Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

References

Introduction

This document describes the IP address 203.0 .113.x  shown in the output of a few commands in the Secure Firewall Threat Defense (FTD).

Prerequisites

Requirements

Basic product knowledge.

Components Used

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

The information in this document is based on these software and hardware versions:

- Secure Firewall Thread Defense (FTD) 7.4.x, 7.6.x.

Background Information

After software upgrade to versions 7.4.x or 7.6.x you can notice changes related to the management interface IP address. These changes can be verified in the

1. The IP address is 203.0.113.x, although it was not manually configured.

FTD running on all platforms except Firepower 4100/9300:

> show nameif

Interface                Name                     Security

Management1/1            management                 0

> show interface ip brief

Interface                  IP-Address      OK?           Method Status      Protocol

…

Management1/1              203.0.113.130   YES           unset  up          up

> show interface Management

Interface Management1/1 "management", is up, line protocol is up

Hardware is en_vtun rev00, DLY 1000 usec

Input flow control is unsupported, output flow control is unsupported

MAC address 0053.500.2222, MTU 1500

IP address 203.0.113.130, subnet mask 255.255.255.248

…

> show running-config interface Management 1/1

!

interface Management1/1

management-only

cts manual

propagate sgt preserve-untag

policy static sgt disabled trusted

security-level 0

The management interface of FTD running on Firepower 4100/9300:

> show nameif

Interface                Name                     Security

…

Ethernet1/1              management                 0

> show interface ip brief

Interface                  IP-Address      OK?           Method Status      Protocol

…

Ethernet1/1                203.0.113.130   YES           unset  up          up

> show interface management

Interface Ethernet1/1 "management", is up, line protocol is up

Hardware is EtherSVI, BW 1000 Mbps, DLY 10 usec

MAC address 0053.500.1111, MTU 1500

IP address 203.0.113.130, subnet mask 255.255.255.248

…

> show running-config interface Ethernet 1/1

interface Ethernet1/1

management-only

nameif management

cts manual

propagate sgt preserve-untag

policy static sgt disabled trusted

security-level 0

Note: On Firepower 4100/9300, you can create a dedicated Ethernetx/y as a custom management interface for applications, therefore the physical interface name is Ethernetx/y, not Managementx/y.

2. This IP address is different than the IP address shown in the output of the show network command:

> show network

===============[ System Information ]===============

Hostname                  : firewall

Domains                   : www.example.org

DNS Servers               : 198.51.100.100

DNS from router           : enabled

Management port           : 8305

IPv4 Default route

Gateway                 : 192.0.2.1

==================[ management0 ]===================

Admin State               : enabled

Admin Speed               : sfpDetect

Operation Speed           : 1gbps

Link                      : up

Channels                  : Management & Events

Mode                      : Non-Autonegotiation

MDI/MDIX                  : Auto/MDIX

MTU                       : 1500

MAC Address               : 00:53:00:00:00:01

---------------------[ IPv4 ]----------------------

Configuration             : Manual

Address                   : 192.0.2.100

Netmask                   : 255.255.255.0

Gateway                   : 192.0.2.1

----------------------[ IPv6 ]----------------------

Configuration             : Disabled

The IP address 203.0.113.x is assigned to the management interface as part of the converged management interface feature (CMI) introduced in the version 7.4.0. Specifically, after software upgrade to version 7.4.x or later, the software proposes merging the management  and diagnostic interfaces as shown in the Merge the Management and Diagnostic Interfaces section. If the merge is successful, the management interface nameif becomes management and is automatically assigned internal IP address 203.0.113.x.

You can ignore the IP address 203.0.113.x.  The IP address shown in the output of the show network command remains unchanged and is the only valid IP address that you must refer to as the FTD management IP address.

References

- Merge the Management and Diagnostic Interfaces