Prerequisites for Configuration
The following topics discuss prerequisite tasks you must complete before configuring the FMC Endpoint Update App.
Configure the FMC Domains and Subdomains
Data in one APIC tenant is pushed and merged to one particular FMC domain you configure. APIC does not modify or delete any other object in another FMC domain. Note that objects defined in a domain are visible and usable in an FMC's subdomains, and that can be a way to share an object across subdomains.
For more information about domains, see the chapter on domain management in the Cisco Firepower Management Center Configuration Guide.
Create domains and subdomains
Before you continue, make sure you have created all users, domains, and subdomains on the FMC. Subdomain users must be created in the correct domain (System. If necessary, click Add Domain to add the user to the desired domain.)
To create a domain on the FMC:
-
Log in to the FMC.
-
Click System.
-
Enter the required information.
-
Click Save.
-
Click Save.
Examples
When you create a device in the FMC Endpoint Update App:
-
Enter a username only to push and merge the configuration to the default Global domain on the FMC.
-
Enter a domain and username in the format domain \ user to get dynamic data from the tenant and access the FMC as user and update the objects of the subdomain named domain of the Global domain.
-
Enter a domain and username in the format domain1 / domain2 \ user2 to get dynamic data from the APIC tenant and access the FMC as user2 and update the objects of the subdomain domain2 , which is a subdomain of domain1 , which is a subdomain of Global.
For example, to push the APIC configuration for a tenant named ExampleTenant to the Global \ domain1 \ domain2 domain on an FMC with IP address 192.0.2.25 as a user named SampleUser:
-
Log in to APIC.
-
Click .
-
Under FMC Endpoint Update, click Open.
-
Click Add Tenant/FMC.
-
Add the following row to the table.
Create Users for the FMC Endpoint Update App
You must create one dedicated FMC user for the FMC Endpoint Update App to update network object and dynamic object configuration:
-
The dedicated user is exclusively for the FMC endpoint update app to update the FMC network object configuration
-
In addition, you must have a second administative user that can be shared between the FMC endpoint update app and other FMC functions. (This can be an existing user or a new user.)
Each user must have the Administrator role. Each ASA user must have privilege level 15. It's necessary to have to users to avoid the FMC endpoint update app logging out the administrator unexpectedly.
The task that follows discusses how to create users on the FMC only. To create ASA users, see the Cisco ASA Series General Operations ASDM Configuration Guide.
Procedure
|
Step 1 |
Log in to the FMC if you haven't done so already. |
|
Step 2 |
Click . |
|
Step 3 |
Click Create User. |
|
Step 4 |
Under User Role Configuration, check Administrator. |
|
Step 5 |
(Optional.) Click Add Domain to give the user access to a particular domain. Both FMC users must be administrators in the same domains. |
|
Step 6 |
Enter the other information required to configure the user; consult the online help for assistance. |
(Config Devices) > 
Feedback