Interface Management. Cisco FXOS Firepower Chassis Manager

C H A P T E R

9

Interface Management

•

About Firepower Security Appliance Interfaces, page 113

•

Edit Interface Properties, page 116

•

Change the Administrative State of an Interface, page 116

•

Create a Port Channel, page 117

•

Configuring Breakout Cables, page 118

About Firepower Security Appliance Interfaces

The FXOS chassis supports single interfaces as well as EtherChannel (port-channel) Interfaces. EtherChannel interfaces can include up to 16 member interfaces of the same type.

Interfaces Page

From the Interfaces page of the Firepower Chassis Manager, you can view the status of the installed interfaces on the chassis, edit interface properties, enable or disable an interface, and create port channels.

The Interfaces page is made up of two sections:

• The upper section shows a visual representation of the interfaces that are installed in the Firepower chassis. You can hover over any of the interfaces to get additional information about the interface.

The interfaces are color coded to indicate their current status:

◦ Green — The interface is installed and enabled.

◦ Dark Grey — The interface is installed but disabled.

◦

Red

—

There is a problem with the operational state of the interface.

◦

Light Grey

—

The interface is not installed.

• The lower section contains two tabs:

All Interfaces

and

Hardware Bypass

. On the

All Interfaces

tab:

For each interface, you can enable or disable the interface. You can also click

Edit

to edit the properties

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

113

Interface Management

Interface Types

of an interface, such as speed and interface type. For

Hardware Bypass

, see

Hardware Bypass Pairs,

on page 115 .

Note

The port-channel 48 cluster type interface shows the

Operation State

as

failed

if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not require any member interfaces, and you can ignore this Operational State.

Interface Types

Each interface can be one of the following types:

• Data (the default)--Data interfaces cannot be shared between logical devices.

• Management--Management interfaces can be shared between logical devices. You can only assign one management interface per logical device.

Within the Firepower Threat Defense application, the physical management interface is shared between the Diagnostic logical interface and the Management logical interface. The Management logical interface is separate from the other interfaces on the device. It is used to set up and register the device to the

Firepower Management Center. It runs a separate SSH server and uses its own local authentication, IP address, and static routing. You can configure its settings at the CLI using the

configure network

command, and also change the IP address from the Management Center

Devices

>

Device Management

>

Devices

>

Management

area.

The Diagnostic logical interface can be configured along with the rest of the data interfaces on the

Management Center

Devices

>

Device Management

>

Interfaces

screen. Using the Diagnostic interface is optional. The Diagnostic interface and data interfaces allow for LDAP or RADIUS external authentication. If you do not want to allow SSH access on a data interface, for example, then you may choose to configure the Diagnostic interface for SSH access. The Diagnostic interface only allows management traffic, and does not allow through traffic.

• Firepower-eventing--This interface is a secondary management interface for Firepower Threat Defense devices. To use this interface, you must configure its IP address and other parameters at the Firepower

Threat Defense CLI. For example, you can separate management traffic from events (such as web events).

See the

configure network

commands in the Firepower Management Center command reference.

• Cluster--Special interface type used for a clustered logical device. This type is automatically assigned to the cluster control link for inter-unit cluster communications. By default, the cluster control link is automatically created on Port-channel 48.

114

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Interface Management

Hardware Bypass Pairs

Note

You can use the Firepower Management Center or Firepower Threat Defense CLI to configure two uplink or breakout port interfaces into an inline pair. Once two ports are configured in an inline pair, they act as one single interface. This configuration is then propagated to the FXOS chassis.

Note the following restrictions for inline pairs:

• The two port interfaces must be unique. Once joining one inline pair, the ports cannot join another inline pair.

• Only data uplink ports or breakout ports can be configured into inline pairs.

For more information, see the Configure an Inline Set of IPS-Only Interfaces topic in the Firepower

Management Center Configuration Guide.

Hardware Bypass Pairs

For the Firepower Threat Defense, certain interface modules on the Firepower 9300 and 4100 series let you enable the Hardware Bypass feature. Hardware Bypass ensures that traffic continues to flow between an inline interface pair during a power outage. This feature can be used to maintain network connectivity in the case of software or hardware failures.

The Hardware Bypass feature is configured within the Hardware Bypass application. You do not need to use these interfaces as Hardware Bypass pairs; they can be used as regular interfaces for both the ASA and the

Firepower Threat Defense applications. Note that Hardware Bypass-capable interfaces cannot be configured for breakout ports. If you want to use the Hardware Bypass feature, do not configure the ports as EtherChannels; otherwise, you can include these interfaces as EtherChannel members in regular interface mode.

The Firepower Threat Defense supports Hardware Bypass for interface pairs on specific network modules on the following models:

• Firepower 9300

• Firepower 4100 series

The supported Hardware Bypass network modules for these models include:

• Firepower 6-port 1G SX FTW Network Module single-wide (FPR-NM-6X1SX-F)

• Firepower 6-port 10G SR FTW Network Module single-wide (FPR-NM-6X10SR-F)

• Firepower 6-port 10G LR FTW Network Module single-wide (FPR-NM-6X10LR-F)

• Firepower 2-port 40G SR FTW Network Module single-wide (FPR-NM-2X40G-F)

Hardware Bypass can only use the following port pairs:

• 1 & 2

• 3 & 4

• 5 & 6

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

115

Interface Management

Jumbo Frame Support

Jumbo Frame Support

The FXOS chassis has support for jumbo frames enabled by default. To enable jumbo frame support on a specific logical device installed on the FXOS chassis, you will need to configure the appropriate MTU settings for the interfaces on the logical device.

The maximum MTU that is supported for the application on the FXOS chassis is 9184.

Edit Interface Properties

Procedure

Step 1

Choose

Interfaces

to open the Interfaces page.

The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.

Step 2

Click

Edit

in the row for the interface you want to edit to open the

Edit Interface

dialog box.

Step 3

To enable the interface, check the

Enable

check box. To disable the interface, uncheck the

Enable

check box.

Step 4

(Optional) From the

Type

drop-down list, choose

data

to configure this interface as a data interface, choose

firepower-eventing

to configure the interface as a Firepower-eventing interface, or choose

mgmt

to configure the interface as a management interface.

Note

Do not choose the

Cluster

type.

Step 5

(Optional) Select the speed of the interface from the

Speed

drop-down list.

Step 6

Click

OK

.

Change the Administrative State of an Interface

Procedure

Step 1

Choose

Interfaces

to open the Interfaces page.

The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.

Step 2

For each interface whose administrative state you want to change, do one of the following:

• To set the administrative state of the interface to enabled, click the

Disabled

switch in the State column for the interface you want to enable to change the setting to

Enabled

. Click

Yes

to confirm the change.

The administrative state of the interface is changed to enabled. The corresponding interface in the visual representation changes from gray to green.

116

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Interface Management

Create a Port Channel

• To set the administrative state of the interface to disabled, click the

Enabled

switch in the State column for the interface you want to disable to change the setting to

Disabled

. Click

Yes

to confirm the change.

The administrative state of the interface is changed to disabled. The corresponding interface in the visual representation changes from green to gray.

Create a Port Channel

An EtherChannel (also known as a port-channel) can include up to 16 member interfaces of the same type.

When the FXOS chassis creates an EtherChannel, the EtherChannel stays in a

Suspended

state until you assign it to a logical device, even if the physical link is up. The EtherChannel will be brought out of this

Suspended

state in the following situations:

• The EtherChannel is added as a data or management port for a standalone logical device

• The EtherChannell is added as a management or CCL port for a logical device that is part of a cluster

• The EtherChannell is added as a data port for a logical device that is part of a cluster and at least one security module has joined the cluster

Note that the EtherChannel does not come up until you assign it to a logical device. If the EtherChannel is removed from the logical device or the logical device is deleted, the EtherChannel will revert to a

Suspended

state.

Before You Begin

The FXOS chassis only supports EtherChannels in Active Link Aggregation Control Protocol (LACP) mode.

We suggest setting the connecting switch ports to Active mode for the best compatibility.

Procedure

Step 1

Choose

Interfaces

to open the Interfaces page.

The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.

Step 2

Click

Add Port Channel

above the interfaces table to open the

Add Port Channel

dialog box.

Step 3

Enter an ID for the port channel in the

Port Channel ID

field. Valid values are between 1 and 47.

Port-channel 48 is reserved for the cluster control link when you deploy a clustered logical device. If you do not want to use Port-channel 48 for the cluster control link, you can configure an EtherChannel with a different

ID and choose the Cluster type for the interface. Do not assign any interfaces to the Cluster EtherChannel.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

117

Interface Management

Configuring Breakout Cables

Step 4

To enable the port channel, check the

Enable

check box. To disable the port channel, uncheck the

Enable

check box.

Step 5

Select the type of port channel from the

Type

drop-down list:

Data

,

Mgmt

, or

Cluster

.

Step 6

If not selected, click the

Interfaces

tab.

Step 7

To add an interface to the port channel, select the interface in the

Available Interface

list and click

Add

Interface

to move the interface to the Member ID list. You can add up to 16 interfaces of the same type and speed.

Tip

You can add multiple interfaces at one time. To select multiple individual interfaces, click on the desired interfaces while holding down the

Ctrl

key. To select a range of interfaces, select the first interface in the range, and then, while holding down the

Shift

key, click to select the last interface in the range.

Step 8

To remove an interface from the port channel, click the

Delete

button to the right of the interface in the Member

ID list.

Step 9

Click the

Settings

tab.

Step 10

Select the speed of the port channel from the

Speed

drop-down list.

Step 11

Click

OK

.

Configuring Breakout Cables

The following procedure shows how to configure breakout cables for use with the FXOS chassis. You can use a breakout cable to provide four 10 Gbps ports in place of a single 40 Gbps port.

Before You Begin

Hardware Bypass-capable interfaces cannot be configured for breakout ports.

Procedure

Step 1

Choose

Interfaces

to open the Interfaces page.

The Interfaces page shows a visual representation of the currently installed interfaces at the top of the page and provides a listing of the installed interfaces in the table below.

The interfaces that are capable of supporting breakout cables but are not currently configured as such are indicated by a Breakout Port icon in the row for that interface. For interfaces that have already been configured as using a breakout cable, the individual breakout interfaces are listed separately (for example, Ethernet 2/1/1,

2/1/2, 2/1/3, and 2/1/4).

Step 2

To convert a 40 Gbps interface into four 10 Gbps interfaces: a) Click the

Breakout Port

icon for the interface that you want to convert.

The Breakout Port Creation dialog box opens asking you to confirm that you want to proceed and warning you that the chassis will be rebooted.

b) Click

Yes

to confirm.

The Firepower chassis reboots and the specified interface is converted into four 10 Gbps interfaces.

Step 3

To convert the four 10 Gbps breakout interfaces back into a single 40 Gbps interface: a) Click

Delete

for any of the breakout interfaces.

118

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

Interface Management

Configuring Breakout Cables

A confirmation dialog box opens asking you to confirm that you want to proceed and warning you that all four breakout interfaces will be deleted and that the chassis will be rebooted.

b) Click

Yes

to confirm.

The Firepower chassis reboots and the specified interfaces are converted into a single 40 Gbps interface.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)

119

Configuring Breakout Cables

Interface Management

120

Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)