Security and Internet Access

Lists of URLs used by the dynamic attributes connector when communicating with cloud service providers and the .

Recommendation: security requirements for network deployment

Install the dynamic attributes connector on a protected internal network. Although the dynamic attributes connector is configured to have only the necessary services and ports available, you must make sure that attacks cannot reach it.

If the dynamic attributes connector and the reside on the same network, you can connect the to the same protected internal network as the dynamic attributes connector.

Take steps to ensure that communications between appliances cannot be interrupted, blocked, or tampered with. Regardless of how you deploy your appliances, inter-system communication is encrypted. However, you must still protect against distributed denial of service (DDoS) or adversary-in-the-middle attacks.

Internet access requirements

By default, the dynamic attributes connector is configured to communicate with the Firepower System over the internet using HTTPS on port 443/tcp (HTTPS). If you do not want the dynamic attributes connector to have direct access to the internet, you can configure a proxy server.

This information details the URLs the dynamic attributes connector use to communicate with the and with external servers.

Table 1. Dynamic Attributes Connector access requirements
URL Reason
https://fmc-ip/api/fmc_platform/v1/ auth/generatetoken

Authentication

https://fmc-ip/api/fmc_config/ v1/domain/domain-id/object/dynamicobjects

GET and POST dynamic objects

https://fmc-ip/api/fmc_config/ v1/domain/ domain-id/object/dynamicobjects/ object-id/mappings?action=add

Add mappings

https://fmc-ip/api/fmc_config/ v1/domain/domain-id /object/dynamicobjects/ object-id/mappings?action=remove

Remove mappings

Migration from DockerHub to Amazon ECR

Docker images for the Dynamic Attributes Connector are being migrated from Docker Hub to Amazon Elastic Container Registry (Amazon ECR).

To use the new field packages, you must allow access through your firewall or proxy to all of the following URLs:

Dynamic Attributes Connector Azure access requirements

The dynamic attributes connector calls built-in SDK methods to GET instance information. These methods internally call https://login.microsoft.com (for authentication) and https://management.azure.com (to GET instance information).