Logical Devices. Cisco FXOS Firepower Chassis Manager
The FXOS Firepower Chassis Manager is a web interface that makes it easy to configure platform settings and interfaces, provision devices, and monitor system status. It is part of the Cisco Application Centric Infrastructure (ACI) Security Solution, providing an agile, open, and secure platform built for scalability, consistent control, and simplified management. The Firepower Security Appliance FXOS Firepower Chassis Manager provides modular chassis-based security, a graphical user interface for configuration and monitoring, a command-line interface (FXOS CLI), and a REST API for programmatic configuration and management.
Advertisement
Advertisement
C H A P T E R
10
Logical Devices
•
About Logical Devices, page 121
•
Create a Standalone Logical Device, page 123
•
•
Configure Service Chaining, page 143
•
Manage Logical Devices, page 147
About Logical Devices
When you create a logical device, the FXOS chassis supervisor deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine, or in the case of an intra-chassis cluster, to all security modules installed in the Firepower chassis.
You can create either of the following two types of logical devices:
•
Standalone
—
You can create a standalone logical device for each security module/engine installed in the Firepower chassis.
• Cluster — Clustering lets you group multiple security modules together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. Multiple module devices, like the Firepower 9300, support intra-chassis clustering.
Note
On an FXOS chassis that supports multiple security modules, you can only create one type of logical device, standalone or cluster. In other words, if you have three security modules installed, you cannot create a standalone logical device on one security module and then create a cluster using the remaining two logical devices.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
121
Logical Devices
Logical Devices Page
Note
If you are configuring standalone logical devices, you must install the same software type on all modules in the chassis; different software types are not supported at this time. Note that modules can run different versions of a particular device type, but all modules must be configured as the same type of logical device.
Logical Devices Page
Use the Logical Devices page of the Firepower Chassis Manager to create, edit, and delete logical devices.
The Logical Devices page includes an informational area for the logical device(s) installed on each FXOS chassis security module/engine.
The header for each logical device area provides the following information:
• The unique name of the logical device.
• The name of the main application installed on the security module/engine, either ASA or FTD.
• The logical device mode, either Standalone or Clustered.
•
Status
—
Shows the state of the logical device:
◦ ok
—
The logical device configuration is complete.
◦ incomplete-configuration
—
The logical device configuration is incomplete.
Each logical device area provides the following information:
• Security Module — Shows the security module.
•
Ports
—
Shows the ports assigned to the application instance.
•
Application
—
Shows the application running on the security module.
• Version — Shows the software version number of the application running on the security module.
Note
Updates to Firepower Threat Defense logical devices are done using Firepower
Management Center and are not reflected on the
Logical Devices
>
Edit
and
System
>
Updates
pages in Firepower Chassis Manager. On these pages, the version shown indicates the software version (CSP image) that was used to create the Firepower Threat
Defense logical device.
•
Management IP
—
Shows the local IP address assigned as the logical device Management IP.
• Management URL — Shows the management URL assigned to the application instance.
• Gateway — Shows the network gateway address assigned to the application instance.
•
Management Port
—
Shows the management port assigned to the application instance.
•
Status
—
Shows the state of the application instance:
◦
Online
—
The application is running and operating.
122
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Create a Standalone Logical Device
◦ Offline — The application is stopped and inoperable.
◦
Installing
—
The application installation is in progress.
◦
Not Installed
—
The application is not installed.
◦ Install Failed — The application installation failed.
◦ Starting — The application is starting up.
◦
Start Failed
—
The application failed to start up.
◦
Started
—
The application started successfully, and is waiting for app agent heartbeat.
◦ Stopping — The application is in the process of stopping.
◦ Stop Failed — The application was unable to be brought offline.
◦
Not Responding
—
The application is unresponsive.
◦
Updating
—
The application software upgrade is in progress.
◦ Update Failed — The application software upgrade failed.
◦ Update Succeeded — The application software upgrade succeeded.
Create a Standalone Logical Device
You can create a standalone logical device for each security module/engine installed in the Firepower chassis.
Create a Standalone ASA Logical Device
You can create a standalone logical device for each security module/engine installed in the FXOS chassis.
On multiple module devices, like the Firepower 9300, you cannot create standalone logical devices if you have a cluster configured. You will need to delete the cluster before you can configure a standalone device.
Note
Optionally, you can install the third-party Radware DefensePro virtual platform as a DDoS detection and mitigation service that sits in front of the ASA firewall on the security module (see
on page 143 ).
Note
You must install the same software type on all modules in a chassis; different software types are not supported at this time. Note that modules can run different versions of a particular device type, but all modules must be configured as the same type of logical device.
Before You Begin
• If the security module/engine that you want to use for the logical device already has a logical device configured on it, you must first delete the existing logical device (see
Delete a Logical Device, on page
148 ).
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
123
Logical Devices
Create a Standalone ASA Logical Device
• Download the application image you want to use for the logical device from Cisco.com (see
Images from Cisco.com, on page 34
) and then upload that image to the FXOS chassis (see
Uploading an Image to the Firepower Security Appliance, on page 34
).
• Configure a management interface to use with the logical device.
• You can only deploy a routed firewall mode ASA from the FXOS chassis. To change the ASA to transparent firewall mode, complete this procedure, and then see
Change the ASA to Transparent Firewall
.
Procedure
Step 1
Choose
Logical Devices
to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 2
Click
Add Device
to open the
Add Device
dialog box.
Step 3
For the
Device Name
, provide a name for the logical device.
Step 4
For the
Template
, choose
Cisco Adaptive Security Appliance
.
Step 5
For the
Image Version
, choose the ASA software version.
Step 6
For the
Device Mode
, click the
Standalone
radio button.
Step 7
Click
OK
.
You see the Provisioning -
device name
window.
Step 8
Expand the
Data Ports
area, and click each port that you want to assign to the device.
Step 9
Click the device icon in the center of the screen.
The ASA Configuration dialog box appears.
Step 10
On the
General Information
tab, complete the following: a) On multiple module devices, like the Firepower 9300, choose the security module that you want to use for this logical device by clicking on it under Security Module Selection.
b) Select the management interface to use with the logical device from the
Management Interface
drop-down list.
c) Under DEFAULT, configure the management interface:
This information is used to configure a management interface in the security module/engine configuration.
This management IP address is also the IP address you will use to connect to ASDM.
1
Select the type of address from the
Address Type
drop-down list.
2
In the
Management IP
field, configure a local IP address.
3
Enter a
Network Mask
or
Prefix Length
.
4
Enter a
Network Gateway
address.
Step 11
On the
Settings
tab, enter a password for the "admin" user in the
Password
field.
Step 12
Click
OK
to close the ASA Configuration dialog box.
Step 13
Click
Save
.
124
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Create a Standalone Threat Defense Logical Device
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine.
Create a Standalone Threat Defense Logical Device
You can create a standalone logical device for each security module/engine installed in the FXOS chassis.
On multiple module devices, like the Firepower 9300, you cannot create standalone logical devices if you have a cluster configured. You will need to delete the cluster before you can configure a standalone device.
Note
You must install the same software type on all modules in a chassis; different software types are not supported at this time. Note that modules can run different versions of a particular device type, but all modules must be configured as the same type of logical device.
Before You Begin
• If the security module/engine that you want to use for the logical device already has a logical device configured on it, you must first delete the existing logical device (see
Delete a Logical Device, on page
148 ).
• Download the application image you want to use for the logical device from Cisco.com (see
Images from Cisco.com, on page 34
) and then upload that image to the FXOS chassis (see
Uploading an Image to the Firepower Security Appliance, on page 34
).
• Configure a management interface to use with the logical device. You must also configure at least one
Data type interface. Optionally, you can also create a firepower-eventing interface to carry all event traffic (such as web events).
Procedure
Step 1
Choose
Logical Devices
to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 2
Click
Add Device
to open the
Add Device
dialog box.
Step 3
For the
Device Name
, provide a name for the logical device.
This name is used by the FXOS chassis supervisor to configure management settings and to assign interfaces; it is not the device name used in the security module/engine configuration.
Step 4
For the
Template
, choose
Cisco Firepower Threat Defense
.
Step 5
For the
Image Version
, choose the Threat Defense software version.
Step 6
For the
Device Mode
, click the
Standalone
radio button.
Step 7
Click
OK
.
You see the Provisioning -
device name
window.
Step 8
Expand the
Data Ports
area, and click each port that you want to assign to the device.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
125
Logical Devices
Create a Standalone Threat Defense Logical Device
Hardware Bypass-capable ports are shown with the following icon: . If you do not assign both interfaces in a Hardware Bypass pair, you see a warning message to make sure your assignment is intentional. You do not need to use the Hardware Bypass feature, so you can assign single interfaces if you prefer.
Step 9
Click the device icon in the center of the screen.
The configuration dialog box appears.
Step 10
On the
General Information
tab, complete the following: a) On multiple module devices, like the Firepower 9300, choose the security module that you want to use for this logical device by clicking on it under Security Module Selection.
b) Select the management interface to use with the logical device from the
Management Interface
drop-down list.
If you assign a Hardware Bypass-capable interface as the Management interface, you see a warning message to make sure your assignment is intentional.
c) Under Management, configure the management interface:
1
Select the type of address from the
Address Type
drop-down list.
2
In the
Management IP
field, configure a local IP address.
3
Enter a
Network Mask
or
Prefix Length
.
4
Enter a
Network Gateway
address.
Step 11
On the
Settings
tab, complete the following: a) In the
Registration Key
field, enter the key to be shared between Firepower Management Center and the device during registration.
b) In the
Password
field, enter a password for the device.
c) In the
Firepower Management Center IP
field, enter the IP address of the managing Firepower
Management Center.
d) In the
Search Domains
field, enter a comma-separated list of search domains for the device.
e) Choose the firewall mode: Transparent or Routed.
f) In the
DNS Servers
field, enter a comma-separated list of DNS servers for the device to use.
g) In the
Fully Qualified Hostname
field, enter a fully qualified name for the Threat Defense device.
h) Choose the interface on which Firepower events should be sent. If not specified, the management interface will be used.
To specify an interface to use for Firepower events, you must configure an interface as a
firepower-eventing
interface. For more information, see
About Firepower Security Appliance Interfaces, on page 113
.
Step 12
On the
Agreement
tab, read and accept the end user license agreement (EULA).
Step 13
Click
OK
to close the configuration dialog box.
Step 14
Click
Save
.
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine.
126
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Deploy a Cluster
Deploy a Cluster
Clustering lets you group multiple devices together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. The Firepower 9300, which includes multiple modules, supports intra-chassis clustering where you group all modules within a single chassis into a cluster. You can also use inter-chassis clustering, where multiple chassis are grouped together; inter-chasis clustering is the only option for single module devices like the Firepower 4100 series.
Note
The Firepower Threat Defense does not support a cluster across multiple chassis (inter-chassis); only intra-chassis clustering is supported.
About Clustering on the FXOS Chassis
The cluster consists of multiple devices acting as a single logical unit. When you deploy a cluster on the FXOS chassis, it does the following:
• Creates a
cluster-control link
(by default, port-channel 48) for unit-to-unit communication. For intra-chassis clustering (Firepower 9300 only), this link utilizes the Firepower 9300 backplane for cluster communications. For inter-chassis clustering, you need to manually assign physical interface(s) to this
EtherChannel for communications between chassis.
• Creates the cluster bootstrap configuration within the application.
When you deploy the cluster, the FXOS chassis supervisor pushes a minimal bootstrap configuration to each unit that includes the cluster name, cluster control link interface, and other cluster settings. Some parts of the bootstrap configuration may be user-configurable within the application if you want to customize your clustering environment.
• Assigns data interfaces to the cluster as
Spanned
interfaces.
For intra-chassis clustering, spanned interfaces are not limited to EtherChannels, like it is for inter-chassis clustering.The Firepower 9300 supervisor uses EtherChannel technology internally to load-balance traffic to multiple modules on a shared interface, so any data interface type works for Spanned mode.
For inter-chassis clustering, you must use Spanned EtherChannels for all data interfaces.
Note
Individual interfaces are not supported, with the exception of a management interface.
• Assigns a management interface to all units in the cluster.
The following sections provide more detail about clustering concepts and implementation.
Primary and Secondary Unit Roles
One member of the cluster is the primary unit. The primary unit is determined automatically. All other members are secondary units.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
127
Logical Devices
About Clustering on the FXOS Chassis
You must perform all configuration on the primary unit only; the configuration is then replicated to the secondary units.
Cluster Control Link
The cluster control link is automatically created using the Port-channel 48 interface. For intra-chassis clustering, this interface has no member interfaces. For inter-chassis clustering, you must add one or more interfaces to the EtherChannel. This Cluster type EtherChannel utilizes the Firepower 9300 backplane for cluster communications for intra-chassis clustering.
For a 2-member inter-chassis cluster, do not directly connect the cluster control link from one chassis to the other chassis. If you directly connect the interfaces, then when one unit fails, the cluster control link fails, and thus the remaining healthy unit fails. If you connect the cluster control link through a switch, then the cluster control link remains up for the healthy unit.
Cluster control link traffic includes both control and data traffic.
Size the Cluster Control Link for Inter-Chassis Clustering
If possible, you should size the cluster control link to match the expected throughput of each chassis so the cluster-control link can handle the worst-case scenarios.
Cluster control link traffic is comprised mainly of state update and forwarded packets. The amount of traffic at any given time on the cluster control link varies. The amount of forwarded traffic depends on the load-balancing efficacy or whether there is a lot of traffic for centralized features. For example:
• NAT results in poor load balancing of connections, and the need to rebalance all returning traffic to the correct units.
• When membership changes, the cluster needs to rebalance a large number of connections, thus temporarily using a large amount of cluster control link bandwidth.
A higher-bandwidth cluster control link helps the cluster to converge faster when there are membership changes and prevents throughput bottlenecks.
Note
If your cluster has large amounts of asymmetric (rebalanced) traffic, then you should increase the cluster control link size.
Cluster Control Link Redundancy for Inter-Chassis Clustering
The following diagram shows how to use an EtherChannel as a cluster control link in a Virtual Switching
System (VSS) or Virtual Port Channel (vPC) environment. All links in the EtherChannel are active. When the switch is part of a VSS or vPC, then you can connect FXOS chassis interfaces within the same EtherChannel to separate switches in the VSS or vPC. The switch interfaces are members of the same EtherChannel port-channel interface, because the separate switches act like a single switch. Note that this EtherChannel is device-local, not a Spanned EtherChannel.
128
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
About Clustering on the FXOS Chassis
Cluster Control Link Reliability for Inter-Chassis Clustering
To ensure cluster control link functionality, be sure the round-trip time (RTT) between units is less than 20 ms. This maximum latency enhances compatibility with cluster members installed at different geographical sites. To check your latency, perform a ping on the cluster control link between units.
The cluster control link must be reliable, with no out-of-order or dropped packets; for example, for inter-site deployment, you should use a dedicated link.
Cluster Control Link Network
The FXOS chassis auto-generates the cluster control link interface IP address for each unit based on the chassis
ID and slot ID: 127.2.
chassis_id
.
slot_id
. You cannot set this IP address manually, either in FXOS or within the application. The cluster control link network cannot include any routers between units; only Layer 2 switching is allowed. For inter-site traffic, Cisco recommends using Overlay Transport Virtualization (OTV).
Management Network
We recommend connecting all units to a single management network. This network is separate from the cluster control link.
Management Interface
You can assign a Management type interface to the cluster. This interface is a special
individual
interface as opposed to a Spanned interface. The management interface lets you connect directly to each unit.
For the ASA, the Main cluster IP address is a fixed address for the cluster that always belongs to the current primary unit. You also configure a range of addresses so that each unit, including the current primary unit, can use a Local address from the range. The Main cluster IP address provides consistent management access to an address; when a primary unit changes, the Main cluster IP address moves to the new primary unit, so management of the cluster continues seamlessly. The Local IP address is used for routing, and is also useful for troubleshooting. For example, you can manage the cluster by connecting to the Main cluster IP address, which is always attached to the current primary unit. To manage an individual member, you can connect to the Local IP address. For outbound management traffic such as TFTP or syslog, each unit, including the primary unit, uses the Local IP address to connect to the server.
For the Firepower Threat Defense, assign a management IP address to each unit on the same network. Use these IP addresses when you add each unit to the Management Center.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
129
Logical Devices
About Clustering on the FXOS Chassis
Spanned EtherChannels
You can group one or more interfaces per chassis into an EtherChannel that spans all chassis in the cluster.
The EtherChannel aggregates the traffic across all the available active interfaces in the channel. A Spanned
EtherChannel can be configured in both routed and transparent firewall modes. In routed mode, the
EtherChannel is configured as a routed interface with a single IP address. In transparent mode, the IP address is assigned to the BVI, not to the bridge group member interface. The EtherChannel inherently provides load balancing as part of basic operation.
Inter-Site Clustering
For inter-site installations, you can take advantage of clustering as long as you follow the recommended guidelines.
You can configure each cluster chassis to belong to a separate site ID.
Site IDs work with site-specific MAC addresses and IP addresses. Packets sourced from the cluster use a site-specific MAC address and IP address, while packets received by the cluster use a global MAC address and IP address. This feature prevents the switches from learning the same global MAC address from both sites on two different ports, which causes MAC flapping; instead, they only learn the site MAC address.
Site-specific MAC addresses and IP address are supported for routed mode using Spanned EtherChannels only.
Site IDs are also used to enable flow mobility using LISP inspection.
See the following sections for more information about inter-site clustering:
• Sizing the Data Center Interconnect
— Prerequisites for Clustering, on page 131
• Inter-Site Guidelines —
Guidelines for Clustering, on page 132
•
Inter-Site Examples
Examples for Inter-Site Clustering, on page 140
130
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Prerequisites for Clustering
Prerequisites for Clustering
Inter-Chassis Hardware and Software Requirements
All chassis in a cluster:
• For the Firepower 4100 series: All chassis must be the same model. For the Firepower 9300: All security modules must be the same type. You can have different quantities of installed security modules in each chassis, although all modules present in the chassis must belong to the cluster including any empty slots.
• Must run the identical FXOS software except at the time of an image upgrade.
• Must include the same interface configuration for interfaces you assign to the cluster, such as the same
Management interface, EtherChannels, active interfaces, speed and duplex, and so on. You can use different network module types on the chassis as long as the capacity matches for the same interface
IDs and interfaces can successfully bundle in the same spanned EtherChannel. Note that all data interfaces must be EtherChannels in inter-chassis clustering.
• Must use the same NTP server. Do not set the time manually.
• Must be registered with the License Authority when using the ASA; for Firepower Threat Defense, all licensing is handled by the Firepower Management Center.
Switch Prerequisites for Inter-Chassis Clustering
• Be sure to complete the switch configuration and successfully connect all the EtherChannels from the chassis to the switch(es) before you configure clustering on the FXOS chassis.
• For a list of supported switches, see Cisco FXOS Compatibility .
Sizing the Data Center Interconnect for Inter-Site Clustering
You should reserve bandwidth on the data center interconnect (DCI) for cluster control link traffic equivalent to the following calculation:
If the number of members differs at each site, use the larger number for your calculation. The minimum bandwidth for the DCI should not be less than the size of the cluster control link for one member.
For example:
• For 4 members at 2 sites:
◦ 4 cluster members total
◦ 2 members at each site
◦ 5 Gbps cluster control link per member
Reserved DCI bandwidth = 5 Gbps (2/2 x 5 Gbps).
• For 6 members at 3 sites, the size increases:
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
131
Logical Devices
Guidelines for Clustering
◦ 6 cluster members total
◦ 3 members at site 1, 2 members at site 2, and 1 member at site 3
◦ 10 Gbps cluster control link per member
Reserved DCI bandwidth = 15 Gbps (3/2 x 10 Gbps).
• For 2 members at 2 sites:
◦ 2 cluster members total
◦ 1 member at each site
◦ 10 Gbps cluster control link per member
Reserved DCI bandwidth = 10 Gbps (1/2 x 10 Gbps = 5 Gbps; but the minimum bandwidth should not be less than the size of the cluster control link (10 Gbps)).
Guidelines for Clustering
Models
•
ASA on the Firepower 9300
—
Supported for intra-chassis, inter-chassis, and inter-site clustering.
•
ASA on the Firepower 4100 series
—
Supported for inter-chassis and inter-site clustering.
• Firepower Threat Defense on the Firepower 9300 — Supported for intra-chassis clustering.
• Radware DefensePro — Supported for intra-chassis clustering with the ASA.
Switches for Inter-Chassis Clustering
• For the ASR 9006, if you want to set a non-default MTU, set the ASR interface MTU to be 14 bytes higher than the cluster device MTU. Otherwise, OSPF adjacency peering attempts may fail unless the
mtu-ignore
option is used. Note that the cluster device MTU should match the ASR
IPv4
MTU.
• On the switch(es) for the cluster control link interfaces, you can optionally enable Spanning Tree PortFast on the switch ports connected to the cluster unit to speed up the join process for new units.
• When you see slow bundling of a Spanned EtherChannel on the switch, you can enable LACP rate fast for an individual interface on the switch.
• On the switch, we recommend that you use one of the following EtherChannel load-balancing algorithms:
source-dest-ip
or
source-dest-ip-port
(see the Cisco Nexus OS and Cisco IOS
port-channel load-balance
command). Do not use a
vlan
keyword in the load-balance algorithm because it can cause unevenly distributed traffic to the devices in a cluster.
Do not
change the load-balancing algorithm from the default on the cluster device.
• If you change the load-balancing algorithm of the EtherChannel on the switch, the EtherChannel interface on the switch temporarily stops forwarding traffic, and the Spanning Tree Protocol restarts. There will be a delay before traffic starts flowing again.
132
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Guidelines for Clustering
• Switches on the cluster control link path should not verify the L4 checksum. Redirected traffic over the cluster control link does not have a correct L4 checksum. Switches that verify the L4 checksum could cause traffic to be dropped.
• Port-channel bundling downtime should not exceed the configured keepalive interval.
• On Supervisor 2T EtherChannels, the default hash distribution algorithm is adaptive. To avoid asymmetric traffic in a VSS design, change the hash algorithm on the port-channel connected to the cluster device to fixed: router(config)# port-channel id hash-distribution fixed
Do not change the algorithm globally; you may want to take advantage of the adaptive algorithm for the
VSS peer link.
EtherChannels for Inter-Chassis Clustering
• For connecting switches, set the EtherChannel mode to Active; On mode is not supported on the FXOS chassis, even for the cluster control link.
• FXOS EtherChannels have the LACP rate set to normal by default. This setting can make port-channel members take more than 30 seconds to bundle, which can cause the cluster interface health check to fail causing the unit to be removed from the cluster. We recommend that you change the LACP rate to fast.
The following example modifies the "default" lacp policy: firepower#
scope org
firepower /org #
scope lacppolicy default
firepower /org/lacppolicy#
set lacp-rate fast
firepower /org* #
commit-buffer
• In Catalyst 3750-X Cisco IOS software versions earlier than 15.1(1)S2, the cluster unit did not support connecting an EtherChannel to a switch stack. With default switch settings, if the cluster unit EtherChannel is connected cross stack, and if the master switch is powered down, then the EtherChannel connected to the remaining switch will not come up. To improve compatibility, set the
stack-mac persistent timer
command to a large enough value to account for reload time; for example, 8 minutes or 0 for indefinite.
Or, you can upgrade to more a more stable switch software version, such as 15.1(1)S2.
•
Spanned vs. Device-Local EtherChannel Configuration
—
Be sure to configure the switch appropriately for Spanned EtherChannels vs. Device-local EtherChannels.
◦
Spanned EtherChannels
—
For cluster unit
Spanned
EtherChannels, which span across all members of the cluster, the interfaces are combined into a single EtherChannel on the switch. Make sure each interface is in the same channel group on the switch.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
133
Guidelines for Clustering
Logical Devices
◦ Device-local EtherChannels — For cluster unit
Device-local
EtherChannels including any
EtherChannels configured for the cluster control link, be sure to configure discrete EtherChannels on the switch; do not combine multiple cluster unit EtherChannels into one EtherChannel on the switch.
134
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Defaults for Clustering
Additional Guidelines
• We recommend connecting EtherChannels to a VSS or vPC for redundancy.
• Within a chassis, you cannot cluster some security modules and run other security modules in standalone mode; you must include all security modules in the cluster.
Defaults for Clustering
The cluster control link uses Port-channel 48.
Configure ASA Clustering
You can easily deploy the cluster from the FXOS chassis supervisor. All initial configuration is automatically generated for each unit. For inter-chassis clustering, you must configure each chassis separately. Deploy the cluster on one chassis; you can then copy the bootstrap configuration from the first chassis to the next chassis for ease of deployment.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
135
Logical Devices
Configure ASA Clustering
Before You Begin
• You must enable clustering for all 3 module slots in a Firepower 9300 chassis, even if you do not have a module installed. If you do not configure all 3 modules, the cluster will not come up.
• On the
Interfaces
tab, the port-channel 48 cluster type interface shows the
Operation State
as
failed
if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not require any member interfaces, and you can ignore this Operational State.
• You can only deploy a routed firewall mode ASA cluster from the FXOS chassis. To change the ASA cluster to transparent firewall mode, complete this procedure, and then see
.
Procedure
Step 1
Add at least one Data type interface or EtherChannel (also known as a port-channel) before you deploy the cluster. See
Create a Port Channel, on page 117
or
Edit Interface Properties, on page 116
.
You can also add data interfaces to the cluster after you deploy it.
For inter-chassis clustering, all data interfaces must be EtherChannels with at least one member interface.
Add the same EtherChannels on each chassis.
Step 2
Add a Management type interface or EtherChannel. See
Create a Port Channel, on page 117
or
.
For inter-chassis clustering, add the same Management interface on each chassis.
Step 3
For inter-chassis clustering, add a member interface to port-channel 48, which is used as the cluster control link.
If you do not include a member interface, then when you deploy the logical device, the Firepower Chassis
Manager assumes that this cluster is an intra-chassis cluster and does not show the
Chassis ID
field. Add the same member interfaces on each chassis.
Step 4
Choose
Logical Devices
to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 5
Click
Add Device
to open the
Add Device
dialog box.
If you have an existing cluster, you are prompted to remove the cluster and add a new one. All cluster-related configuration on the security modules will be replaced by the new information.
Step 6
For the
Device Name
, provide a name for the logical device. This name is used by the FXOS chassis supervisor to configure clustering settings and assign interfaces; it is not the cluster name used in the security module configuration.
Step 7
For the
Template
, choose
Cisco Adaptive Security Appliance
.
Step 8
For the
Image Version
, choose the ASA software version.
Step 9
For the
Device Mode
, click the
Cluster
radio button.
Step 10
Click the
Create New Cluster
radio button.
Step 11
Click
OK
.
If you have any standalone devices configured, you are prompted to replace them with a new cluster. You see the Provisioning -
device name
window.
All interfaces are assigned to the cluster by default.
136
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Configure ASA Clustering
Step 12
Click the device icon in the center of the screen.
The ASA Configuration dialog box appears with the
Cluster Information
tab selected.
Step 13
In the
Chassis ID
field, enter a chassis ID. Each chassis in the cluster must use a unique ID.
Step 14
In the
Cluster Key
field, configure an authentication key for control traffic on the cluster control link.
The shared secret is an ASCII string from 1 to 63 characters. The shared secret is used to generate the key.
This option does not affect datapath traffic, including connection state update and forwarded packets, which are always sent in the clear.
Step 15
Set the
Cluster Group Name
, which is the cluster group name in the security module configuration.
The name must be an ASCII string from 1 to 38 characters.
Step 16
Click
Management Interface
and choose the management interface you created earlier.
Step 17
Choose the
Address Type
for the management interface.
This information is used to configure a management interface in the security module configuration.
a) In the
Management IP Pool
field, configure a pool of Local IP addresses, one of which will be assigned to each cluster unit for the interface, by entering the starting and ending addresses separated by a hyphen.
Include at least as many addresses as there are units in the cluster. Note that for the Firepower 9300, you must include 3 addresses per chassis, even if you do not have all module slots filled. If you plan to expand the cluster, include additional addresses. The Virtual IP address (known as the Main cluster IP address) that belongs to the current primary unit is
not
a part of this pool; be sure to reserve an IP address on the same network for the Main cluster IP address. You can use IPv4 and/or IPv6 addresses.
b) Enter a
Network Mask
or
Prefix Length
.
c) Enter a
Network Gateway
.
d) Enter a
Virtual IP address
.
This IP address must be on the same network as the cluster pool addresses, but not be part of the pool.
Step 18
On the
Settings
tab, for the
Password
, enter a password for the "admin" user.
Step 19
Click
OK
to close the ASA Configuration dialog box.
Step 20
Click
Save
.
The FXOS chassis supervisor deploys the cluster by downloading the specified software version and pushing the cluster bootstrap configuration and management interface settings to each security module.
Step 21
For inter-chassis clustering, add the next chassis to the cluster: a) On the first chassis Firepower Chassis Manager, click the
Show Cluster Details
icon at the top right; copy the displayed cluster configuration.
b) Connect to the Firepower Chassis Manager on the next chassis, and add a logical device according to this procedure.
c) Choose
Join an Existing Cluster
.
d) Click the
Copy config
check box, and click
OK
. If you uncheck this check box, you must manually enter the settings to match the first chassis configuration.
e) In the
Copy Cluster Details
box, paste in the cluster configuration from the first chassis, and click
OK
.
f) Click the device icon in the center of the screen. The cluster information is mostly pre-filled, but you must change the following settings:
•
Chassis ID
— Enter a unique chassis ID.
•
Cluster Key
—
(Not prefilled) Enter the same cluster key.
Click
OK
.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
137
Logical Devices
Configure Firepower Threat Defense Clustering
g) Click
Save
.
Step 22
Connect to the primary unit security module to customize your clustering configuration.
Configure Firepower Threat Defense Clustering
You can easily deploy the cluster from the FXOS chassis supervisor. All initial configuration is automatically generated for each unit.
Before You Begin
• You must enable clustering for all 3 module slots in a Firepower 9300 chassis, even if you do not have a module installed. If you do not configure all 3 modules, the cluster will not come up.
• On the
Interfaces
tab, the port-channel 48 cluster type interface shows the
Operation State
as
failed
if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not require any member interfaces, and you can ignore this Operational State.
Procedure
Step 1
Add at least one Data type interface or EtherChannel (also known as a port-channel) before you deploy the cluster.
You can also add data interfaces to the cluster after you deploy it.
Step 2
Add a Management type interface or EtherChannel.
Step 3
(Optional) Add a Firepower-eventing interface.
This interface is a secondary management interface for Firepower Threat Defense devices. To use this interface, you must configure its IP address and other parameters at the Firepower Threat Defense CLI. For example, you can separate management traffic from events (such as web events). See the
configure network
commands in the Firepower Threat Defense command reference.
Step 4
Choose
Logical Devices
to open the
Logical Devices
page.
The
Logical Devices
page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 5
Click
Add Device
to open the
Add Device
dialog box.
If you have an existing logical device, you are prompted to remove the device and add a new one. All configuration on the security modules will be replaced by the new information.
Step 6
For the
Device Name
, provide a name for the logical device. This name is used by the FXOS chassis supervisor to configure clustering/management settings and to assign interfaces; it is not the cluster name used in the logical device configuration.
Step 7
For the
Template
, choose
Cisco Firepower Threat Defense
.
Step 8
For the
Image Version
, choose the Firepower Threat Defense software version. Make sure this version is compatible with your FXOS version and with the Firepower Management Center version.
Step 9
For the
Device Mode
, click the
Cluster
radio button.
Step 10
Click
OK
.
138
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Configure Firepower Threat Defense Clustering
If you have any standalone devices configured, you are prompted to replace them with a new cluster. You see the Provisioning - device name window.
All interfaces are assigned to the cluster by default. Hardware Bypass-capable ports are shown with the following icon: . If you do not assign both interfaces in a Hardware Bypass pair, you see a warning message to make sure your assignment is intentional. You do not need to use the Hardware Bypass feature, so you can assign single interfaces if you prefer.
Step 11
Click the device icon in the center of the screen.
The
Cisco Firepower Threat Defense Configuration
dialog box appears.
Step 12
On the
Cluster Information
tab, complete the following: a) In the
Cluster Key
field, configure an authentication key for control traffic on the cluster control link.
The shared secret is an ASCII string from 1 to 63 characters. The shared secret is used to generate the key.
This option does not affect datapath traffic, including connection state update and forwarded packets, which are always sent in the clear.
b) Set the
Cluster Group Name
, which is the cluster group name in the logical device configuration.
The name must be an ASCII string from 1 to 38 characters.
c) Select the management interface to use with the logical device from the
Management Interface
drop-down list.
If you assign a Hardware Bypass-capable interface as the Management interface, you see a warning message to make sure your assignment is intentional.
Step 13
On the
Settings
tab, complete the following: a) In the
Registration Key
field, enter the key to be shared between the Firepower Management Center and the cluster members during registration.
b) In the
Password
field, enter a password for the admin user on the cluster.
c) In the
Firepower Management Center IP
field, enter the IP address of the managing Firepower
Management Center.
d) In the
Search Domains
field, enter a comma-separated list of search domains for the management network.
e) From the
Firewall Mode
drop-down list, choose
Transparent
or
Routed
.
f) In the
DNS Servers
field, enter a comma-separated list of DNS servers that the Firepower Threat Defense device should use on the management network.
g) In the
Fully Qualified Hostname
field, enter a fully qualified name for the Firepower Threat Defense device.
h) From the
Eventing Interface
drop-down list, choose the interface on which Firepower events should be sent. If not specified, the management interface will be used.
To specify a separate interface to use for Firepower events, you must configure an interface as a
firepower-eventing
interface. If you assign a Hardware Bypass-capable interface as the Eventing interface, you see a warning message to make sure your assignment is intentional.
Step 14
On the
Interface Information
tab, configure a management IP address for each security module in the cluster.
Select the type of address from the
Address Type
drop-down list and then complete the following for each security module.
Note
You must set the IP address for all 3 module slots in a chassis, even if you do not have a module installed. If you do not configure all 3 modules, the cluster will not come up.
a) In the
Management IP
field, configure an IP address.
Specify an IP address on the same network for each module.
b) Enter a
Network Mask
or
Prefix Length
.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
139
Logical Devices
Examples for Inter-Site Clustering
c) Enter a
Network Gateway
address.
Step 15
On the
Agreement
tab, read and accept the end user license agreement (EULA).
Step 16
Click
OK
to close the
Cisco Firepower Threat Defense Configuration
dialog box.
Step 17
Click
Save
.
The FXOS chassis supervisor deploys the cluster by downloading the specified software version and pushing the cluster bootstrap configuration and management interface settings to each security module.
Step 18
Add each unit separately to the Firepower Management Center using the management IP addresses, and then group them into a cluster at the web interface.
All cluster units must be in a successfully-formed cluster on FXOS prior to adding them to Firepower
Management Center.
Examples for Inter-Site Clustering
The following examples show supported cluster deployments.
Spanned EtherChannel Transparent Mode North-South Inter-Site Example
The following example shows 2 cluster members at each of 2 data centers placed between inside and outside routers (North-South insertion). The cluster members are connected by the cluster control link over the DCI.
The cluster members at each site connect to the local switches using spanned EtherChannels for the inside and outside. Each EtherChannel is spanned across all chassis in the cluster.
The inside and outside routers at each data center use OSPF, which is passed through the transparent ASAs.
Unlike MACs, router IPs are unique on all routers. By assigning a higher cost route across the DCI, traffic stays within each data center unless all cluster members at a given site go down. The lower cost route through the ASAs must traverse the same bridge group at each site for the cluster to maintain asymmetric connections.
In the event of a failure of all cluster members at one site, traffic goes from each router over the DCI to the cluster members at the other site.
The implementation of the switches at each site can include:
• Inter-site VSS/vPC — In this scenario, you install one switch at Data Center 1, and the other at Data
Center 2. One option is for the cluster units at each Data Center to only connect to the local switch, while the VSS/vPC traffic goes across the DCI. In this case, connections are for the most part kept local to each datacenter. You can optionally connect each unit to both switches across the DCI if the DCI can handle the extra traffic. In this case, traffic is distributed across the data centers, so it is essential for the
DCI to be very robust.
• Local VSS/vPC at each site — For better switch redundancy, you can install 2 separate VSS/vPC pairs at each site. In this case, although the cluster units still have a spanned EtherChannel with Data Center
1 chassis connected only to both local switches, and Data Center 2 chassis connected to those local switches, the spanned EtherChannel is essentially
“ split.
”
Each local VSS/vPC sees the spanned
EtherChannel as a site-local EtherChannel.
140
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Examples for Inter-Site Clustering
Spanned EtherChannel Transparent Mode East-West Inter-Site Example
The following example shows 2 cluster members at each of 2 data centers placed between the gateway router and two inside networks at each site, the App network and the DB network (East-West insertion). The cluster members are connected by the cluster control link over the DCI. The cluster members at each site connect to the local switches using spanned EtherChannels for both the App and DB networks on the inside and outside.
Each EtherChannel is spanned across all chassis in the cluster.
The gateway router at each site uses an FHRP such as HSRP to provide the same destination virtual MAC and IP addresses at each site. A good practice to avoid unintended MAC address flapping is to statically add the gateway routers real MAC addresses to the ASA MAC address table. Without these entries, if the gateway at site 1 communicates with the gateway at site 2, that traffic might pass through the ASA and attempt to reach site 2 from the inside interface and cause problems. The data VLANs are extended between the sites using
Overlay Transport Virtualization (OTV) (or something similar). You must add filters to prevent traffic from traversing the DCI to the other site when the traffic is destined for the gateway router. If the gateway router at one site becomes unreachable, you must remove the filters so traffic can be sent to the other site
’ s gateway router.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
141
History for Clustering
Logical Devices
See
Spanned EtherChannel Transparent Mode North-South Inter-Site Example, on page 140
for information about vPC/VSS options.
History for Clustering
Feature Name Platform
Releases
Intra-chassis Clustering for the Cisco ASA
1.1.1
Feature Information
You can cluster all ASA security modules within the Firepower 9300 chassis.
We introduced the following screen:
Logical Devices
>
Configuration
Inter-chassis clustering for
6 ASA modules
1.1.3
Support for intra-chassis clustering on the
Firepower Threat Defense on the Firepower 9300
1.1.4
You can now enable inter-chassis clustering for the ASA. You can include up to 6 modules in up to 6 chassis.
We modified the following screen:
Logical Devices
>
Configuration
The Firepower 9300 supports intra-chassis clustering with the Firepower Threat Defense application.
We modified the following screen:
Logical Devices
>
Configuration
142
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Configure Service Chaining
Configure Service Chaining
The Cisco FXOS chassis can support multiple services (for example, a firewall and a third-party DDoS application) on a single blade. These applications and services can be linked together to form a Service Chain.
About Service Chaining
In the current supported Service Chaining configuration, the third-party Radware DefensePro virtual platform runs in front of the ASA firewall. Radware DefensePro is a KVM-based virtual platform that provides distributed denial-of-service (DDoS) detection and mitigation capabilities on the FXOS chassis. When Service
Chaining is enabled on your FXOS chassis, traffic from the network must first pass through the DefensePro virtual platform before reaching the main ASA firewall.
The Radware DefensePro virtual platform may be referred to as
Radware vDP
(virtual DefensePro), or simply
vDP
. The Radware DefensePro virtual platform may occasionally be referred to as a Link Decorator.
Prerequisites for Service Chaining
Prior to deploying Radware DefensePro on your FXOS chassis, you must configure the FXOS chassis to use an NTP Server with the
etc/UTC
Time Zone. For more information about setting the date and time in your
FXOS chassis, see
Setting the Date and Time, on page 79
.
Guidelines for Service Chaining
Models
• The Radware DefensePro platform is supported with ASA on the following security appliances:
◦ Firepower 9300
◦ Firepower 4120 - You must use the CLI to deploy Radware DefensePro on this platform; the
Firepower Chassis Manager does not yet support this functionality.
◦ Firepower 4140 - You must use the CLI to deploy Radware DefensePro on this platform; the
Firepower Chassis Manager does not yet support this functionality.
◦ Firepower 4150
Note
The Radware DefensePro platform is not currently supported with ASA on Firepower
4110 devices.
Additional Guidelines
• The DefensePro application can run as separate instances on up to three security modules.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
143
Logical Devices
Configure Radware DefensePro Service Chain on a Standalone Logical Device
Configure Radware DefensePro Service Chain on a Standalone Logical Device
The following procedure shows how to install Radware DefensePro in a single Service Chain in front of a standalone ASAlogical device.
Note
If you are installing Radware vDP in front of ASA on a 4120 security appliance, you must use the FXOS
CLI to deploy the decorator. For full CLI instructions on how to install and configure Radware DefensePro in a service chain in front of ASA on Firepower 4100 devices, refer to the FXOS CLI configuration guide.
If you are installing Radware vDP in front of Firepower Threat Defense on any Firepower device, you must use the FXOS CLI to deploy the decorator. For full CLI instructions on how to install and configure
Radware DefensePro in a service chain in front of Firepower Threat Defense on Firepower 4100 or
Firepower 9300 devices, refer to the FXOS CLI configuration guide.
Before You Begin
• Download the vDP image from Cisco.com (see
Downloading Images from Cisco.com, on page 34
) and then upload that image to the FXOS chassis (see
Uploading an Image to the Firepower Security
).
• You can deploy the Radware DefensePro application in a standalone configuration on an intra-chassis cluster; for intra-chassis clustering, see
Configure Radware DefensePro Service Chain on an Intra-Chassis
.
Procedure
Step 1
If you want to use a separate management interface for vDP, enable the interface and set it to be the mgmt type according to
Edit Interface Properties, on page 116
. Otherwise, you can share the application management interface.
Step 2
Choose
Logical Devices
to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown.
Step 3
Create a standalone ASA Logical Device (see
Create a Standalone ASA Logical Device, on page 123
).
Note that before you click
Save
at the end of the procedure to create a standaolone ASA logical device, you must first follow the following steps to add a vDP decorator to the logical device.
Step 4
In the
Decorators
area, select vDP. The Radware: Virtual DefensePro - Configuration window appears.
Configure the following fields under the
General Information
tab.
Step 5
If you have more than one vDP version uploaded to the FXOS chassis, select the version you want to use in the
Version
drop-down.
Step 6
Under the
Management Interface
drop-down, choose the management interface you created in step 1 of this procedure.
Step 7
Select the default
Address Type
, IPv4 only, IPv6 only, or IPv4 and IPv6.
Step 8
Configure the following fields, based on your
Address Type
selection from the previous step.
a) In the
Management IP
field, configure a local IP address.
b) IPv4 only: Enter a
Network Mask
.
144
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Configure Radware DefensePro Service Chain on an Intra-Chassis Cluster
IPv6 only: Enter a
Prefix Length
.
c) Enter a
Network Gateway
address.
Step 9
Click the checkbox next to each data port that you want to assign to the device.
Step 10
Click
OK
.
Step 11
Click
Save
.
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module.
Configure Radware DefensePro Service Chain on an Intra-Chassis Cluster
The following procedure shows how to install the Radware DefensePro image, and configure it in a Service
Chain in front of an ASA intra-chassis cluster.
Before You Begin
• Download the vDP image from Cisco.com (see
Downloading Images from Cisco.com, on page 34
) and then upload that image to the FXOS chassis (see
Uploading an Image to the Firepower Security
).
Procedure
Step 1
If you want to use a separate management interface for vDP, enable the interface and set it to be the mgmt type according to
Edit Interface Properties, on page 116
. Otherwise, you can share the application management interface.
Step 2
Configure an ASA intra-chassis cluster (see
Configure ASA Clustering, on page 135
).
Note that before you click
Save
at the end of the procedure to configure the intra-chassis cluster, you must first follow the following steps to add a vDP decorator to the cluster.
Step 3
In the
Decorators
area, select vDP. The
Radware: Virtual DefensePro - Configuration
dialog box appears.
Configure the following fields under the
General Information
tab.
Step 4
If you have more than one vDP version uploaded to the FXOS chassis, select the vDP version you want to use in the
Version
drop-down.
Step 5
Under the
Management Interface
drop-down, choose a management interface.
Step 6
Click the checkbox next to each data port that you want to assign to the vDP decorator.
Step 7
Click the
Interface Information
tab.
Step 8
Select the
Address Type
to be used, IPv4 only, IPv6 only, or IPv4 and IPv6.
Step 9
Configure the following fields for each Security Module. Note that the fields that display depend on your
Address Type
selection from the previous step.
a) In the
Management IP
field, configure a local IP address.
b) IPv4 only: Enter a
Network Mask
.
IPv6 only: Enter a
Prefix Length
.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
145
Logical Devices
Open UDP/TCP Ports and Enable vDP Web Services
c) Enter a
Network Gateway
address.
Step 10
Click
OK
.
Step 11
Click
Save
.
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module.
Step 12
Choose
Logical Devices
to open the Logical Devices page.
Step 13
Scroll through the list of configured logical devices to the entries for vDP. Verify their Attributes listed in the
Management IP
column.
• If the
CLUSTER-ROLE
element displays as
unknown
for the DefensePro instances, you must enter the DefensePro application and configure the master IP address to complete the creation of the vDP cluster.
• If the
CLUSTER-ROLE
element displays as
primary
or
secondary
for the DefensePro instances, the applications are online and formed in a cluster.
Open UDP/TCP Ports and Enable vDP Web Services
The Radware APSolute Vision Manager interfaces communicate with the Radware vDP appliation using various UDP/TCP ports. In orer for the vDP application to communicate with the APSolute Vision Manager, you must ensure that these ports are accessible and not blocked by your firewall. For more information on which specific ports to open, see the following tables in the APSolute Vision User Guide:
•
Ports for APSolute Vision Server-WBM Communication and Operating System
•
Communication Ports for APSolute Vision Server with Radware Devices
In order for Radware APSolute Vision to manage the Virtual DefensePro application deployed on the FXOS chassis, you must enable the vDP web service using the FXOS CLI.
Procedure
Step 1
From the FXOS CLI, connect to the vDP application instance.
connect module slot console
connect vdp
Step 2
Enable vDP web services.
manage secure-web status set enable
Step 3
Exit the vDP application console and return to the FXOS module CLI.
Ctrl ]
146
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Manage Logical Devices
Manage Logical Devices
You can delete a logical device, convert an ASA to transparent mode, change the interface configuration, and perform other tasks on existing logical devices.
Connect to the Console of the Application or Decorator
Use the following procedure to connect to the console of the application or decorator.
Note
If you encounter any issues with accessing the console, we recommend that you try a different SSH client or upgrade your SSH client to a newer version.
Procedure
Step 1
To connect to the console of the application or decorator: a) From the FXOS CLI, connect to the security module/engine:
Firepower-chassis #
connect module slot_number console
Note
To connect to the security engine of a device that does not support multiple security modules, use 1 as the
slot_number
.
The first time you connect to the security module, you access the FXOS module CLI.
b) To connect to the application or decorator, enter the appropriate command for your device:
Firepower-module1>
connect asa
Firepower-module1>
connect ftd
Firepower-module1>
connect vdp
Subsequent connections from the supervisor level of the FXOS CLI to the security module/engine access the security module/engine OS directly.
Step 2
(Optional) Exit the application console to the FXOS module CLI by typing
Ctrl-A-D
.
Exit the decorator console to the FXOS module CLI by typing
Ctrl-]-
.
You might want to access the FXOS module CLI for troubleshooting purposes.
Step 3
Return to the supervisor level of the FXOS CLI.
a) To exit the security module/engine console, type
~
.
You exit to the Telnet application.
b) To exit the Telnet application, enter: telnet>
quit
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
147
Logical Devices
Delete a Logical Device
Example
The following example connects to an ASA on security module 1 and then exits back to the supervisor level of the FXOS CLI.
Firepower#
connect module 1 console
Telnet escape character is '~'.
Trying 127.5.1.1...
Connected to 127.5.1.1.
Escape character is '~'.
CISCO Serial Over LAN:
Close Network Connection to Exit
Firepower-module1>
connect asa
asa>
~
telnet>
quit
Connection closed.
Firepower#
Delete a Logical Device
Procedure
Step 1
Choose
Logical Devices
to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 2
Click
Delete
for the logical device that you want to delete.
Step 3
Click
Yes
to confirm that you want to delete the logical device.
Step 4
Click
Yes
to confirm that you want to delete the application configuration.
Change the ASA to Transparent Firewall Mode
You can only deploy a routed firewall mode ASA from the FXOS chassis. To change the ASA to transparent firewall mode, complete the initial deployment, and then change the firewall mode within the ASA CLI.
Because changing the firewall mode erases the configuration, you must then redeploy the configuration from the FXOS chassis to regain the bootstrap configuration. The ASA then remains in transparent mode with a working bootstrap configuration.
Procedure
Step 1
Connect to the ASA console according to
Connect to the Console of the Application or Decorator, on page
147 . For a cluster, connect to the primary unit. For a failover pair, connect to the active unit.
Step 2
Enter configuration mode:
enable configure terminal
By default, the enable password is blank.
148
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Change an Interface on a Firepower Threat Defense Logical Device
Step 3
Set the firewall mode to transparent:
firewall transparent
Step 4
Save the configuration:
write memory
For a cluster or failover pair, this configuration is replicated to secondary units: asa(config)# firewall transparent asa(config)# write memory
Building configuration...
Cryptochecksum: 9f831dfb 60dffa8c 1d939884 74735b69
3791 bytes copied in 0.160 secs
[OK] asa(config)#
Beginning configuration replication to Slave unit-1-2
End Configuration Replication to slave.
asa(config)#
Step 5
On the Firepower Chassis Manager
Logical Devices
page, click the
Edit
icon to edit the ASA.
The
Provisioning
page appears.
Step 6
Click the device icon to edit the bootstrap configuration. Change any value in your configuration, and click
OK
.
You must change the value of at least one field. Cisco recommends changing the
Password
to a new password because this setting is not important.
You see a warning about changing the bootstrap configuration; click
Yes
.
Step 7
Click
Save
to redeploy the configuration to the ASA.For an inter-chassis cluster or for a failover pair, repeat steps 5 through 7 to redeploy the bootstrap configuration on each chassis.
Wait several minutes for the chassis/security modules to reload, and for the ASA to to become operational again. The ASA now has an operational bootstrap configuration, but remains in transparent mode.
Change an Interface on a Firepower Threat Defense Logical Device
You can allocate or unallocate an interface, or replace a management interface on a Firepower Threat Defense logical device. You can then sync the interface configuration in the Firepower Management Center.
Before You Begin
• Configure your interfaces, and add any EtherChannels according to
Edit Interface Properties, on page
116 and
Create a Port Channel, on page 117
.
• You can edit the membership of an allocated EtherChannel without affecting the logical device or requiring a sync on the Firepower Management Center.
• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are allocated by default to a cluster), you need to unallocate the interface from the logical device first, then
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
149
Logical Devices
Change an Interface on an ASA Logical Device
add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel to the device.
• If you want to replace the management or firepower eventing interface with a management EtherChannel, then you need to create the EtherChannel with at least 1 unallocated data member interface, and then replace the current management interface with the EtherChannel. After the Firepower Threat Defense device reboots (management interface changes cause a reboot), and you sync the configuration in the
Firepower Management Center, you can add the (now unallocated) management interface to the
EtherChannel as well.
• For clustering or High Availability, make sure you add or remove the interface on all units before you sync the configuration in the Firepower Management Center. Note that new interfaces are added in an administratively down state, so they do not affect interface monitoring.
Procedure
Step 1
In the Firepower Chassis Manager, choose
Logical Devices
.
Step 2
Click the
Edit
icon at the top right to edit the logical device.
Step 3
Unallocate a data interface by de-selecting the interface in the
Data Ports
area.
Step 4
Allocate a new data interface by selecting the interface in the
Data Ports
area.
Step 5
Replace the management or eventing interface:
For these types of interfaces, the device reboots after you save your changes.
a) Click the device icon in the center of the page.
b) On the
General/Cluster Information
tab, choose the new
Management Interface
from the drop-down list.
c) On the
Settings
tab, choose the new
Eventing Interface
from the drop-down list.
d) Click
OK
.
If you change the IP address of the Management interface, then you must also change the IP address for the device in the Firepower Management Center: go to
Devices
>
Device Management
>
Device/Cluster
. In the
Management
area, set the IP address to match the bootstrap configuration address.
Step 6
Click
Save
.
Step 7
Log into the Firepower Management Center.
Step 8
Select
Devices
>
Device Management
and click the edit icon ( ) for your Firepower Threat Defense device.
The
Interfaces
tab is selected by default.
Step 9
Click the
Sync Interfaces from device
button on the top left of the
Interfaces
tab.
Step 10
Click
Save
.
You can now click
Deploy
and deploy the policy to assigned devices. The changes are not active until you deploy them.
Change an Interface on an ASA Logical Device
You can allocate, unallocate, or replace a management interface on an ASA logical device. ASDM discovers the new interfaces automatically.
150
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Logical Devices
Change an Interface on an ASA Logical Device
Before You Begin
• Configure your interfaces and add any EtherChannels according to
Edit Interface Properties, on page
116 and
Create a Port Channel, on page 117
.
• You can edit the membership of an allocated EtherChannel without affecting the logical device.
• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are allocated by default to a cluster), you need to unallocate the interface from the logical device first, then add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel to the device.
• If you want to replace the management interface with a management EtherChannel, then you need to create the EtherChannel with at least 1 unallocated data member interface, and then replace the current management interface with the EtherChannel. After the ASA reloads (management interface changes cause a reload), you can add the (now unallocated) management interface to the EtherChannel as well.
• For clustering or failover, new interfaces are added in an administratively down state, so they do not affect interface monitoring.
Procedure
Step 1
In the Firepower Chassis Manager, choose
Logical Devices
.
Step 2
Click the
Edit
icon at the top right to edit the logical device.
Step 3
Unallocate a data interface by de-selecting the interface in the
Data Ports
area.
Step 4
Allocate a new data interface by selecting the interface in the
Data Ports
area.
Step 5
Replace the management interface:
For this type of interface, the device reloads after you save your changes.
a) Click the device icon in the center of the page.
b) On the
General/Cluster Information
tab, choose the new
Management Interface
from the drop-down list.
c) Click
OK
.
Step 6
Click
Save
.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
151
Change an Interface on an ASA Logical Device
Logical Devices
152
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Modular chassis-based security system
Graphical user interface
FXOS CLI
FXOS REST API
Frequently asked questions
To log in, open a supported browser and enter the URL https://<chassis_mgmt_ip_address>, where <chassis_mgmt_ip_address> is the IP address or hostname of the FXOS chassis. Then, enter your username and password and click Login.
First, configure the FXOS chassis hardware. Then, complete the initial configuration, which includes setting the date and time, configuring a DNS server, registering your product license, configuring users, performing software updates, configuring platform settings, configuring interfaces, and creating logical devices.
The Overview page in the Firepower Chassis Manager provides a visual representation of the chassis, showing the installed components and their status. You can also view detailed status information about faults, interfaces, devices, licenses, and inventory.