Change FTD Manager Access Data Interface

Introduction

This document describes the steps to change the Secure Firewall Threat Defense (FTD) manager access data interface.

Prerequisites

Requirements

• Basic product knowledge.
• Familiarity with FTD management and management over data interfaces.

Components Used

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

The information in this document is based on these software and hardware versions:

• Secure Firewall 4200
• Secure Firewall Threat Defense (FTD) 10.0.x, 7.6.4
• Secure Firewall Management Center (FMC) 10.0.x

Initial Configuration

1. The FMC manages FTD in high availability (HA) via data interface Ethernet1/1 with the nameif outside1, using active and standby IP addresses 10.62.113.125  and 10.62.113.126 respectively:

Verification on FTD CLISH:

> show network management-data-interface

Physical Interface               Name of the Interface
Ethernet1/1              outside1

> show network 
===============[ System Information ]===============
Hostname                  : CSF4215-3
..
DNS from router           : enabled
Management port           : 8305
IPv4 Default route
  Gateway                 : data-interfaces
…
======[ System Information - Data Interfaces ]======
DNS Servers               : 192.0.2.100
Interfaces                : Ethernet1/1

==================[ Ethernet1/1 ]===================

State                     : Enabled
Link                      : Up
Name                      : outside1
MTU                       : 1500
MAC Address               : 40:F4:9F:3D:5A:0E
----------------------[ IPv4 ]----------------------
Configuration             : Manual
Address                   : 10.62.113.125
Netmask                   : 255.255.255.0
Gateway                   : 10.62.113.1
…

2. sftunnel connections are established between the FTD HA unit and the FMC:

> sftunnel-status-brief 
PEER:fmc.example.org
        SFTunnel Status:-
                Channel A: Connected
                Channel B: Connected
        Peer channel Channel-A is valid  type (CONTROL), using 'tap_nlp', connected to '198.51.100.23' via '169.254.1.3'
        Peer channel Channel-B is valid  type (EVENT), using 'tap_nlp', connected to '198.51.100.23' via '169.254.1.3'
        Registration: Completed.
        IPv4 Connection to peer 'fmc.example.org' Start Time: Fri Jul 17 08:22:31 2026 UTC
        Heartbeat Send Time:     Fri Jul 17 08:52:42 2026 UTC
        Heartbeat Received Time: Fri Jul 17 08:53:03 2026 UTC
        Last disconnect time   : Fri Jul 17 08:22:16 2026 UTC
        Last disconnect reason : Process shutdown due to stop request from PM

3. FTD relies on DNS resolution to connect to FMC. The manager is configuration based on the fully qualified domain name (FQDN):

> show managers 
Type                      : Manager
Host                      : fmc.example.org
Display name              : fmc.example.org
Version                   : 10.0.1 (Build 1)
Identifier                : 6d86efc4-c095-11f0-9244-48f1a7894b18
Registration              : Completed
Management type           : Configuration and analytics

> show network
===============[ System Information ]===============
Hostname                  : KSEC-FPR-4215-3
Domains                   : example.org
DNS Servers               : 192.0.2.100
DNS from router           : enabled
Management port           : 8305
IPv4 Default route
  Gateway                 : data-interfaces
…

The DNS servers are reachable via the outside1 interface.

4. sftunnel connections are established via the Lina engine:

> show conn all port 8305
26 in use, 32 most used
Inspect Snort:
        preserve-connection: 0 enabled, 0 in effect, 0 most enabled, 0 most in effect

TCP nlp_int_tap  10.62.113.125(169.254.1.3):8305 outside1  198.51.100.23:45647, idle 0:00:03, bytes 2129062, flags UIO 
TCP nlp_int_tap  10.62.113.125(169.254.1.3):37141 outside1  198.51.100.23:8305, idle 0:00:04, bytes 148581, flags UxIO

Configuration Steps

The goal is to move the manager access from the current outside1 to the target outside2 interface. The active and standby outside2 IP addresses are 10.62.114.51/24 and 10.62.114.52/24 respectively.

Note that FTD versions 7.7.0 or later support redundant manager access data interfaces, which allow the configuration and deployment of more than 1 manager access interfaces. This feature is not supported in versions earlier than 7.7.0.

Due to this fact, specific steps are skipped or contain different actions. 

Caution: Do not unregister/delete FTDs from FMC at any step.

1. It is recommended to have console access to the FTDs:

• In the case of Firepower 4100/9300, you can connect to the chassis using SSH, and then connect to the native FTD console using the connect module x console command, where x is the slot/security module ID.
• In the case of Firepower 4100/9300 running FTD in multi-instance (MI) mode, you can connect to the chassis using SSH, and then connect to the native FTD console using the connect module x telnet command, where x is the slot/security module ID. Then connect to FTD instance using the connect ftd <ftd_id> command.
• In the case of Secure Firewall 3100/4200 in MI mode you can connect to the chassis using SSH and then connect to the FTD console using the connect ftd <identifier> command.

2. Deploy pending policies.

3. It is strongly recommended to take FTD and FMC backups. In the case of FTD HA, take the backup of both units.

4. Configure the target interface nameif, IP address, security zone and other interface-related settings, if applicable.

5. Configure the target interface standby IP address.

6. If the FTD software version is 7.7.0 or later, enable manager access on the target interface and adjust the management access networks as needed:

Note that FTD versions earlier than 7.7.0 do not support redundant manager access data interfaces. Attempting to configure second manager access interface results in this error message:

Ensure that you skip steps 7 and 8 for FTD versions earlier than 7.7.0.

7. Deploy the policies and verify the settings on the FTD CLISH. In this example, Ethernet1/2 interface with nameif outside2 has IP addresses 10.62.114.51 and 10.62.114.52 respectively:

> show ip 
System IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
Ethernet1/1              outside1               10.62.113.125   255.255.255.0   manual <- source interface
Ethernet1/2              outside2               10.62.114.51    255.255.255.0   manual <- target interface
Ethernet1/4              fover                  10.9.0.21       255.255.255.0   unset

The outside2 interface is added to the sftunnel configuration:

> show running-config sftunnel
sftunnel interface outside2 <- target interface
sftunnel interface outside1 <- source interface
sftunnel port 8305
sftunnel route-map FMC_GEN_19283746_RBD_DUAL_WAN_RMAP_91827346

Although additional rules are installed in the Network Address Translation (NAT) table, the rules with the outside1 interface are in use:

> show nat detail
Manual NAT Policies Implicit (Section 0)
1 (nlp_int_tap) to (outside1) source static nlp_server__sftunnel_0.0.0.0_intf5 interface  destination static 0_0.0.0.0_5 0_0.0.0.0_5 service tcp 8305 8305
    translate_hits = 1448, untranslate_hits = 1448
    Source - Origin: 169.254.1.3/32, Translated: 10.62.113.125/24
    Destination - Origin: 0.0.0.0/0, Translated: 0.0.0.0/0
    Service - Protocol: tcp Real: 8305 Mapped: 8305
2 (nlp_int_tap) to (outside2) source static nlp_server__sftunnel_0.0.0.0_intf6 interface  destination static 0_0.0.0.0_9 0_0.0.0.0_9 service tcp 8305 8305 
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 169.254.1.3/32, Translated: 10.62.114.51/24
    Destination - Origin: 0.0.0.0/0, Translated: 0.0.0.0/0
    Service - Protocol: tcp Real: 8305 Mapped: 8305
3 (nlp_int_tap) to (outside1) source static nlp_server__sftunnel_::_intf5 interface ipv6  destination static 0_::_6 0_::_6 service tcp 8305 8305
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: fd00:0:0:1::3/128, Translated:
    Destination - Origin: ::/0, Translated: ::/0
    Service - Protocol: tcp Real: 8305 Mapped: 8305
4 (nlp_int_tap) to (outside2) source static nlp_server__sftunnel_::_intf6 interface ipv6  destination static 0_::_10 0_::_10 service tcp 8305 8305 
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: fd00:0:0:1::3/128, Translated:
    Destination - Origin: ::/0, Translated: ::/0
    Service - Protocol: tcp Real: 8305 Mapped: 8305
5 (nlp_int_tap) to (outside1) source dynamic nlp_client_0_intf5 interface
    translate_hits = 653, untranslate_hits = 0
    Source - Origin: 169.254.1.3/32, Translated: 10.62.113.125/24
6 (nlp_int_tap) to (outside2) source dynamic nlp_client_0_intf6 interface 
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 169.254.1.3/32, Translated: 10.62.114.51/24
7 (nlp_int_tap) to (outside1) source dynamic nlp_client_0_ipv6_intf5 interface ipv6
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: fd00:0:0:1::3/128, Translated:
8 (nlp_int_tap) to (outside2) source dynamic nlp_client_0_ipv6_intf6 interface ipv6 
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: fd00:0:0:1::3/128, Translated:

8. Verify high availability status and interface monitoring:

> show monitor-interface 
        This host: Primary - Active 
                Interface management (203.0.113.130): Normal (Monitored)
                Interface outside1 (10.62.113.125): Normal (Monitored)
                Interface outside2 (10.62.114.51): Normal (Monitored)
        Other host: Secondary - Standby Ready 
                Interface management (203.0.113.131): Normal (Monitored)
                Interface outside1 (10.62.113.126): Normal (Monitored)
                Interface outside2 (10.62.114.52): Normal (Monitored)

9. If you plan to manage the FTDs over the outside2 interface, ensure that access in the SSH Access section of the platform settings is allowed.

10. Make necessary changes to allow connectivity over the target interface to domain name servers (DNS) and FMC:

• If domain name resolution (DNS) is required for connectivity between FMC and FTDs, then ensure that the FTDs have reachability over the target interface to the next hop used to reach the DNS servers. DNS resolution must also be allowed in the transit path.
• Ensure that FTDs have reachability over the target interface to the next hop to be used to reach FMC. 
• Ensure that bidirectional connectivity between FMC and FTDs over TCP port 8305 is allowed in the transit path over the target interface. The connection must be allowed in both directions.

In this case, IP 10.62.114.1 needs to be used as the default gateway over the target interface. The next hop IP address is reachable using Internet Control Message Protocol (ICMP):

> ping 10.62.114.1
Please use 'CTRL+C' to cancel/abort...
Sending 5, 100-byte ICMP Echos to 10.62.114.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

If ICMP is administratively blocked in the transit path or the next hop, ensure that the Media Access Control (MAC) address of the next hop is visible in the output of the show arp command and is valid:

> show arp 
        fover 10.9.0.22 4c01.f7e9.e111 13275
        outside1 10.62.113.1 c02c.1782.2cbf 1
        outside1 10.62.113.126 4c01.f7e9.e10e 5453
        outside2 10.62.114.1 c02c.1782.2cbf 0
        outside2 10.62.114.52 4c01.f7e9.e10f 5453

11. Perform these steps depending on the FTD version:

• Version 7.7.0 or later: on FMC, disable manager access over the source interface (outside1), adjust routing, including routing to DNS servers (if DNS is used to access FMC) and FMC over the target interface (outside2). For example, either configure specific static routes or configure default gateway over the target interface.
• Version earlier than 7.7.0: on FMC, disable manager access over the source interface (outside1), enable manager access over the target interface (outside2), adjust routing, including routing to DNS servers (if DNS is used to access FMC) and FMC over the target interface (outside2). For example, either configure specific static routes or configure default gateway over the target interface. 

12. Deploy policies.

13. Verify on FTD CLISH:

> show route 0.0.0.0

Routing entry for 0.0.0.0 0.0.0.0, supernet
  Known via "static", distance 1, metric 0, candidate default path
  Routing Descriptor Blocks:
  * 10.62.114.1, via outside2 <- default route over outside2
      Route metric is 0, traffic share count is 1


> show running-config sftunnel
sftunnel interface outside2 <- sftunnel is enabled only over outside2
sftunnel port 8305


> show nat detail
Manual NAT Policies Implicit (Section 0)
1 (nlp_int_tap) to (outside2) source static nlp_server__sftunnel_0.0.0.0_intf6 interface  destination static 0_0.0.0.0_9 0_0.0.0.0_9 service tcp 8305 8305 
    translate_hits = 3, untranslate_hits = 3
    Source - Origin: 169.254.1.3/32, Translated: 10.62.114.51/24
    Destination - Origin: 0.0.0.0/0, Translated: 0.0.0.0/0
    Service - Protocol: tcp Real: 8305 Mapped: 8305
2 (nlp_int_tap) to (outside2) source static nlp_server__sftunnel_::_intf6 interface ipv6  destination static 0_::_10 0_::_10 service tcp 8305 8305
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: fd00:0:0:1::3/128, Translated:
    Destination - Origin: ::/0, Translated: ::/0
    Service - Protocol: tcp Real: 8305 Mapped: 8305
3 (nlp_int_tap) to (outside2) source dynamic nlp_client_0_intf6 interface
    translate_hits = 407, untranslate_hits = 0
    Source - Origin: 169.254.1.3/32, Translated: 10.62.114.51/24
4 (nlp_int_tap) to (outside2) source dynamic nlp_client_0_ipv6_intf6 interface ipv6
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: fd00:0:0:1::3/128, Translated:


> show conn all port 8305
31 in use, 42 most used
Inspect Snort:
        preserve-connection: 0 enabled, 0 in effect, 0 most enabled, 0 most in effect

TCP nlp_int_tap  10.62.114.51(169.254.1.3):56853 outside2  198.51.100.23:8305, idle 0:00:06, bytes 33008, flags UxIO  <- connectivity over outside2
TCP nlp_int_tap  10.62.114.51(169.254.1.3):32905 outside2  198.51.100.23:8305, idle 0:00:00, bytes 1595942, flags UxIO <- connectivity over outside2

14. If the DNS servers in the output of the 'show network' CLISH command need to be changed, configure the new DNS servers:

> configure network dns servers 192.0.2.184

15. On FMC change FTD management IP address to the outside2 IP address, then disable and re-enable the connectivity using the slider. Repeat this step for both units in HA:

16. Verify sftunnel connectivity on all FTDs:

> sftunnel-status-brief 
PEER:198.51.100.23
        SFTunnel Status:-
                Channel A: Connected
                Channel B: Connected
        Peer channel Channel-A is valid  type (CONTROL), using 'tap_nlp', connected to '198.51.100.23' via '169.254.1.3'
        Peer channel Channel-B is valid  type (EVENT), using 'tap_nlp', connected to '198.51.100.23' via '169.254.1.3'
        Registration: Completed.
        IPv4 Connection to peer '198.51.100.23' Start Time: Thu Jul 16 16:37:14 2026 UTC
        Heartbeat Send Time:     Thu Jul 16 16:38:13 2026 UTC
        Heartbeat Received Time: Thu Jul 16 16:39:13 2026 UTC
        Last disconnect time   : Thu Jul 16 16:37:11 2026 UTC
        Last disconnect reason : Both control and event channel connections with peer went down

> show conn all port 8305
32 in use, 42 most used
Inspect Snort:
        preserve-connection: 0 enabled, 0 in effect, 0 most enabled, 0 most in effect

TCP nlp_int_tap  10.62.114.51(169.254.1.3):8305 outside2  198.51.100.23:36383, idle 0:00:00, bytes 235757, flags UIO  <- new connection over different source port
TCP nlp_int_tap  10.62.114.51(169.254.1.3):8305 outside2  198.51.100.23:50963, idle 0:00:01, bytes 12319, flags UIO <- new connection over different source port

17. If DNS servers in platforms settings need to be changed, make appropriate configuration changes and deploy policies.

Troubleshoot Management Connection

Use these commands for verifications:

1. show network – shows configuration of management interface.
2. sftunnel-status-brief – shows sftunnel connectivity status.
3. show run sftunnel – shows sftunnel configuration in the firewall engine (Lina).
4. show conn all port 8305 – shows sftunnel connections via the Lina engine.

To troubleshoot management connections issues, refer to the Troubleshooting the Management Connection section in the official guide.

 

References

1. Cisco Secure Firewall Management Center Device Configuration Guide, 10.x
2. Change the Manager Access Interface
3. Troubleshooting the Management Connection

Revision History

Revision	Publish Date	Comments
1.0	07-Aug-2026	Initial Release