Platform Settings. Cisco FXOS Firepower Chassis Manager

The FXOS Firepower Chassis Manager is a web interface that makes it easy to configure platform settings and interfaces, provision devices, and monitor system status. It is part of the Cisco Application Centric Infrastructure (ACI) Security Solution, providing an agile, open, and secure platform built for scalability, consistent control, and simplified management. The Firepower Security Appliance FXOS Firepower Chassis Manager provides modular chassis-based security, a graphical user interface for configuration and monitoring, a command-line interface (FXOS CLI), and a REST API for programmatic configuration and management.

PDF

Document

C H A P T E R

Platform Settings

•

Setting the Date and Time, page 79

•

Configuring SSH, page 82

•

Configuring Telnet, page 82

•

Configuring SNMP, page 83

•

Configuring HTTPS, page 89

•

Configuring AAA, page 99

•

Configuring Syslog, page 108

•

Configuring DNS Servers, page 111

Setting the Date and Time

Use the NTP page to configure the network time protocol (NTP) on the system, to set the date and time manually, or to view the current system time.

NTP settings are automatically synced between the FXOS chassis and any logical devices installed on the chassis.

Note

If you are deploying Firepower Threat Defense on the FXOS chassis, you must configure NTP on the

FXOS chassis so that Smart Licensing will work properly and to ensure proper timestamps on device registrations. You should use the same NTP server for the FXOS chassis and the Firepower Management

Center.

If you are using NTP, you can view the overall synchronization status on the

Current Time

tab, or you can view the synchronization status for each configured NTP server by looking at the Server Status field in the

NTP Server

table on the

Time Synchronization

tab. If the system is unable to synchronize with a particular

NTP server, you can hover over the information icon next to the Server Status for more information.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Viewing the Configured Date and Time

Viewing the Configured Date and Time

Procedure

Step 1

Choose

Platform Settings

NTP

Step 2

Click the

Current Time

tab.

The system shows the date, time, and time zone that are configured on the device.

If you are using NTP, you can also view the overall synchronization status on the

Current Time

tab. You can view the synchronization status for each configured NTP server by looking at the Server Status field in the

NTP Server

table on the

Time Synchronization

tab. If the system is unable to synchronize with a particular

NTP server, you can hover over the information icon next to the Server Status for more information.

Setting the Time Zone

Procedure

Step 1

Choose

Platform Settings

NTP

Step 2

Click the

Current Time

tab.

Step 3

Choose the appropriate time zone for the Firepower chassis from the

Time Zone

drop-down list.

Setting the Date and Time Using NTP

NTP is used to implement a hierarchical system of servers that provide a precisely synchronized time among network systems. This kind of accuracy is required for time-sensitive operations, such as validating CRLs, which include a precise time stamp. You can configure up to four NTP servers.

Procedure

Step 1

Choose

Platform Settings

NTP

Step 2

Click the

Time Synchronization

tab.

Step 3

Under

Set Time Source

, click

Use NTP Server

Step 4

For each NTP server you want to use, up to a maximum of four, enter the IP address or hostname of the NTP server in the

NTP Server

field and click

Add

Step 5

Click

Save

The Firepower chassis is configured with the NTP server information specified.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Deleting an NTP Server

You can view the synchronization status of each server by looking at the Server Status field in the

NTP Server

table. If the system is unable to synchronize with a particular NTP server, you can hover over the information icon next to the Server Status for more information.

Note

If you modify the system time by more than 10 minutes, the system will log you out and you will need to log in to the Firepower Chassis Manager again.

Deleting an NTP Server

Procedure

Step 1

Choose

Platform Settings

NTP

Step 2

Click the

Time Synchronization

tab.

Step 3

For each NTP server that you want to remove, click the

Delete

icon for that server in the

NTP Server

table.

Step 4

Click

Save

Setting the Date and Time Manually

This section describes how to set the date and time manually on the Firepower chassis.

Procedure

Step 1

Choose

Platform Settings

NTP

Step 2

Click the

Time Synchronization

tab.

Step 3

Under

Set Time Source

, click

Set Time Manually

Step 4

Click the

Date

drop-down list to display a calendar and then set the date using the controls available in the calendar.

Step 5

Use the corresponding drop-down lists to specify the time as hours, minutes, and AM/PM.

Tip

You can click

Get System Time

to set the date and time to match what is configured on the system you are using to connect to the Firepower Chassis Manager.

Step 6

Click

Save

The Firepower chassis is configured with the date and time specified.

Note

If you modify the system time by more than 10 minutes, the system will log you out and you will need to log in to the Firepower Chassis Manager again.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Configuring SSH

Configuring SSH

The following procedure describes how to enable or disable SSH access to the Firepower chassis. SSH is enabled by default.

Procedure

Step 1

Choose

Platform Settings

SSH

Step 2

To enable SSH access to the Firepower chassis, check the

Enable SSH

check box. To disable SSH access, uncheck the

Enable SSH

check box.

Step 3

Click

Save

Configuring Telnet

The following procedure describes how to enable or disable Telnet access to the Firepower chassis. Telnet is disabled by default.

Note

Telnet configuration is currently only available using the CLI.

Procedure

Step 1

Enter system mode:

Firepower-chassis #

scope system

Step 2

Enter system services mode:

Firepower-chassis /system #

scope services

Step 3

To configure Telnet access to the Firepower chassis, do one of the following:

• To allow Telnet access to the Firepower chassis, enter the following command:

Firepower-chassis /system/services #

enable telnet-server

• To disallow Telnet access to the Firepower chassis, enter the following command:

Firepower-chassis /system/services #

disable telnet-server

Step 4

Commit the transaction to the system configuration:

Firepower /system/services #

commit-buffer

The following example enables Telnet and commits the transaction:

Firepower-chassis#

scope system

Firepower-chassis /system #

scope services

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Configuring SNMP

Firepower-chassis /services #

enable telnet-server

Firepower-chassis /services* #

commit-buffer

Firepower-chassis /services #

Configuring SNMP

Use the SNMP page to configure the Simple Network Management Protocol (SNMP) on the Firepower chassis.

See the following topics for more information:

About SNMP

The Simple Network Management Protocol (SNMP) is an application-layer protocol that provides a message format for communication between SNMP managers and agents. SNMP provides a standardized framework and a common language used for the monitoring and management of devices in a network.

The SNMP framework consists of three parts:

•

An SNMP manager

—

The system used to control and monitor the activities of network devices using

SNMP.

• An SNMP agent — The software component within the Firepower chassis that maintains the data for the

Firepower chassis and reports the data, as needed, to the SNMP manager. The Firepower chassis includes the agent and a collection of MIBs. To enable the SNMP agent and create the relationship between the manager and agent, enable and configure SNMP in the Firepower Chassis Manager or the FXOS CLI.

• A managed information base (MIB) — The collection of managed objects on the SNMP agent.

The Firepower chassis supports SNMPv1, SNMPv2c and SNMPv3. Both SNMPv1 and SNMPv2c use a community-based form of security. SNMP is defined in the following:

• RFC 3410 ( http://tools.ietf.org/html/rfc3410 )

•

RFC 3411 ( http://tools.ietf.org/html/rfc3411 )

•

RFC 3412 ( http://tools.ietf.org/html/rfc3412 )

• RFC 3413 ( http://tools.ietf.org/html/rfc3413 )

• RFC 3414 ( http://tools.ietf.org/html/rfc3414 )

•

RFC 3415 ( http://tools.ietf.org/html/rfc3415 )

•

RFC 3416 ( http://tools.ietf.org/html/rfc3416 )

• RFC 3417 ( http://tools.ietf.org/html/rfc3417 )

•

RFC 3418 ( http://tools.ietf.org/html/rfc3418 )

•

RFC 3584 ( http://tools.ietf.org/html/rfc3584 )

SNMP Notifications

A key feature of SNMP is the ability to generate notifications from an SNMP agent. These notifications do not require that requests be sent from the SNMP manager. Notifications can indicate improper user

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

SNMP Security Levels and Privileges

authentication, restarts, the closing of a connection, loss of connection to a neighbor router, or other significant events.

The Firepower chassis generates SNMP notifications as either traps or informs. Traps are less reliable than informs because the SNMP manager does not send any acknowledgment when it receives a trap, and the

Firepower chassis cannot determine if the trap was received. An SNMP manager that receives an inform request acknowledges the message with an SNMP response protocol data unit (PDU). If the Firepower chassis does not receive the PDU, it can send the inform request again.

SNMP Security Levels and Privileges

SNMPv1, SNMPv2c, and SNMPv3 each represent a different security model. The security model combines with the selected security level to determine the security mechanism applied when the SNMP message is processed.

The security level determines the privileges required to view the message associated with an SNMP trap. The privilege level determines whether the message needs to be protected from disclosure or authenticated. The supported security level depends upon which security model is implemented. SNMP security levels support one or more of the following privileges:

• noAuthNoPriv

—

No authentication or encryption

• authNoPriv — Authentication but no encryption

• authPriv — Authentication and encryption

SNMPv3 provides for both security models and security levels. A security model is an authentication strategy that is set up for a user and the role in which the user resides. A security level is the permitted level of security within a security model. A combination of a security model and a security level determines which security mechanism is employed when handling an SNMP packet.

Supported Combinations of SNMP Security Models and Levels

The following table identifies what the combinations of security models and levels mean.

Table 5: SNMP Security Models and Levels

Model

Level

noAuthNoPriv

Authentication

Community string

Encryption

No v2c v3 noAuthNoPriv noAuthNoPriv

Community string No

Username No

What Happens

Uses a community string match for authentication.

Uses a username match for authentication.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

SNMPv3 Security Features

Model

v3 v3

Level

authNoPriv

Authentication

HMAC-SHA

Encryption

No authPriv HMAC-SHA DES

What Happens

Provides authentication based on the HMAC

Secure Hash

Algorithm (SHA).

Provides authentication based on the HMAC-SHA algorithm. Provides

Data Encryption

Standard (DES)

56-bit encryption in addition to authentication based on the Cipher Block

Chaining (CBC)

DES (DES-56) standard.

SNMPv3 Security Features

SNMPv3 provides secure access to devices by a combination of authenticating and encrypting frames over the network. SNMPv3 authorizes management operations only by configured users and encrypts SNMP messages. The SNMPv3 User-Based Security Model (USM) refers to SNMP message-level security and offers the following services:

•

Message integrity

—

Ensures that messages have not been altered or destroyed in an unauthorized manner and that data sequences have not been altered to an extent greater than can occur non-maliciously.

•

Message origin authentication

—

Ensures that the claimed identity of the user on whose behalf received data was originated is confirmed.

• Message confidentiality and encryption — Ensures that information is not made available or disclosed to unauthorized individuals, entities, or processes.

SNMP Support

The Firepower chassis provides the following support for SNMP:

Support for MIBs

The Firepower chassis supports read-only access to MIBs.

Authentication Protocol for SNMPv3 Users

The Firepower chassis supports the HMAC-SHA-96 (SHA) authentication protocol for SNMPv3 users.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Enabling SNMP and Configuring SNMP Properties

AES Privacy Protocol for SNMPv3 Users

The Firepower chassis uses Advanced Encryption Standard (AES) as one of the privacy protocols for SNMPv3 message encryption and conforms with RFC 3826.

The privacy password, or priv option, offers a choice of DES or 128-bit AES encryption for SNMP security encryption. If you enable AES-128 configuration and include a privacy password for an SNMPv3 user, the

Firepower chassis uses the privacy password to generate a 128-bit AES key. The AES privacy password can have a minimum of eight characters. If the passphrases are specified in clear text, you can specify a maximum of 64 characters.

Enabling SNMP and Configuring SNMP Properties

Procedure

Step 1

Choose

Platform Settings

SNMP

Step 2

In the

SNMP

area, complete the following fields:

Name Description

Admin State

check box Whether SNMP is enabled or disabled. Enable this service only if your system includes integration with an SNMP server.

Port

field The port on which the Firepower chassis communicates with the SNMP host. You cannot change the default port.

Community/Username

field The default SNMP v1 or v2 community name or SNMP v3 username the Firepower chassis includes on any trap messages it sends to the

SNMP host.

Enter an alphanumeric string between 1 and 32 characters. Do not use

@ (at sign), \ (backslash), " (double quote), ? (question mark) or an empty space. The default is public.

Note that if the

Community/Username

field is already set, the text to the right of the empty field reads

Set: Yes

. If the

Community/Username

field is not yet populated with a value, the text to the right of the empty field reads

Set: No

System Administrator Name

field The contact person responsible for the SNMP implementation.

Enter a string of up to 255 characters, such as an email address or a name and telephone number.

Location

field The location of the host on which the SNMP agent (server) runs.

Enter an alphanumeric string up to 510 characters.

Step 3

Click

Save

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Creating an SNMP Trap

What to Do Next

Create SNMP traps and users.

Creating an SNMP Trap

Procedure

Step 1

Choose

Platform Settings

SNMP

Step 2

In the

SNMP Traps

area, click

Add

Step 3

In the

Add SNMP Trap

dialog box, complete the following fields:

Name Description

Host Name

field The hostname or IP address of the SNMP host to which the Firepower chassis should send the trap.

Community/Username

field

Port

field

The SNMP v1 or v2 community name or the SNMP v3 username the

Firepower chassis includes when it sends the trap to the SNMP host.

This must be the same as the community or username that is configured for the SNMP service.

Enter an alphanumeric string between 1 and 32 characters. Do not use

@ (at sign), \ (backslash), " (double quote), ? (question mark) or an empty space.

The port on which the Firepower chassis communicates with the SNMP host for the trap.

Enter an integer between 1 and 65535.

Version

field The SNMP version and model used for the trap. This can be one of the following:

•

Type

field If you select

for the version, the type of trap to send. This can be one of the following:

•

Traps

•

Informs

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Deleting an SNMP Trap

Name v3 Privilege

field

Description

If you select

for the version, the privilege associated with the trap.

This can be one of the following:

•

Auth

— Authentication but no encryption

•

Noauth

—

No authentication or encryption

•

Priv

—

Authentication and encryption

Step 4

Click

to close the

Add SNMP Trap

dialog box.

Step 5

Click

Save

Deleting an SNMP Trap

Procedure

Step 1

Choose

Platform Settings

SNMP

Step 2

In the

SNMP Traps

area, click the

Delete

icon in the row in the table that corresponds to the trap you want to delete.

Creating an SNMPv3 User

Procedure

Step 1

Choose

Platform Settings

SNMP

Step 2

In the

SNMP Users

area, click

Add

Step 3

In the

Add SNMP User

dialog box, complete the following fields:

Name Description

Name

field The username assigned to the SNMP user.

Enter up to 32 letters or numbers. The name must begin with a letter and you can also specify _ (underscore), . (period), @ (at sign), and -

(hyphen).

Auth Type

field

Use AES-128

check box

The authorization type:

SHA

If checked, this user uses AES-128 encryption.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Deleting an SNMPv3 User

Name

Password

field

Confirm Password

Privacy Password

field field

Description

The password for this user.

The password again for confirmation purposes.

The privacy password for this user.

Confirm Privacy Password

field The privacy password again for confirmation purposes.

Step 4

Click

to close the

Add SNMP User

dialog box.

Step 5

Click

Save

Deleting an SNMPv3 User

Procedure

Step 1

Choose

Platform Settings

SNMP

Step 2

In the

SNMP Users

area, click the

Delete

icon in the row in the table that corresponds to the user you want to delete.

Configuring HTTPS

This section describes how to configure HTTPS on the FXOS chassis.

Note

You can change the HTTPS port using Firepower Chassis Manager or the FXOS CLI. All other HTTPS configuration can only be done using the FXOS CLI.

Certificates, Key Rings, and Trusted Points

HTTPS uses components of the Public Key Infrastructure (PKI) to establish secure communications between two devices, such as a client's browser and the FXOS chassis.

Encryption Keys and Key Rings

Each PKI device holds a pair of asymmetric Rivest-Shamir-Adleman (RSA) encryption keys, one kept private and one made public, stored in an internal key ring. A message encrypted with either key can be decrypted

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Creating a Key Ring

with the other key. To send an encrypted message, the sender encrypts the message with the receiver's public key, and the receiver decrypts the message using its own private key. A sender can also prove its ownership of a public key by encrypting (also called 'signing') a known message with its own private key. If a receiver can successfully decrypt the message using the public key in question, the sender's possession of the corresponding private key is proven. Encryption keys can vary in length, with typical lengths from 512 bits to 2048 bits. In general, a longer key is more secure than a shorter key. FXOS provides a default key ring with an initial 2048-bit key pair, and allows you to create additional key rings.

The default key ring certificate must be manually regenerated if the cluster name changes or the certificate expires.

Certificates

To prepare for secure communications, two devices first exchange their digital certificates. A certificate is a file containing a device's public key along with signed information about the device's identity. To merely support encrypted communications, a device can generate its own key pair and its own self-signed certificate.

When a remote user connects to a device that presents a self-signed certificate, the user has no easy method to verify the identity of the device, and the user's browser will initially display an authentication warning. By default, FXOS contains a built-in self-signed certificate containing the public key from the default key ring.

Trusted Points

To provide stronger authentication for FXOS, you can obtain and install a third-party certificate from a trusted source, or trusted point, that affirms the identity of your device. The third-party certificate is signed by the issuing trusted point, which can be a root certificate authority (CA) or an intermediate CA or trust anchor that is part of a trust chain that leads to a root CA. To obtain a new certificate, you must generate a certificate request through FXOS and submit the request to a trusted point.

Important

The certificate must be in Base64 encoded X.509 (CER) format.

Creating a Key Ring

FXOS supports a maximum of 8 key rings, including the default key ring.

Procedure

Step 1

Enter security mode:

Firepower-chassis #

scope security

Step 2

Create and name the key ring:

Firepower-chassis # create keyring keyring-name

Step 3

Set the SSL key length in bits:

Firepower-chassis #

set modulus

{

mod1024

mod1536

mod2048

mod512

}

Step 4

Commit the transaction:

Firepower-chassis #

commit-buffer

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Regenerating the Default Key Ring

The following example creates a keyring with a key size of 1024 bits:

Firepower-chassis#

scope security

Firepower-chassis /security #

create keyring kr220

Firepower-chassis /security/keyring* #

set modulus mod1024

Firepower-chassis /security/keyring* #

commit-buffer

Firepower-chassis /security/keyring #

What to Do Next

Create a certificate request for this key ring.

Regenerating the Default Key Ring

The default key ring certificate must be manually regenerated if the cluster name changes or the certificate expires.

Procedure

Step 1

Enter security mode:

Firepower-chassis #

scope security

Step 2

Enter key ring security mode for the default key ring:

Firepower-chassis /security #

scope keyring default

Step 3

Regenerate the default key ring:

Firepower-chassis /security/keyring #

set regenerate yes

Step 4

Commit the transaction:

Firepower-chassis #

commit-buffer

The following example regenerates the default key ring:

Firepower-chassis#

scope security

Firepower-chassis /security #

scope keyring default

Firepower-chassis /security/keyring* #

set regenerate yes

Firepower-chassis /security/keyring* #

commit-buffer

Firepower-chassis /security/keyring #

Creating a Certificate Request for a Key Ring

Creating a Certificate Request for a Key Ring with Basic Options

Procedure

Step 1

Enter security mode:

Firepower-chassis #

scope security

Step 2

Enter configuration mode for the key ring:

Firepower-chassis /security # scope keyring keyring-name

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Creating a Certificate Request for a Key Ring

Step 3

Create a certificate request using the IPv4 or IPv6 address specified, or the name of the fabric interconnect.

You are prompted to enter a password for the certificate request.

Firepower-chassis /security/keyring #

create certreq

{

[

ipv4-addr

ipv6-v6

] | subject-name name }

Step 4

Commit the transaction:

Firepower-chassis /security/keyring/certreq #

commit-buffer

Step 5

Display the certificate request, which you can copy and send to a trust anchor or certificate authority:

Firepower-chassis /security/keyring #

show certreq

The following example creates and displays a certificate request with an IPv4 address for a key ring, with basic options:

Firepower-chassis#

scope security

Firepower-chassis /security #

scope keyring kr220

Firepower-chassis /security/keyring #

create certreq ip 192.168.200.123 subject-name sjc04

Certificate request password:

Confirm certificate request password:

Firepower-chassis /security/keyring* #

commit-buffer

Firepower-chassis /security/keyring #

show certreq

Certificate request subject name: sjc04

Certificate request ip address: 192.168.200.123

Certificate request e-mail name:

Certificate request country name:

State, province or county (full name):

Locality (eg, city):

Organization name (eg, company):

Organization Unit name (eg, section):

Request:

-----BEGIN CERTIFICATE REQUEST-----

MIIBfTCB5wIBADARMQ8wDQYDVQQDEwZzYW1jMDQwgZ8wDQYJKoZIhvcNAQEBBQAD gY0AMIGJAoGBALpKn1t8qMZO4UGqILKFXQQc2c8b/vW2rnRF8OPhKbhghLA1YZ1F

JqcYEG5Yl1+vgohLBTd45s0GC8m4RTLJWHo4SwccAUXQ5Zngf45YtX1WsylwUWV4

0re/zgTk/WCd56RfOBvWR2Dtztu2pGA14sd761zLxt29K7R8mzj6CAUVAgMBAAGg

LTArBgkqhkiG9w0BCQ4xHjAcMBoGA1UdEQEB/wQQMA6CBnNhbWMwNIcECsEiXjAN

BgkqhkiG9w0BAQQFAAOBgQCsxN0qUHYGFoQw56RwQueLTNPnrndqUwuZHUO03Teg nhsyu4satpyiPqVV9viKZ+spvc6x5PWIcTWgHhH8BimOb/0OKuG8kwfIGGsEDlAv

TTYvUP+BZ9OFiPbRIA718S+V8ndXr1HejiQGxlDNqoN+odCXPc5kjoXD0lZTL09H

BA==

-----END CERTIFICATE REQUEST-----

Firepower-chassis /security/keyring #

What to Do Next

• Copy the text of the certificate request, including the BEGIN and END lines, and save it in a file. Send the file with the certificate request to a trust anchor or certificate authority to obtain a certificate for the key ring.

• Create a trusted point and set the certificate chain for the certificate of trust received from the trust anchor.

Creating a Certificate Request for a Key Ring with Advanced Options

Procedure

Step 1

Enter security mode:

Firepower-chassis #

scope security

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Creating a Certificate Request for a Key Ring

Step 2

Enter configuration mode for the key ring:

Firepower-chassis /security # scope keyring keyring-name

Step 3

Create a certificate request:

Firepower-chassis /security/keyring #

create certreq

Step 4

Specify the country code of the country in which the company resides:

Firepower-chassis /security/keyring/certreq* # set country country name

Step 5

Specify the Domain Name Server (DNS) address associated with the request:

Firepower-chassis /security/keyring/certreq* # set dns DNS Name

Step 6

Specify the email address associated with the certificate request:

Firepower-chassis /security/keyring/certreq* # set e-mail E-mail name

Step 7

Specify the IP address of the FXOS chassis:

Firepower-chassis /security/keyring/certreq* #

set ip

{

certificate request ip-address|certificate request ip6-address

}

Step 8

Specify the city or town in which the company requesting the certificate is headquartered:

Firepower-chassis /security/keyring/certreq* # set locality locality name (eg, city)

Step 9

Specify the organization requesting the certificate:

Firepower-chassis /security/keyring/certreq* # set org-name organization name

Step 10

Specify the organizational unit:

Firepower-chassis /security/keyring/certreq* #

set org-unit-name organizational unit name

Step 11

Specify an optional password for the certificate request:

Firepower-chassis /security/keyring/certreq* #

set password certificate request password

Step 12

Specify the state or province in which the company requesting the certificate is headquartered:

Firepower-chassis /security/keyring/certreq* # set state state, province or county

Step 13

Specify the fully qualified domain name of the FXOS chassis:

Firepower-chassis /security/keyring/certreq* # set subject-name certificate request name

Step 14

Commit the transaction:

Firepower-chassis /security/keyring/certreq #

commit-buffer

Step 15

Display the certificate request, which you can copy and send to a trust anchor or certificate authority:

Firepower-chassis /security/keyring #

show certreq

The following example creates and displays a certificate request with an IPv4 address for a key ring, with advanced options:

Firepower-chassis#

scope security

Firepower-chassis /security #

scope keyring kr220

Firepower-chassis /security/keyring #

create certreq

Firepower-chassis /security/keyring/certreq* #

set ip 192.168.200.123

Firepower-chassis /security/keyring/certreq* #

set subject-name sjc04

Firepower-chassis /security/keyring/certreq* #

set country US

Firepower-chassis /security/keyring/certreq* #

set dns bg1-samc-15A

Firepower-chassis /security/keyring/certreq* #

set email [email protected]

Firepower-chassis /security/keyring/certreq* #

set locality new york city

Firepower-chassis /security/keyring/certreq* #

set org-name "Cisco Systems"

Firepower-chassis /security/keyring/certreq* #

set org-unit-name Testing

Firepower-chassis /security/keyring/certreq* #

set state new york

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Creating a Trusted Point

Firepower-chassis /security/keyring/certreq* #

commit-buffer

Firepower-chassis /security/keyring/certreq #

show certreq

Certificate request subject name: sjc04

Certificate request ip address: 192.168.200.123

Certificate request e-mail name: [email protected]

Certificate request country name: US

State, province or county (full name): New York

Locality name (eg, city): new york city

Organization name (eg, company): Cisco

Organization Unit name (eg, section): Testing

Request:

-----BEGIN CERTIFICATE REQUEST-----

MIIBfTCB5wIBADARMQ8wDQYDVQQDEwZzYW1jMDQwgZ8wDQYJKoZIhvcNAQEBBQAD gY0AMIGJAoGBALpKn1t8qMZO4UGqILKFXQQc2c8b/vW2rnRF8OPhKbhghLA1YZ1F

JqcYEG5Yl1+vgohLBTd45s0GC8m4RTLJWHo4SwccAUXQ5Zngf45YtX1WsylwUWV4

0re/zgTk/WCd56RfOBvWR2Dtztu2pGA14sd761zLxt29K7R8mzj6CAUVAgMBAAGg

LTArBgkqhkiG9w0BCQ4xHjAcMBoGA1UdEQEB/wQQMA6CBnNhbWMwNIcECsEiXjAN

BgkqhkiG9w0BAQQFAAOBgQCsxN0qUHYGFoQw56RwQueLTNPnrndqUwuZHUO03Teg nhsyu4satpyiPqVV9viKZ+spvc6x5PWIcTWgHhH8BimOb/0OKuG8kwfIGGsEDlAv

TTYvUP+BZ9OFiPbRIA718S+V8ndXr1HejiQGxlDNqoN+odCXPc5kjoXD0lZTL09H

BA==

-----END CERTIFICATE REQUEST-----

Firepower-chassis /security/keyring/certreq #

What to Do Next

• Create a trusted point and set the certificate chain for the certificate of trust received from the trust anchor.

Creating a Trusted Point

Procedure

Step 1

Enter security mode:

Firepower-chassis #

scope security

Step 2

Create a trusted point:

Firepower-chassis /security #

create trustpoint name

Step 3

Specify certificate information for this trusted point:

Firepower-chassis /security/trustpoint #

set certchain

[

certchain

]

If you do not specify certificate information in the command, you are prompted to enter a certificate or a list of trustpoints defining a certification path to the root certificate authority (CA). On the next line following your input, type ENDOFBUF to finish.

Important

The certificate must be in Base64 encoded X.509 (CER) format.

Step 4

Commit the transaction:

Firepower-chassis /security/trustpoint #

commit-buffer

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Importing a Certificate into a Key Ring

The following example creates a trusted point and provides a certificate for the trusted point:

Firepower-chassis#

scope security

Firepower-chassis /security #

create trustpoint tPoint10

Firepower-chassis /security/trustpoint* #

set certchain

Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.

Trustpoint Certificate Chain:

-----BEGIN CERTIFICATE-----

MIIDMDCCApmgAwIBAgIBADANBgkqhkiG9w0BAQQFADB0MQswCQYDVQQGEwJVUzEL

BxMMU2FuIEpvc2UsIENBMRUwEwYDVQQKEwxFeGFtcGxlIEluYy4xEzARBgNVBAsT

ClRlc3QgR3JvdXAxGTAXBgNVBAMTEHRlc3QuZXhhbXBsZS5jb20xHzAdBgkqhkiG

9w0BCQEWEHVzZXJAZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ

AoGBAMZw4nTepNIDhVzb0j7Z2Je4xAG56zmSHRMQeOGHemdh66u2/XAoLx7YCcYU

ZgAMivyCsKgb/6CjQtsofvtrmC/eAehuK3/SINv7wd6Vv2pBt6ZpXgD4VBNKONDl

GMbkPayVlQjbG4MD2dx2+H8EH3LMtdZrgKvPxPTE+bF5wZVNAgMBAAGgJTAjBgkq

hkiG9w0BCQcxFhMUQSBjaGFsbGVuZ2UgcGFzc3dvcmQwDQYJKoZIhvcNAQEFBQAD

gYEAG61CaJoJaVMhzCl903O6Mg51zq1zXcz75+VFj2I6rH9asckCld3mkOVx5gJU

Ptt5CVQpNgNLdvbDPSsXretysOhqHmp9+CLv8FDuy1CDYfuaLtvlWvfhevskV0j6

jtcEMyZ+f7+3yh421ido3nO4MIGeBgNVHSMEgZYwgZOAFLlNjtcEMyZ+f7+3yh42

1ido3nO4oXikdjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFDASBgNVBAcT

C1NhbnRhIENsYXJhMRswGQYDVQQKExJOdW92YSBTeXN0ZW1zIEluYy4xFDASBgNV

BAsTC0VuZ2luZWVyaW5nMQ8wDQYDVQQDEwZ0ZXN0Q0GCAQAwDAYDVR0TBAUwAwEB

/zANBgkqhkiG9w0BAQQFAAOBgQAhWaRwXNR6B4g6Lsnr+fptHv+WVhB5fKqGQqXc

wR4pYiO4z42/j9Ijenh75tCKMhW51az8copP1EBmOcyuhf5C6vasrenn1ddkkYt4

PR0vxGc40whuiozBolesmsmjBbedUCwQgdFDWhDIZJwK5+N3x/kfa2EHU6id1avt

4YL5Jg==

-----END CERTIFICATE-----

ENDOFBUF

Firepower-chassis /security/trustpoint* #

commit-buffer

Firepower-chassis /security/trustpoint #

What to Do Next

Obtain a key ring certificate from the trust anchor or certificate authority and import it into the key ring.

Importing a Certificate into a Key Ring

Before You Begin

• Configure a trusted point that contains the certificate chain for the key ring certificate.

• Obtain a key ring certificate from a trust anchor or certificate authority.

Procedure

Step 1

Enter security mode:

Firepower-chassis #

scope security

Step 2

Enter configuration mode for the key ring that will receive the certificate:

Firepower-chassis /security #

scope keyring keyring-name

Step 3

Specify the trusted point for the trust anchor or certificate authority from which the key ring certificate was obtained:

Firepower-chassis /security/keyring # set trustpoint name

Step 4

Launch a dialog for entering and uploading the key ring certificate:

Firepower-chassis /security/keyring #

set cert

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Platform Settings

Configuring HTTPS

At the prompt, paste the certificate text that you received from the trust anchor or certificate authority. On the next line following the certificate, type ENDOFBUF to complete the certificate input.

Important

The certificate must be in Base64 encoded X.509 (CER) format.

Step 5

Commit the transaction:

Firepower-chassis /security/keyring #

commit-buffer

The following example specifies the trust point and imports a certificate into a key ring:

Firepower-chassis#

scope security

Firepower-chassis /security #

scope keyring kr220

Firepower-chassis /security/keyring #

set trustpoint tPoint10

Firepower-chassis /security/keyring* #

set cert

Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.

Keyring certificate:

-----BEGIN CERTIFICATE-----

MIIB/zCCAWgCAQAwgZkxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UE