FDM-Managed Device Settings

• Management Access

• DHCP Server

• DNS Server

• Hostname

• NTP Server

• URL Filtering

• Cloud Services

• Web Analytics

• Protocol. Select whether the rule is for HTTPS (port 443) or SSH (port 22).

• Allowed Networks. Select the network object that defines the IPv4 or IPv6 network or host that should be able to access the system. To specify "any" address, select any-ipv4 (0.0.0.0/0) and any-ipv6(::/0).

• Interface. Select the interface on which you want to allow management access.

• Protocol. Select whether the rule is for HTTPS (port 443), SSH (port 22), or both. You cannot configure HTTPS rules for the outside interface if it's used in a remote access VPN connection profile.

• Allowed Networks. Select the network object that defines the IPv4 or IPv6 network or host that should be able to access the system. To specify "any" address, select any-ipv4 (0.0.0.0/0) and any-ipv6 (::/0).

This will send data logging events for any type of syslog message, with your minimum chosen severity level, to the syslog server.

Note

Security Cloud Control doesn't currently support creating a Custom Logging Filter for Data Logging. For finer control of which messages you send to the syslog server, we recommend you define this setting in an FDM-managed device. To do so, log on to an FDM-managed device, and navigate System Settings > Logging Settings.

Tip

Do not enable data logging if you are a Cisco Security Analytics and Logging customer unless you forward the data logging events to a syslog server other than the Secure Event Connector. Data events (diagnostic events) are not traffic events. Sending the data events to a different syslog server removes the burden on the SEC from analyzing and filtering them out.

File and malware events are generated at the same severity level. The minimum level of event severity you select will be assigned to all file and malware events.

File and malware events are reported when a file or malware policy in any access control rule has been triggered. This is not the same as a connection event. Note that the syslog settings for file and malware events are relevant only if you apply file or malware policies, which require the and Malware licenses.

For Cisco Security Analytics and Logging subscribers:

• If you send events to the Cisco cloud through a Secure Event Connector (SEC), specify an SEC as your syslog server. You will then be able to see these events alongside file policy and malware policy connection events.

• If you send events directly to the Cisco cloud without an SEC, you do not need to enable this setting. File and malware events are sent if the access control rule is configured to send connection events.

Intrusion events are reported when an intrusion policy in any access control rule has been triggered. This is not the same as a connection event. Note that the syslog settings for intrusion events are relevant only if you apply intrusion policies, which require the license.

For Cisco Security Analytics and Logging subscribers:

• If you send events to the Cisco cloud through a Secure Event Connector (SEC), specify an SEC as your syslog server. You will then be able to see these events alongside file policy and malware policy connection events.

• If you send events directly to the Cisco cloud without an SEC, you do not need to enable this setting. Intrusion events are sent to the Cisco cloud if the access control rule is configured to send connection events.

You will see these messages when you log into the CLI on the console port of your FDM-managed device. You can also see these logs in an SSH session to other FDM-managed device interfaces (including the management interface) by using the show console-output command. In addition, you can see these messages in real time in the diagnostic CLI by entering system support diagnostic-cli from the main CLI.

1. Click the Enable Auto Configuration slider to On if you want to use auto configuration, and in the From Interface pull-down, select the interface that's obtaining its address through DHCP.

2. If you do not enable auto configuration, or if you want to override any of the automatically configured settings, configure the following global options. These settings are sent to DHCP clients on all interfaces that host DHCP server.

   1. Primary WINS IP Address, Secondary WINS IP Address. The addresses of the Windows Internet Name Service (WINS) servers that clients should use for NetBIOS name resolution.

   2. Primary DNS IP Address, Secondary DNS IP Address. The addresses of the Domain Name System (DNS) servers that clients should use for domain name resolution. Click Apply Umbrella Settings if you want to populate the DNS IP address fields with Cisco Umbrella DNS servers. Clicking the button loads the appropriate IP addresses into the fields.

3. Click Save.

1. Configure the server properties:

   1. Enable DHCP Server. Whether to enable the server. You can configure a server but keep it disabled until you are ready to use it.

   2. Interface. Select the interface on which you will provide DHCP addresses to clients. The interface must have a static IP address; you cannot be using DHCP to obtain the interface address if you want to run a DHCP server on the interface. For bridge groups, you configure the DHCP server on the Bridge Virtual Interface (BVI), not the member interfaces, and the server operates on all member interfaces. You cannot configure DHCP server on the Diagnostic interface, configure it on the Management interface instead, on the Device > System Settings > Management Interface page.

   3. Address Pool. Add the single IP address or an IP address range of a DHCP server. The range of IP addresses from lowest to highest that the server is allowed to provide to clients that request an address. The range of IP addresses must be on the same subnet as the selected interface and cannot include: the IP address of the interface itself, the broadcast address, or the subnet network address. Specify the start and end address for the pool, separated by a hyphen. For example, 10.100.10.12-10.100.10.250.

2. Click OK.

• New NTP Server. Enter the fully qualified domain name or IP address of the NTP server you want to use. For example, ntp1.example.com or 10.100.10.10.

• Use Default.

• Click the Enable Automatic Updates slider On to automatically check for and download updated URL data, which includes category and reputation information. After you deploy, the FDM-managed device checks for updates every 30 minutes.

• Click the Query Cisco CSI for Unknown URLs slider to ON to check the Cisco CSI for updated information on URLs that do not have category and reputation data in the local URL filtering database.

• URL Time to Live is only in effect if you enable the Query Cisco CSI for Unknown URLs option. This determines how long to cache the category and reputation lookup values for a given URL. When the time to live expires, the next attempted access of the URL results in a fresh category/reputation lookup. A shorter time results in more accurate URL filtering, a longer time results in better performance for unknown URLs. The default selection is Never.

• File/Malware - For any file policies, you have applied in any access control rule.

• Intrusion Events - For any intrusion policies, you have applied in any access control rule.

• Connection Events - For access control rules where you have enabled logging. When you select this option, you can also elect to send All Connection Events, or only send the High Priority connection events. High-priority connection events are those related to connections that trigger intrusion, file, or malware events, or that match Security Intelligence blocking policies.