannels on the switch; do not combine multiple cluster unit EtherChannels into one EtherChannel on the switch.
Additional Guidelines
• We recommend connecting EtherChannels to a VSS or vPC for redundancy.
• Within a chassis, you cannot cluster some security modules and run other security modules in standalone mode; you must include all security modules in the cluster.
Defaults for Clustering
The cluster control link uses Port-channel 48.
86
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
Configure ASA Clustering
Configure ASA Clustering
You can easily deploy the cluster from the FXOS chassis supervisor. All initial configuration is automatically generated for each unit. For inter-chassis clustering, you must configure each chassis separately. Deploy the cluster on one chassis; you can then copy the bootstrap configuration from the first chassis to the next chassis for ease of deployment.
Before You Begin
• You must enable clustering for all 3 module slots in a Firepower 9300 chassis, even if you do not have a module installed. If you do not configure all 3 modules, the cluster will not come up.
• On the Interfaces tab, the port-channel 48 cluster type interface shows the Operation State as failed if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not require any member interfaces, and you can ignore this Operational State.
• You can only deploy a routed firewall mode ASA cluster from the FXOS chassis. To change the ASA cluster to transparent firewall mode, complete this procedure, and then see
.
Procedure
Step 1
Add at least one Data type interface or EtherChannel (also known as a port-channel) before you deploy the cluster. See
Create a Port Channel, on page 71
or
Edit Interface Properties, on page 70
.
You can also add data interfaces to the cluster after you deploy it.
For inter-chassis clustering, all data interfaces must be EtherChannels with at least one member interface.
Add the same EtherChannels on each chassis.
Step 2
Add a Management type interface or EtherChannel. See
Create a Port Channel, on page 71
or
.
For inter-chassis clustering, add the same Management interface on each chassis.
Step 3
For inter-chassis clustering, add a member interface to port-channel 48, which is used as the cluster control link.
If you do not include a member interface, then when you deploy the logical device, the Firepower Chassis
Manager assumes that this cluster is an intra-chassis cluster and does not show the Chassis ID field. Add the same member interfaces on each chassis.
Step 4
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 5
Click Add Device to open the Add Device dialog box.
If you have an existing cluster, you are prompted to remove the cluster and add a new one. All cluster-related configuration on the security modules will be replaced by the new information.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
87
Logical Devices
Configure ASA Clustering
Step 6
For the Device Name, provide a name for the logical device. This name is used by the FXOS chassis supervisor to configure clustering settings and assign interfaces; it is not the cluster name used in the security module configuration.
Step 7
For the Template, choose Cisco Adaptive Security Appliance.
Step 8
For the Image Version, choose the ASA software version.
Step 9
For the Device Mode, click the Cluster radio button.
Step 10 Click the Create New Cluster radio button.
Step 11 Click OK.
If you have any standalone devices configured, you are prompted to replace them with a new cluster. You see the Provisioning - device name window.
All interfaces are assigned to the cluster by default.
Step 12 Click the device icon in the center of the screen.
The ASA Configuration dialog box appears with the Cluster Information tab selected.
Step 13 In the Chassis ID field, enter a chassis ID. Each chassis in the cluster must use a unique ID.
Step 14 In the Cluster Key field, configure an authentication key for control traffic on the cluster control link.
The shared secret is an ASCII string from 1 to 63 characters. The shared secret is used to generate the key.
This option does not affect datapath traffic, including connection state update and forwarded packets, which are always sent in the clear.
Step 15 Set the Cluster Group Name, which is the cluster group name in the security module configuration.
The name must be an ASCII string from 1 to 38 characters.
Step 16 Click Management Interface and choose the management interface you created earlier.
Step 17 Choose the Address Type for the management interface.
This information is used to configure a management interface in the security module configuration.
a) In the Management IP Pool field, configure a pool of Local IP addresses, one of which will be assigned to each cluster unit for the interface, by entering the starting and ending addresses separated by a hyphen.
Include at least as many addresses as there are units in the cluster. Note that for the Firepower 9300, you must include 3 addresses per chassis, even if you do not have all module slots filled. If you plan to expand the cluster, include additional addresses. The Virtual IP address (known as the Main cluster IP address) that belongs to the current primary unit is not a part of this pool; be sure to reserve an IP address on the same network for the Main cluster IP address. You can use IPv4 and/or IPv6 addresses.
b) Enter a Network Mask or Prefix Length.
c) Enter a Network Gateway.
d) Enter a Virtual IP address.
This IP address must be on the same network as the cluster pool addresses, but not be part of the pool.
Step 18 On the Settings tab, for the Password, enter a password for the "admin" user.
Step 19 Click OK to close the ASA Configuration dialog box.
Step 20 Click Save.
The FXOS chassis supervisor deploys the cluster by downloading the specified software version and pushing the cluster bootstrap configuration and management interface settings to each security module.
Step 21 For inter-chassis clustering, add the next chassis to the cluster: a) On the first chassis Firepower Chassis Manager, click the Show Cluster Details icon at the top right; copy the displayed cluster configuration.
88
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
Examples for Inter-Site Clustering
b) Connect to the Firepower Chassis Manager on the next chassis, and add a logical device according to this procedure.
c) Choose Join an Existing Cluster.
d) Click the Copy config check box, and click OK. If you uncheck this check box, you must manually enter the settings to match the first chassis configuration.
e) In the Copy Cluster Details box, paste in the cluster configuration from the first chassis, and click OK.
f) Click the device icon in the center of the screen. The cluster information is mostly pre-filled, but you must change the following settings:
• Chassis ID—Enter a unique chassis ID.
• Cluster Key—(Not prefilled) Enter the same cluster key.
Click OK.
g) Click Save.
Step 22 Connect to the primary unit security module to customize your clustering configuration.
Examples for Inter-Site Clustering
The following examples show supported cluster deployments.
Spanned EtherChannel Transparent Mode North-South Inter-Site Example
The following example shows 2 cluster members at each of 2 data centers placed between inside and outside routers (North-South insertion). The cluster members are connected by the cluster control link over the DCI.
The cluster members at each site connect to the local switches using spanned EtherChannels for the inside and outside. Each EtherChannel is spanned across all chassis in the cluster.
The inside and outside routers at each data center use OSPF, which is passed through the transparent ASAs.
Unlike MACs, router IPs are unique on all routers. By assigning a higher cost route across the DCI, traffic stays within each data center unless all cluster members at a given site go down. The lower cost route through the ASAs must traverse the same bridge group at each site for the cluster to maintain asymmetric connections.
In the event of a failure of all cluster members at one site, traffic goes from each router over the DCI to the cluster members at the other site.
The implementation of the switches at each site can include:
• Inter-site VSS/vPC—In this scenario, you install one switch at Data Center 1, and the other at Data
Center 2. One option is for the cluster units at each Data Center to only connect to the local switch, while the VSS/vPC traffic goes across the DCI. In this case, connections are for the most part kept local to each datacenter. You can optionally connect each unit to both switches across the DCI if the DCI can handle the extra traffic. In this case, traffic is distributed across the data centers, so it is essential for the
DCI to be very robust.
• Local VSS/vPC at each site—For better switch redundancy, you can install 2 separate VSS/vPC pairs at each site. In this case, although the cluster units still have a spanned EtherChannel with Data Center
1 chassis connected only to both local switches, and Data Center 2 chassis connected to those local switches, the spanned EtherChannel is essentially “split.” Each local VSS/vPC sees the spanned
EtherChannel as a site-local EtherChannel.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
89
Examples for Inter-Site Clustering
Logical Devices
Spanned EtherChannel Transparent Mode East-West Inter-Site Example
The following example shows 2 cluster members at each of 2 data centers placed between the gateway router and two inside networks at each site, the App network and the DB network (East-West insertion). The cluster members are connected by the cluster control link over the DCI. The cluster members at each site connect to the local switches using spanned EtherChannels for both the App and DB networks on the inside and outside.
Each EtherChannel is spanned across all chassis in the cluster.
The gateway router at each site uses an FHRP such as HSRP to provide the same destination virtual MAC and IP addresses at each site. A good practice to avoid unintended MAC address flapping is to statically add the gateway routers real MAC addresses to the ASA MAC address table. Without these entries, if the gateway at site 1 communicates with the gateway at site 2, that traffic might pass through the ASA and attempt to reach site 2 from the inside interface and cause problems. The data VLANs are extended between the sites using
Overlay Transport Virtualization (OTV) (or something similar). You must add filters to prevent traffic from traversing the DCI to the other site when the traffic is destined for the gateway router. If the gateway router at one site becomes unreachable, you must remove the filters so traffic can be sent to the other site’s gateway router.
90
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
History for Clustering
See
Spanned EtherChannel Transparent Mode North-South Inter-Site Example, on page 89
for information about vPC/VSS options.
History for Clustering
Feature Name Platform
Releases
Feature Information
Intra-chassis Clustering for the Cisco ASA
1.1.1
You can cluster all ASA security modules within the Firepower 9300 chassis.
We introduced the following screen: Logical Devices > Configuration
Inter-chassis clustering for
6 ASA modules
1.1.3
You can now enable inter-chassis clustering for the ASA. You can include up to 6 modules in up to 6 chassis.
We modified the following screen: Logical Devices > Configuration
Manage Logical Devices
You can delete a logical device, convert an ASA to transparent mode, change the interface configuration, and perform other tasks on existing logical devices.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
91
Logical Devices
Connect to the Console of the Application or Decorator
Connect to the Console of the Application or Decorator
Use the following procedure to connect to the console of the application or decorator.
Note
If you encounter any issues with accessing the console, we recommend that you try a different SSH client or upgrade your SSH client to a newer version.
Procedure
Step 1
To connect to the console of the application or decorator: a) From the FXOS CLI, connect to the security module/engine:
Firepower-chassis # connect module slot_number console
Note
To connect to the security engine of a device that does not support multiple security modules, use 1 as the slot_number.
The first time you connect to the security module, you access the FXOS module CLI.
b) To connect to the application or decorator, enter:
Firepower-module1>connect asa
Subsequent connections from the supervisor level of the FXOS CLI to the security module/engine access the security module/engine OS directly.
Step 2
(Optional) Exit the application console to the FXOS module CLI by typing Ctrl-A-D.
You might want to access the FXOS module CLI for troubleshooting purposes.
Step 3
Return to the supervisor level of the FXOS CLI.
a) To exit the security module/engine console, type ~.
You exit to the Telnet application.
b) To exit the Telnet application, enter: telnet>quit
Example
The following example connects to an ASA on security module 1 and then exits back to the supervisor level of the FXOS CLI.
Firepower#
connect module 1 console
Telnet escape character is '~'.
Trying 127.5.1.1...
Connected to 127.5.1.1.
Escape character is '~'.
CISCO Serial Over LAN:
Close Network Connection to Exit
Firepower-module1>
connect asa
asa>
~
telnet>
quit
92
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
Delete a Logical Device
Connection closed.
Firepower#
Delete a Logical Device
Procedure
Step 1
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 2
Click Delete for the logical device that you want to delete.
Step 3
Click Yes to confirm that you want to delete the logical device.
Step 4
Click Yes to confirm that you want to delete the application configuration.
Change the ASA to Transparent Firewall Mode
You can only deploy a routed firewall mode ASA from the FXOS chassis. To change the ASA to transparent firewall mode, complete the initial deployment, and then change the firewall mode within the ASA CLI.
Because changing the firewall mode erases the configuration, you must then redeploy the configuration from the FXOS chassis to regain the bootstrap configuration. The ASA then remains in transparent mode with a working bootstrap configuration.
Procedure
Step 1
Connect to the ASA console according to
Connect to the Console of the Application or Decorator, on page
92 . For a cluster, connect to the primary unit. For a failover pair, connect to the active unit.
Step 2
Enter configuration mode:
enable configure terminal
By default, the enable password is blank.
Step 3
Set the firewall mode to transparent:
firewall transparent
Step 4
Save the configuration:
write memory
For a cluster or failover pair, this configuration is replicated to secondary units: asa(config)# firewall transparent asa(config)# write memory
Building configuration...
Cryptochecksum: 9f831dfb 60dffa8c 1d939884 74735b69
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
93
Logical Devices
Change an Interface on a Firepower Threat Defense Logical Device
3791 bytes copied in 0.160 secs
[OK] asa(config)#
Beginning configuration replication to Slave unit-1-2
End Configuration Replication to slave.
asa(config)#
Step 5
On the Firepower Chassis Manager Logical Devices page, click the Edit icon to edit the ASA.
The Provisioning page appears.
Step 6
Click the device icon to edit the bootstrap configuration. Change any value in your configuration, and click
OK.
You must change the value of at least one field. Cisco recommends changing the Password to a new password because this setting is not important.
You see a warning about changing the bootstrap configuration; click Yes.
Step 7
Click Save to redeploy the configuration to the ASA.For an inter-chassis cluster or for a failover pair, repeat steps 5 through 7 to redeploy the bootstrap configuration on each chassis.
Wait several minutes for the chassis/security modules to reload, and for the ASA to to become operational again. The ASA now has an operational bootstrap configuration, but remains in transparent mode.
Change an Interface on a Firepower Threat Defense Logical Device
You can allocate or unallocate an interface, or replace a management interface on a Firepower Threat Defense logical device. You can then sync the interface configuration in the Firepower Management Center.
Before You Begin
• Configure your interfaces, and add any EtherChannels according to
Edit Interface Properties, on page
70 and
Create a Port Channel, on page 71
.
• You can edit the membership of an allocated EtherChannel without affecting the logical device or requiring a sync on the Firepower Management Center.
• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are allocated by default to a cluster), you need to unallocate the interface from the logical device first, then add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel to the device.
• If you want to replace the management or firepower eventing interface with a management EtherChannel, then you need to create the EtherChannel with at least 1 unallocated data member interface, and then replace the current management interface with the EtherChannel. After the Firepower Threat Defense device reboots (management interface changes cause a reboot), and you sync the configuration in the
Firepower Management Center, you can add the (now unallocated) management interface to the
EtherChannel as well.
• For clustering or High Availability, make sure you add or remove the interface on all units before you sync the configuration in the Firepower Management Center. Note that new interfaces are added in an administratively down state, so they do not affect interface monitoring.
94
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Logical Devices
Change an Interface on an ASA Logical Device
Procedure
Step 1
In the Firepower Chassis Manager, choose Logical Devices.
Step 2
Click the Edit icon at the top right to edit the logical device.
Step 3
Unallocate a data interface by de-selecting the interface in the Data Ports area.
Step 4
Allocate a new data interface by selecting the interface in the Data Ports area.
Step 5
Replace the management or eventing interface:
For these types of interfaces, the device reboots after you save your changes.
a) Click the device icon in the center of the page.
b) On the General/Cluster Information tab, choose the new Management Interface from the drop-down list.
c) On the Settings tab, choose the new Eventing Interface from the drop-down list.
d) Click OK.
If you change the IP address of the Management interface, then you must also change the IP address for the device in the Firepower Management Center: go to Devices > Device Management > Device/Cluster. In the
Management area, set the IP address to match the bootstrap configuration address.
Step 6
Click Save.
Step 7
Log into the Firepower Management Center.
Step 8
Select Devices > Device Management and click the edit icon ( ) for your Firepower Threat Defense device.
The Interfaces tab is selected by default.
Step 9
Click the Sync Interfaces from device button on the top left of the Interfaces tab.
Step 10 Click Save.
You can now click Deploy and deploy the policy to assigned devices. The changes are not active until you deploy them.
Change an Interface on an ASA Logical Device
You can allocate, unallocate, or replace a management interface on an ASA logical device. ASDM discovers the new interfaces automatically.
Before You Begin
• Configure your interfaces and add any EtherChannels according to
Edit Interface Properties, on page
70 and
Create a Port Channel, on page 71
.
• You can edit the membership of an allocated EtherChannel without affecting the logical device.
• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are allocated by default to a cluster), you need to unallocate the interface from the logical device first, then add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel to the device.
• If you want to replace the management interface with a management EtherChannel, then you need to create the EtherChannel with at least 1 unallocated data member interface, and then replace the current
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
95
Logical Devices
Change an Interface on an ASA Logical Device
management interface with the EtherChannel. After the ASA reloads (management interface changes cause a reload), you can add the (now unallocated) management interface to the EtherChannel as well.
• For clustering or failover, new interfaces are added in an administratively down state, so they do not affect interface monitoring.
Procedure
Step 1
In the Firepower Chassis Manager, choose Logical Devices.
Step 2
Click the Edit icon at the top right to edit the logical device.
Step 3
Unallocate a data interface by de-selecting the interface in the Data Ports area.
Step 4
Allocate a new data interface by selecting the interface in the Data Ports area.
Step 5
Replace the management interface:
For this type of interface, the device reloads after you save your changes.
a) Click the device icon in the center of the page.
b) On the General/Cluster Information tab, choose the new Management Interface from the drop-down list.
c) Click OK.
Step 6
Click Save.
96
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
9
Security Module/Engine Management
•
About FXOS Security Modules/Security Engine, page 97
•
Decommissioning/Recommissioning a Security Module, page 98
•
Acknowledging a Security Module/Engine, page 99
•
Resetting a Security Module/Engine, page 99
•
Reinitializing a Security Module/Engine, page 100
•
Powering On/Off a Security Module/Engine, page 100
About FXOS Security Modules/Security Engine
From the Security Modules/Security Engine page of the Firepower Chassis Manager, you can view the status of and can perform the following functions on a security module/engine:
• Decommission/Recommission (security modules only)—Decommissioning a security module places the security module into maintenance mode. You can also decommission and then recommission a security module in order to correct certain fault states. See
Decommissioning/Recommissioning a Security
.
• Acknowledge—Brings newly installed security modules online. See
.
• Power Cycle—Restarts the security module/engine. See
Resetting a Security Module/Engine, on page
99 .
• Reinitialize—Reformats the security module/engine hard disk, removing all deployed applications and configurations from the security module/engine, and then restarts the system. After reinitialization has completed, if a logical device is configured for the security module/engine, the Firepower eXtensible
Operating System will reinstall the application software, redeploy the logical device, and auto start the application. See
Reinitializing a Security Module/Engine, on page 100
.
Warning
All application data on the security module/engine is deleted during reinitialization.
Please back up all application data before reinitializing a security module/engine.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
97
Security Module/Engine Management
Decommissioning/Recommissioning a Security Module
• Power off/on—Toggles the power state for the security module/engine. See
.
The Security Modules/Security Engine page provides the following information:
• Hardware State—Shows the state of the security module/engine hardware.
◦Up—The security module/engine has powered up successfully and is not showing any hardware faults.
◦Booting Up—The security module/engine is in the process of powering up.
◦Down—The security module/engine is not powered on or a hardware fault is preventing the security module/engine from starting successfully.
◦Unassociated—The security module/engine does not have a logical device associated with it.
◦Mismatch—The security module has been decommissioned or a new security module was installed into the slot. Use the Recommission or Acknowledge function to return the security module to a functioning state.
• Service State—Shows the state of the software on the security module/engine:
◦Not-available—The security module has been removed from the chassis slot. Reinstall the security module to return it to its normal operational state.
◦Offline—The security module/engine is installed but has been decommissioned, has been powered off, or is still in the process of powering up.
◦Online—The security module/engine is installed and is in normal operation mode.
◦Not Responding—The security module/engine is unresponsive.
◦Fault—The security module/engine is in a fault state. Review the system fault listing for more information about what might be causing the fault state.
◦Token Mismatch—Indicates that a security module other than the one previously configured has been installed into the chassis slot. This could also be caused by a software installation error. Use the Reinitialize function to return the security module to a functioning state.
• Power—Shows the power status of the security module/engine:
◦On—Use the Power off/on function to toggle the power status for the security module/engine.
◦Off—Use the Power off/on function to toggle the power status for the security module/engine.
• Application—Shows the logical device type that is installed on the security module/engine.
Decommissioning/Recommissioning a Security Module
When you decommission a security module, the security module object is deleted from the configuration and the security module becomes unmanaged. Any logical devices or software running on the security module will become inactive.
You can decommission a security module if you want to temporarily discontinue use of the security module.
Also, if restarting a security module cannot correct an error condition, you can try decommissioning and then
98
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Security Module/Engine Management
Acknowledging a Security Module/Engine
recommissioning the security module to see if you can correct the error condition without having to reinitalize the security module.
Procedure
Step 1
Choose Security Modules to open the Security Modules page.
Step 2
To decommission a security module, click Decommission for that security module.
To recommission a security module, click Recommission for that security module.
Step 3
Click Yes to verify that you want to decommission or recommission the specified security module.
Acknowledging a Security Module/Engine
When a new security module is installed into the chassis, you must acknowledge the security module before you can begin using it.
If the security module is showing a status of "mismatch" or "token mismatch", this is an indication that the security module installed in the slot has data on it that does not match what was previously installed in the slot. If the security module has existing data on it and you are sure you want to use it in the new slot (in other words, the security module wasn't inadvertently installed into the wrong slot), you must reinitialize the security module before you can deploy a logical device to it.
Procedure
Step 1
Choose Security Modules/Security Engine to open the Security Modules/Security Engine page.
Step 2
Click Acknowledge for the security module/engine that you want to acknowledge.
Step 3
Click Yes to verify that you want to acknowledge the specified security module/engine.
Resetting a Security Module/Engine
Procedure
Step 1
Choose Security Modules/Security Engine to open the Security Modules/Security Engine page.
Step 2
Click Power Cycle for the security module/engine that you want to reset.
Step 3
Click Yes to verify that you want to reset the specified security module/engine.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
99
Security Module/Engine Management
Reinitializing a Security Module/Engine
Reinitializing a Security Module/Engine
When a security module/engine is reinitialized, the security module/engine hard disk is formatted and all installed application instances and configurations are removed. After reinitialization has completed, if a logical device is configured for the security module/engine, the Firepower eXtensible Operating System will reinstall the application software, redeploy the logical device, and auto start the application.
Warning
All application data on the security module/engine is deleted during reinitialization. Please back up all application data before reinitializing a security module/engine.
Procedure
Step 1
Choose Security Modules/Security Engine to open the Security Modules/Security Engine page.
Step 2
Click Reinitialize for the security module/engine that you want to reinitialize.
Step 3
Click Yes to verify that you want to reinitialize the specified security module/engine.
The security module/engine is restarted and all data on the security module is deleted. This process can take several minutes.
Powering On/Off a Security Module/Engine
Procedure
Step 1
Choose Security Modules/Security Engine to open the Security Modules/Security Engine page.
Step 2
To power off a security module/engine: a) Click Power off for that security module/engine.
b) Click Yes to verify that you want to power off the specified security module/engine.
Step 3
To power on a security module/engine: a) Click Power on for that security module/engine.
b) Click Yes to verify that you want to power on the specified security module/engine.
100
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
10
Configuration Import/Export
•
About Configuration Import/Export, page 101
•
Exporting a Configuration File, page 102
•
Importing a Configuration File, page 102
About Configuration Import/Export
You can use the configuration export feature to export an XML file containing logical device and platform configuration settings for your FXOS chassis to a remote server or your local computer. You can later import that configuration file to quickly apply the configuration settings to your FXOS chassis to return to a known good configuration or to recover from a system failure.
Guidelines and Restrictions
• Do not modify the contents of the configuration file. If a configuration file is modified, configuration import using that file might fail.
• Application-specific configuration settings are not contained in the configuration file. You must use the configuration backup tools provided by the application to manage application-specific settings and configurations.
• When you import a configuration to the FXOS chassis, all existing configuration on the FXOS chassis
(including any logical devices) will be deleted and completely replaced by the configuration contained in the import file.
• We recommend that you only import a configuration file to the same FXOS chassis from which the configuration was exported.
• The platform software version of the FXOS chassis to which you are importing should be the same version as when the export was taken. If not, the import operation is not guaranteed to be successful.
We recommend that you export a backup configuration whenever the FXOS chassis is upgraded or downgraded.
• The FXOS chassis to which you are importing must have the same Network Modules installed in the same slots as when the export was taken.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
101
Configuration Import/Export
Exporting a Configuration File
• The FXOS chassis to which you are importing must have the correct software application images installed for any logical devices defined in the export file that your are importing.
• To avoid overwriting existing backup files, please be sure to change the filename in the backup operation or copy the existing file to another location.
Exporting a Configuration File
Use the configuration export feature to export an XML file containing logical device and platform configuration settings for your FXOS chassis to a remote server or your local computer.
Please review the
About Configuration Import/Export
for important information about using the configuration export feature.
Procedure
Step 1
Choose System > Configuration > Export.
Step 2
To export a configuration file to your local computer: a) Click the Local radio button.
b) Click Export.
The configuration file is created and, depending on your browser, the file might be automatically downloaded to your default download location or you might be prompted to save the file.
Step 3
To export the configuration file to a remote server: a) Click the Remote radio button.
b) Choose the protocol to use when communicating with the remote server. This can be one of the following:
FTP, TFTP, SCP, or SFTP.
c) Enter the hostname or IP address of the location where the backup file should be stored. This can be a server, storage array, local drive, or any read/write media that the FXOS chassis can access through the network.
If you use a hostname rather than an IP address, you must configure a DNS server.
d) If you are using a non-default port, enter the port number in the Port field.
e) Enter the username the system should use to log in to the remote server. This field does not apply if the protocol is TFTP.
f) Enter the password for the remote server username. This field does not apply if the protocol is TFTP.
g) In the Location field, enter the full path to where you want the configuration file exported including the filename. If you omit the filename, the export procedure assigns a name to the file.
h) Click Export.
The configuration file is created and exported to the specified location.
Importing a Configuration File
You can use the configuration import feature to apply configuration settings that were previously exported from your FXOS chassis. This feature allows you to return to a known good configuration or to recover from
102
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Configuration Import/Export
Importing a Configuration File
a system failure. Please review the
About Configuration Import/Export
for important information about using the configuration import feature.
Procedure
Step 1
Choose System > Configuration > Import.
Step 2
To import from a local configuration file: a) Click the Local radio button.
b) Click Choose File to navigate to and select the configuration file that you want to import.
c) Click Import.
A confirmation dialog box opens asking you to confirm that you want to proceed and warning you that the chassis might need to restart.
d) Click Yes to confirm that you want to import the specified configuration file.
The existing configuration is deleted and the configuration specified in the import file is applied to the
FXOS chassis. If there is a breakout port configuration change during the import, the FXOS chassis will need to restart.
Step 3
To import from a configuration file on a remote server: a) Click the Remote radio button.
b) Choose the protocol to use when communicating with the remote server. This can be one of the following:
FTP, TFTP, SCP, or SFTP.
c) If you are using a non-default port, enter the port number in the Port field.
d) Enter the hostname or IP address of the location where the backup file is stored. This can be a server, storage array, local drive, or any read/write media that the FXOS chassis can access through the network.
If you use a hostname rather than an IP address, you must configure a DNS server.
e) Enter the username the system should use to log in to the remote server. This field does not apply if the protocol is TFTP.
f) Enter the password for the remote server username. This field does not apply if the protocol is TFTP.
g) In the File Path field, enter the full path to the configuration file including the filename.
h) Click Import.
A confirmation dialog box opens asking you to confirm that you want to proceed and warning you that the chassis might need to restart.
i) Click Yes to confirm that you want to import the specified configuration file.
The existing configuration is deleted and the configuration specified in the import file is applied to the
FXOS chassis. If there is a breakout port configuration change during the import, the FXOS chassis will need to restart.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
103
Importing a Configuration File
Configuration Import/Export
104
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
C H A P T E R
11
Packet Capture
•
About Packet Capture, page 105
•
Creating or Editing a Packet Capture Session, page 106
•
Configuring Filters for Packet Capture, page 108
•
Starting and Stopping a Packet Capture Session, page 109
•
Downloading a Packet Capture File, page 109
About Packet Capture
The Packet Capture tool is a valuable asset for use in debugging connectivity and configuration issues and for understanding traffic flows through your FXOS chassis. You can use the Packet Capture tool to log traffic that is going through specific customer-facing ports or application ports on your FXOS chassis.
You can create multiple packet capture sessions and each session can capture traffic on multiple ports. For each port included in a packet capture session, a separate packet capture (PCAP) file will be created.
Backplane Port Mappings
The FXOS chassis uses the following mappings for internal backplane ports:
Security Module
Security Module 1/Security Engine
Port Mapping
Ethernet1/9
Description
Internal-Data0/0
Security Module 1/Security Engine
Security Module 2
Ethernet1/10
Ethernet1/11
Internal-Data0/1
Internal-Data0/0
Security Module 2
Security Module 3
Security Module 3
Ethernet1/12
Ethernet1/13
Ethernet1/14
Internal-Data0/1
Internal-Data0/0
Internal-Data0/1
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
105
Packet Capture
Creating or Editing a Packet Capture Session
Guidelines and Limitations
The Packet Capture tool has the following limitations:
• Can capture only up to 100 Mbps.
• Packet capture sessions can be created even when there is not enough storage space available to run the packet capture session. You should verify that you have enough storage space available before you start a packet capture session.
• Does not support multiple active packet capturing sessions.
• There is no option to filter based on source or destination IPv6 address.
• Captures only at Ingress stage of internal switch.
• Filters are not effective on packets which cannot be understood by internal switch (for example Security
Group Tag and Network Service Header packets).
• Abstractions are not supported (for example, port channels and service chain).
Note
Although capturing traffic on port channels is not supported, you can include the individual member ports that make up a port channel in a packet capture session and the packet capture tool will create separate packet capture files for each of those member ports.
• You cannot copy or export a PCAP file while the capture session is still active.
• When you delete a packet capture session, all packet capture files associated with that session are also deleted.
Creating or Editing a Packet Capture Session
Procedure
Step 1
Choose Tools > Packet Capture.
The Capture Session tab displays a list of currently configured packet capture sessions. If no packet capture sessions are currently configured, a message stating so is displayed instead.
Step 2
Do one of the following:
• To create a packet capture session, click the Capture Session button.
• To edit an existing packet capture session, click the Edit button for that session.
You see the Configure Packet Capture Session window. The left side of the Configure Packet Capture
Session window allows you to select a specific logical device configured on your FXOS chassis and then shows a representation of that logical device. This representation is used to select the interfaces on which you would like to capture packets. The right side of the Configure Packet Capture Session window contains fields for defining the packet capture session.
106
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Packet Capture
Creating or Editing a Packet Capture Session
Step 3
Enter a name for the packet capture session in the Session Name field.
Step 4
Specify the buffer size to use for this packet capture session by selecting one of the pre-defined values from the Buffer Size list, or by selecting Custom in MB and then entering the desired buffer size. The specified buffer size must be between 256 and 2048 MB.
Step 5
Specify whether you want to overwrite existing PCAP files or append data to the PCAP files when this packet capture session is executed.
Step 6
On the left side of the Configure Packet Capture Session window, click the name of the logical device for which you would like to capture packets.
You see a representation of the selected logical device including all interfaces assigned to the device.
Step 7
To capture traffic on any of the customer-facing ports assigned to the logical device, click the desired interface to select it.
Step 8
To capture traffic from the logical device going out over the backplane ports: a) Click the box representing the logical device.
The Capture On, Application Port, and Application Capture Direction fields are made available on the right side of the Configure Packet Capture Session window.
b) Select the backplane port you wish to capture traffic on or select All Backplane Ports from the Capture
On drop-down list.
Step 9
To capture traffic between the logical device and a specific interface: a) Click the box representing the logical device.
The Capture On, Application Port, and Application Capture Direction fields are made available on the right side of the Configure Packet Capture Session window.
b) Make sure the logical device (for example, asa) is selected in the Capture On drop-down list.
c) Select the interface that you would like to capture traffic coming from or going to in the Application Port drop-down list.
d) To capture only the traffic going from the logical device toward the specified interface, click the Egress
Packets option next to Application Capture Direction.
e) To capture traffic coming from or going to the specified interface, click the All Packets option next to
Application Capture Direction.
Step 10 To filter the traffic being captured: a) Click the Apply Filter option for the Capture Filter field.
You are given a set of fields for configuring the filter.
b) If you need to create the filter, click Create Filter.
You see the Create Packet Filter dialog box. For more information, see
Configuring Filters for Packet
.
c) Select the filter you want to use from the Apply drop-down list.
d) Select the interface to which you want to apply the filter from the To drop-down list.
e) To apply additional filters, click Apply Another Filter and then repeat the steps above to apply the additional filter.
Step 11 Do one of the following:
• To save this packet capture session and run it now, click the Save and Run button. This option is only available if no other packet capture sessions are currently running.
• To save this packet capture session so that it can be ran at a later time, click the Save button.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
107
Packet Capture
Configuring Filters for Packet Capture
You see the Capture Session tab with your session listed along with any other sessions that have been created.
If you selected Save and Run, your packet capture session will be capturing packets. You will need to stop capturing before you can download the PCAP files from your session.
Configuring Filters for Packet Capture
You can create filters to limit the traffic that is included in a packet capture session. You can select which interfaces should use a specific filter while creating a packet capture session.
Note
If you modify or delete a filter that is applied to a packet capture session that is currently running, the changes will not take affect until you disable that session and then reenable it.
Procedure
Step 1
Choose Tools > Packet Capture.
The Capture Session tab displays a list of currently configured packet capture sessions. If no packet capture sessions are currently configured, a message stating so is displayed instead.
Step 2
Do one of the following:
• To create a filter, click the Add Filter button.
• To edit an existing filter, click the Edit button for that fitler.
You see the Create or Edit Packet Filter dialog box.
Step 3
Enter a name for the packet capture filter in the Filter Name field.
Step 4
To filter on a specific protocol, select it from the Protocol list, or selectCustom and then enter the desired protocol. The custom protocol must be an IANA defined protocol in decimal format (0-255).
Step 5
To filter on a specific EtherType, select it from the EtherType list, or selectCustom and then enter the desired
EtherType. The custom EhterType must be an IANA defined EtherType in decimal format (for example, IPv4
= 2048, IPv6 = 34525, ARP = 2054, and SGT = 35081).
Step 6
To filter traffic based on an Inner VLAN (VLAN ID while ingressing the port) or Outer VLAN (VLAN ID added by the FXOS chassis), enter the VLAN ID in the specified field.
Step 7
To filter traffic from a specific source or destination, enter the IP address and port or enter the MAC address in the specified source or destination fields.
Step 8
Click Save to save the filter,
You see the Filter List tab with your filter listed along with any other filters that have been created.
108
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Packet Capture
Starting and Stopping a Packet Capture Session
Starting and Stopping a Packet Capture Session
Procedure
Step 1
Choose Tools > Packet Capture.
The Capture Session tab displays a list of currently configured packet capture sessions. If no packet capture sessions are currently configured, a message stating so is displayed instead.
Step 2
To start a packet capture session, click the Enable Session button for that session and then click Yes to confirm.
Note
You cannot start a packet capture session while another session is running.
The PCAP files for the interfaces included in the session will start collecting traffic. If the session is configured to overwrite session data, the existing PCAP data will be erased. If not, data will be appended to the existing file (if any).
While the packet capture session is running, the file size for the individual PCAP files will increase as traffic is captured. Once the Buffer Size limit is reached, the system will start dropping packets and you will see the
Drop Count field increase.
Step 3
To stop a packet capture session, click the Disable Session button for that session and then click Yes to confirm.
After the session has been disabled, you can then download the PCAP files (see
).
Downloading a Packet Capture File
You can download the Packet Capture (PCAP) files from a session to your local computer so that they can be analyzed using a network packet analyzer.
Procedure
Step 1
Choose Tools > Packet Capture.
The Capture Session tab displays a list of currently configured packet capture sessions. If no packet capture sessions are currently configured, a message stating so is displayed instead.
Step 2
To download the PCAP file for a specific interface from a packet capture session, click the Download button that corresponds to that interface.
Note
You cannot download a PCAP file while a packet capture session is running.
Depending on your browser, the specified PCAP file is either automatically downloaded to your default download location or you are prompted to save the file.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
109
Downloading a Packet Capture File
Packet Capture
110
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
I N D E X
A
AAA
LDAP providers
RADIUS providers
TACACS+ providers
accessing the command line interface
accounts
locally authenticated
acknowledging security modules
asa
connecting to
creating a cluster
creating a clustered
creating a standalone asa logical device
deleting a logical device
exiting from connection
updating image version
asa images
about
downloading from Cisco.com
uploading to the Firepower security appliance
authentication
default
authNoPriv
authPriv
B
breakout cables
configuring
breakout ports
C
call home
configure http proxy
certificate
about
chassis
initial configuration
monitoring status
chassis manager
user interface overview
Cisco Secure Package
about
downloading from Cisco.com
uploading to the Firepower security appliance
cli, See
clustering
cluster control link
redundancy
size
device-local EtherChannels, configuring on switch
management
network
member requirements
software requirements
spanning-tree portfast
upgrading software
clusters
about
creating
defaults when creating
command line interface
accessing
communication services
HTTPS
SNMP
community, SNMP
configuration import/export
guidelines
restrictions
configuring
HTTPS
connecting to a logical device
creating packet capture session
CSP, See
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
IN-1
Index
D
date
setting manually
date and time
configuring
decommissioning security modules
DNS
downloading packet capture file
HTTPS
8, 47, 48, 49, 51, 52, 53, 54, 56
certificate request
changing port
configuring
creating key ring
disabling
importing certificate
logging in or out
regenerating key ring
trusted point
E
enabling
SNMP
exiting from logical device connection
export configuration
F
Firepower chassis
See also
initial configuration
See also
Firepower Chassis Manager
logging in or out
user interface overview
Firepower eXtensible OS
upgrading the platform bundle
Firepower platform bundle
about
downloading from Cisco.com
upgrading
uploading to the Firepower security appliance
verifying integrity
Firepower security appliance
overview
firmware
upgrading
fpga
upgrading
FXOS chassis
monitoring status
I
image version
updating
images
downloading from Cisco.com
managing
upgrading the Firepower eXtensible Operating System platform bundle
uploading to the Firepower security appliance
verifying integrity
import configuration
informs
about
initial configuration
interfaces
administrative state
configuring
properties
K
key ring
about
certificate request
creating
deleting
importing certificate
regenerating
trusted point
H
high-level task list
history, passwords
http proxy
configuring
IN-2
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
L
LDAP
LDAP providers
creating
deleting
license
registering
Index
license authority
locally authenticated users
password profile
logging in or out
logical devices
connecting to
creating a cluster
creating a standalone
deleting
exiting from connection
understanding
updating image version
M
management IP address
changing
monitoring chassis status
N
noAuthNoPriv
NTP
adding
configuring
deleting
P
packet capture
creating packet capture session
downloading PCAP file
filter
starting a packet capture session
stopping a packet capture session
password profile
about
passwords
change interval
guidelines
history count
strength check
PCAP, See
PCAP file
downloading
PKI
platform bundle
about
downloading from Cisco.com
upgrading
platform bundle (continued) uploading to the Firepower security appliance
verifying integrity
port channels
configuring
powering on/off security modules
profiles
password
R
RADIUS
RADIUS providers
creating
deleting
registering a license
reinitializing security modules
resetting security modules
rommon
upgrading
RSA
S
security modules
acknowledging
decommissioning
powering off
powering on
reinitializing
resetting
smart call home
configure http proxy
SNMP
about
community
enabling
notifications
privileges
security levels
support
traps
creating
deleting
users
creating
deleting
Version 3 security features
SNMPv3
security features
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
IN-3
Index
SSH
configuring
syslog
configuring local destinations
configuring local sources
configuring remote destinations
system
initial configuration
T
TACACS+
TACACS+ providers
creating
deleting
task flow
Telnet
configuring
time
setting manually
time zone
setting
traps
about
creating
deleting
trusted points
about
creating
deleting
U
upgrading the firmware
user accounts
password profile
user interface
overview
users
17, 18, 19, 22, 23, 26, 28, 45, 46
activating
creating
deactivating
default authentication
deleting
locally authenticated
managing
naming guidelines
password guidelines
roles
settings
SNMP
IN-4
Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(3)
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Web-based interface
Visual representation of chassis status
Simplified configuration of chassis features
Monitoring of system status
Configuration of platform settings
License management
Software updates
User management
Frequently asked questions
You can log in to the Firepower Chassis Manager by entering the following URL in the address bar of a supported web browser: https://<chassis_mgmt_ip_address>, where <chassis_mgmt_ip_address> is the IP address or host name of the FXOS chassis that you entered during initial configuration. Then, enter your username and password and click Login.
For information on supported browsers, refer to the release notes for the version you are using (see http://www.cisco.com/c/en/us/support/security/firepower-9000-series/products-release-notes-list.html).
The Firepower Chassis Manager provides a variety of features, including the ability to configure platform settings and interfaces, provision devices, and monitor system status. It also provides a streamlined, visual representation of the current chassis status and simplified configuration of chassis features.