C H A P T E R
2
Getting Started
•
Task Flow, page 5
•
Initial Configuration, page 6
•
Log In or Out of the Firepower Chassis Manager, page 8
•
Accessing the FXOS CLI, page 8
Task Flow
The following procedure shows the basic tasks that should be completed when configuring your FXOS chassis.
Procedure
Step 1
Configure the FXOS chassis hardware (see the Cisco Firepower Security Appliance Hardware Installation
Guide ).
Step 2
Complete the initial configuration (see
Initial Configuration, on page 6
).
Step 3
Log in to the Firepower Chassis Manager (see
Log In or Out of the Firepower Chassis Manager, on page
8 ).
Step 4
Set the Date and Time (see
Setting the Date and Time, on page 79
).
Step 5
Configure a DNS server (see
Configuring DNS Servers, on page 111
).
Step 6
Register your product license (see
License Management, on page 11
).
Step 7
Configure users (see
User Management, on page 19
).
Step 8
Perform software updates as required (see
Image Management, on page 33
).
Step 9
Configure additional platform settings (see
Platform Settings, on page 79
).
Step 10
Configure interfaces (see
Interface Management, on page 113
).
Step 11
Create logical devices (see
Logical Devices, on page 121
).
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
5
Getting Started
Initial Configuration
Initial Configuration
Before you can use Firepower Chassis Manager or the FXOS CLI to configure and manage your system, you must perform some initial configuration tasks using the FXOS CLI accessed through the console port. The first time that you access the FXOS chassis using the FXOS CLI, you will encounter a setup wizard that you can use to configure the system.
You can choose to either restore the system configuration from an existing backup file, or manually set up the system by going through the Setup wizard. If you choose to restore the system, the backup file must be reachable from the management network.
You must specify only one IPv4 address, gateway, and subnet mask, or only one IPv6 address, gateway, and network prefix for the single management port on the FXOS chassis. You can configure either an IPv4 or an
IPv6 address for the management port IP address.
Before You Begin
1
Verify the following physical connections on the FXOS chassis:
• The console port is physically connected to a computer terminal or console server.
• The 1 Gbps Ethernet management port is connected to an external hub, switch, or router.
For more information, refer to the Cisco Firepower Security Appliance Hardware Installation Guide .
2
Verify that the console port parameters on the computer terminal (or console server) attached to the console port are as follows:
• 9600 baud
• 8 data bits
• No parity
• 1 stop bit
Procedure
Step 1
Connect to the console port.
Step 2
Power on the FXOS chassis.
You will see the power on self-test messages as the FXOS chassis boots.
Step 3
When the unconfigured system boots, a setup wizard prompts you for the following information required to configure the system:
• Setup mode (restore from full system backup or initial setup)
• Strong password enforcement policy (for strong password guidelines, see
User Accounts, on page 19
)
• Admin password
• System name
• Management port IPv4 address and subnet mask, or IPv6 address and prefix
6
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Getting Started
Initial Configuration
• Default gateway IPv4 or IPv6 address
• DNS Server IPv4 or IPv6 address
• Default domain name
Step 4
Review the setup summary and enter
yes
to save and apply the settings, or enter
no
to go through the Setup wizard again to change some of the settings.
If you choose to go through the Setup wizard again, the values you previously entered appear in brackets. To accept previously entered values, press
Enter
.
The following example sets up a configuration using IPv4 management addresses:
Enter the setup mode; setup newly or restore from backup. (setup/restore) ?
setup
You have chosen to setup a new Fabric interconnect. Continue? (y/n):
y
Enforce strong password? (y/n) [y]:
n
Enter the password for "admin":
adminpassword%958
Confirm the password for "admin":
adminpassword%958
Enter the system name:
foo
Physical Switch Mgmt0 IP address :
192.168.10.10
Physical Switch Mgmt0 IPv4 netmask:
255.255.255.0
IPv4 address of the default gateway:
192.168.10.1
Configure the DNS Server IP address? (yes/no) [n]:
yes
DNS IP address:
20.10.20.10
Configure the default domain name? (yes/no) [n]:
yes
Default domain name:
domainname.com
Following configurations will be applied:
Switch Fabric=A
System Name=foo
Enforce Strong Password=no
Physical Switch Mgmt0 IP Address=192.168.10.10
Physical Switch Mgmt0 IP Netmask=255.255.255.0
Default Gateway=192.168.10.1
IPv6 value=0
DNS Server=20.10.20.10
Domain Name=domainname.com
Apply and save the configuration (select 'no' if you want to re-enter)? (yes/no):
yes
The following example sets up a configuration using IPv6 management addresses:
Enter the setup mode; setup newly or restore from backup. (setup/restore) ?
setup
You have chosen to setup a new Fabric interconnect. Continue? (y/n):
y
Enforce strong password? (y/n) [y]:
n
Enter the password for "admin":
adminpassword%652
Confirm the password for "admin":
adminpassword%652
Enter the system name:
foo
Physical Switch Mgmt0 IP address :
2001::107
Physical Switch Mgmt0 IPv6 prefix:
64
IPv6 address of the default gateway:
2001::1
Configure the DNS Server IPv6 address? (yes/no) [n]:
yes
DNS IP address:
2001::101
Configure the default domain name? (yes/no) [n]:
yes
Default domain name:
domainname.com
Following configurations will be applied:
Switch Fabric=A
System Name=foo
Enforced Strong Password=no
Physical Switch Mgmt0 IPv6 Address=2001::107
Physical Switch Mgmt0 IPv6 Prefix=64
Default Gateway=2001::1
Ipv6 value=1
DNS Server=2001::101
Domain Name=domainname.com
Apply and save the configuration (select 'no' if you want to re-enter)? (yes/no):
yes
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
7
Getting Started
Log In or Out of the Firepower Chassis Manager
Log In or Out of the Firepower Chassis Manager
Note
You can optionally configure your Firepower Chassis Manager to allow only a certain number of unsuccessful login attempts before the user is locked out of the system for a specified amount of time.
This option is one of a number offered for achieving Common Criteria certification compliance on your system. For more information, see
Security Certifications Compliance, on page 39
.
Procedure
Step 1
To log in to the Firepower Chassis Manager: a) Using a supported browser, enter the following URL in the address bar: https://
<chassis_mgmt_ip_address>
where
<chassis_mgmt_ip_address>
is the IP address or host name of the FXOS chassis that you entered during initial configuration.
Note
For information on supported browsers, refer to the release notes for the version you are using
(see http://www.cisco.com/c/en/us/support/security/firepower-9000-series/ products-release-notes-list.html
).
b) Enter your username and password.
c) Click
Login
.
You are logged in and the Firepower Chassis Manager opens to show the Overview page.
Step 2
To log out of the Firepower Chassis Manager, point at your username in the navigation bar and then select
Logout
.
You are logged out of the Firepower Chassis Manager and are returned to the login screen.
Accessing the FXOS CLI
You can connect to the FXOS CLI using a terminal plugged into the console port. Verify that the console port parameters on the computer terminal (or console server) attached to the console port are as follows:
• 9600 baud
• 8 data bits
• No parity
• 1 stop bit
You can also connect to the FXOS CLI using SSH and Telnet. The Firepower eXtensible Operating System supports up to eight simultaneous SSH connections. To connect with SSH, you need to know the hostname or IP address of the FXOS chassis.
Use one of the following syntax examples to log in with SSH, Telnet, or Putty:
8
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Getting Started
Accessing the FXOS CLI
Note
SSH log in is case-sensitive.
From a Linux terminal using SSH:
• ssh ucs-auth-domain \\
username
@{
UCSM-ip-address
|
UCMS-ipv6-address
}
ssh ucs-example\\[email protected]
ssh ucs-example\\jsmith@2001::1
• ssh -l ucs-auth-domain \\
username
{
UCSM-ip-address
|
UCSM-ipv6-address
|
UCSM-host-name
}
ssh -l ucs-example\\jsmith 192.0.20.11
ssh -l ucs-example\\jsmith 2001::1
•
ssh
{
UCSM-ip-address
|
UCSM-ipv6-address
|
UCSM-host-name
} -l ucs-auth-domain \\
username
ssh 192.0.20.11 -l ucs-example\\jsmith ssh 2001::1 -l ucs-example\\jsmith
• ssh ucs-auth-domain \\
username
@{
UCSM-ip-address
|
UCSM-ipv6-address
}
ssh ucs-ldap23\\[email protected]
ssh ucs-ldap23\\jsmith@2001::1
From a Linux terminal using Telnet:
Note
Telnet is disabled by default. See
Configuring Telnet, on page 82
for instructions on enabling Telnet.
• telnet ucs-UCSM-host-name ucs-auth-domain \
username
telnet ucs-qa-10
login:
ucs-ldap23\blradmin
•
telnet ucs-
{
UCSM-ip-address
|
UCSM-ipv6-address
}
ucs-auth-domain
\
username
telnet 10.106.19.12 2052
ucs-qa-10-A login:
ucs-ldap23\blradmin
From a Putty client:
• Login as: ucs-auth-domain \
username
Login as:
ucs-example\jsmith
Note
If the default authentication is set to local, and the console authentication is set to LDAP, you can log in to the fabric interconnect from a Putty client using ucs-local\admin, where admin is the name of the local account.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
9
Accessing the FXOS CLI
Getting Started
10
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
