This document describes how to configure the FDM (Firepower Device Management) On-Box management service for the firepower 2100 series with FTD (Firepower Threat Defense) installed.
The main intention of this document is to guide you through the steps required to enable the FDM On-Box management for the firepower 2100 series.
Cisco recommends that you have knowledge of these topics:
Cisco Firepower 2100, FTD software installation.
Cisco FTD (Firepower Threat Defense) basic configuration and troubleshooting.
The information in this document is based on these software and hardware versions:
Cisco Firepower 2100 series.
Cisco FTD version 6.2.3
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
You have two options to manage the FTD installed on a firepower 2100:
The FDM On-Box management.
The Cisco FMC (Firepower Management Center).
Note: You cannot use both the FDM and FMC to manage an FTD installed in a firepower 2100. Once the FDM On-Box management is enabled on the firepower 2100 FTD, it won't be possible to use an FMC to manage the FTD, unless you disable the local management and re-configure the management to use an FMC. On the other hand, register the FTD to an FMC disables the FDM On-Box management service on the FTD.
Caution: Right now Cisco does not have any option to migrate FDM firepower configuration to an FMC and vice-versa, take this into consideration when you choose what type of management you configure for the FTD installed in the firepower 2100.
The management interface is divided into 2 logical interfaces, br1 (management0 on FPR2100/4100/9300 appliances) and diagnostic:
Management - br1/management0
This interface is used in order to assign the FTD IP that is used for FTD/FMC communication.
Terminates the sftunnel between FMC/FTD.
Used as a source for rule-based syslogs.
Provides SSH and HTTPS access to the FTD box.
Provides remote access (e.g. SNMP) to ASA engine.
Used as a source for LINA-level syslogs, AAA, SNMP etc messages.
Yes, since it is used for FTD/FMC communication (the sftunnel terminates on it).
No, and it is not recommended to configure it. The recommendation is to use
a data interface instead (check the note below).
Note: The benefit of leaving the IP address off of the diagnostic interface is that you can place the management interface on the same network as any other data interface. If you configure the diagnostic interface, its IP address must be on the same network as the management IP address, and it counts as a regular interface that cannot be on the same network as any other data interfaces. Because the management interface requires internet access for updates, putting the management interface on the same network as an inside FTD interface means you can deploy the FTD with only a switch on the LAN and point the inside interface as the default gateway for the management interface (This just applies when the FTD is deployed in routed mode).
The FTD can be installed in a firepower 2100 appliance. The firepower chassis runs its own operating system called FXOS (Firepower eXtensible Operating System) to control basic operations of the device, while the FTD logical device is installed on a module/blade.
Note: You can use the FXOS GUI (Graphic User Interface) called FCM (Firepower Chassis Manager) or the FXOS CLI (Command Line Interface) to configure firepower chassis functions; However the GUI FCM is not available when the FTD is installed on the firepower 2100 series, just the FXOS CLI.
Firepower 21xx appliance:
Note: On the firepower 2100 series the management interface is shared between the chassis FXOS and the FTD logical device.
The default configuration assumes that certain firepower 2100 interfaces are used for the inside and outside networks. Initial configuration will be easier to complete if you connect network cables to the interfaces based on these expectations. To cable the Firepower 2100 series, see the next image.
Note: The above image shows a simple topology using a Layer 2 switch. Other topologies can be used and your deployment will vary depending on your basic logical network connectivity, ports, addressing, and configuration requirements.
In order to enable the FDM On-Box management on the firepower 2100 series proceed as follows.
1. Console access into the FPR2100 chassis and connect to the FTD application.