Step 1

In the Secure Firewall Management Center, choose Integration > SecureX.

Step 2

Choose a Cisco regional cloud from the Current Region drop-down list.

Step 3

Click Enable SecureX.

Step 4

Click Continue to Cisco SSO.

Step 5

Log in to your Security Cloud Control account.

If you do not have a Security Cloud Sign On account to log in to Security Cloud Control and you want to create one, click Sign up now in the Security Cloud Sign On page. Refer to Create a New Cisco Security Cloud Sign On Account.

Step 6

Choose a Security Cloud Control tenant that you want to use for this integration. The Secure Firewall Management Center and the managed devices get onboarded to the Security Cloud Control tenant that you choose here.

If you do not already have a Security Cloud Control tenant or if you want to use a new tenant for this integration, create a new tenant. Refer to Request a Security Cloud Control Tenant for more information.

Step 7

Verify that the code displayed in the Security Cloud Control login page matches the code provided by the Secure Firewall Management Center.

Step 8

Click Authorize FMC.

Step 9

In the Secure Firewall Management Center, configure these settings:

Step 1

Choose System () > Configuration.

Step 2

(Optional) Click SNMP to configure SNMP if you want to add SNMP rules to the access list. By default, SNMP is disabled; refer to Configure SNMP polling.

Step 3

Click Access List.

Step 4

Click Add Rules to add access for IP addresses.

Step 5

In the IP Address field, enter an IP address or address range, or any.

Step 6

Choose SSH, HTTPS, SNMP, or a combination of these options to specify which ports you want to enable for these IP addresses.

Step 7

Click Add.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Audit Log.

Step 3

Choose Enabled from the Send Audit Log to Syslog drop-down menu.

Step 4

The following fields are applicable only for audit logs sent to syslog:

Step 5

(Optional) To test whether the IP address of the syslog servers is valid, click Test Syslog Server.

Step 6

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Audit Log.

Step 3

Optionally, in the Tag field, enter the tag name that you want to appear with the message. For example, if you want all audit log records to be preceded with FROMMC, enter FROMMC in the field.

Step 4

Choose Enabled from the Send Audit Log to HTTP Server drop-down list.

Step 5

In the URL to Post Audit field, designate the URL where you want to send the audit information. Enter a URL that corresponds to a Listener program that expects the HTTP POST variables as listed:

Step 6

Click Save.

Step 1

In the /etc/syslog-ng.conf file, comment out the @include "/etc/syslog-ng.d/*.conf" line.

#@include "/etc/syslog-ng.d/*.conf"

Step 2

Reload the syslog configuration file. Use the syslog-ng-ctl reload command to reload the configuration file without having to restart the application.

syslog-ng-ctl reload

Step 1

Obtain and install a signed client certificate on the Firewall Management Center.

1. Obtain a signed audit log client certificate for the Firewall Management Center:

   Generate a Certificate Signing Request (CSR) from the Firewall Management Center based on your system information and the identification information you supply.

   • Submit the CSR to a recognized, trusted certificate authority (CA) to request a signed client certificate.

   • If you will require mutual authentication between the Firewall Management Center and the audit log server, ensure the client certificate is signed by the same CA that signed the server certificate.

2. After you receive the signed certificate from the certificate authority, import it into the Firewall Management Center. Refer to Import an audit log client certificate into the Firewall Management Center.

Step 2

Configure the communication channel with the server to use Transport Layer Security (TLS) and enable mutual authentication.

Step 3

If you have not yet configured audit log streaming, do so now.

Step 1

Choose System () > Configuration and click Audit Log Certificate.

Step 2

Click Generate New CSR.

Step 3

Enter a country code in the Country Name (two-letter code) field.

Step 4

Enter a state or province postal abbreviation in the State or Province field.

Step 5

Enter a Locality or City, an Organization name, and an Organizational Unit (Department) name.

Step 6

Enter the fully qualified domain name of the server for which you want to request a certificate in the Common Name field.

Step 7

Click Generate and then open a new blank file with a text editor.

Step 8

Copy the block of text from the certificate request, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines. Paste this information into a blank text file.

Step 9

Save the file as clientname.CSR. Replace clientname with the appliance name where you plan to use the certificate. Click Close.

Step 1

On the Firewall Management Center, choose System () > Configuration.

Step 2

Click Audit Log Certificate.

Step 3

Click Import Audit Client Certificate.

Step 4

Open the client certificate in a text editor, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Paste this text into the Client Certificate field.

Step 5

To upload a private key, open the private key file and copy the entire block of text, including the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines. Paste this text into the PRIVATE KEY field.

Step 6

Open any required intermediate certificates, copy the entire block of text for each, and paste it into the Certificate Chain field.

Step 7

Click Save.

Step 1

On the Firewall Management Center , choose System () > Configuration .

Step 2

Click Audit Log Certificate .

Step 3

To use Transport Layer Security to securely stream the audit log to an external server, select Enable TLS .

Step 4

If you do not want the client to authenticate itself against the server, but wish to accept the server certificate when the certificate is issued by the same CA (not recommended), complete these steps.

1. Deselect Enable Mutual Authentication .

   Important

   Ensure that the server is configured to trust the client without verifying any client certificates.

2. Click Save and skip the remainder of this procedure.

Step 5

(Optional) To enable client certificate verification by the audit log server, select Enable Mutual Authentication.

							openssl pkcs8 -topk8 -inform PEM -outform PEM 
							-nocrypt -in 
							
								PKCS1 key file name
							 
							-out 
							
								PKCS8 key filename
							 
						

Step 6

(Optional) To automatically recognize server certificates that are no longer valid:

1. Select Enable Fetching of CRL .

   Important

   This option is displayed only when you select the Enable Mutual Authentication check box. However, the Enable Fetching of CRL option is applicable only when the TLS option is enabled. The use of CRL is for server certification verification, and it is not dependent on the use of Mutual Authentication which is for enabling client certificate verification.

   When you enable fetching of the CRL, the client creates a scheduled task to regularly update (download) the CRL or CRLs. The CRLs are used for server certificate verification. Verification fails if a CRL from the CA specifies that the server certificate has been revoked.

2. Enter a valid URL to an existing CRL file and click Add CRL.

   Repeat to add up to 25 CRLs.

3. Click Refresh CRL to load the current CRL or CRLs from the specified URL or URLs.

Step 7

Verify that you have a valid server certificate generated by the same certificate authority that created the client certificate.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Audit Log Certificate.

Step 1

Choose System () > Configuration.

Step 2

Click Change Reconciliation.

Step 3

Check the Enable check box.

Step 4

Choose the time of day you want the system to send out the change reconciliation report from the Time to Run drop-down lists.

Step 5

Enter email addresses in the Email to field.

Step 6

If you want to include policy changes, check the Include Policy Configuration check box.

Step 7

If you want to include all changes over the past 24 hours, check the Show Full Change History check box.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose DNS Cache.

Step 3

From the DNS Resolution Caching drop-down list, choose one of these options:

• Enabled—Enable caching.
• Disabled—Disable caching.

Step 4

In the DNS Cache Timeout (in minutes) field, enter the number of minutes a DNS entry remains cached in memory before it is removed for inactivity.

Step 5

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Dashboard.

Step 3

Check the Enable Custom Analysis Widgets check box to allow users to add Custom Analysis widgets to dashboards.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Email Notification.

Step 3

In the Mail Relay Host field, enter the hostname or IP address of the mail server you want to use. Ensure the mail host you enter allows access from the appliance.

Step 4

In the Port Number field, enter the port number to use on the email server.

Step 5

Choose an Encryption Method:

• TLS: Encrypt communications using Transport Layer Security.
• SSLv3: Encrypt communications using Secure Socket Layers.
• None: Allow unencrypted communication.

Step 6

In the From Address field, enter the valid email address you want to use as the source email address for messages sent by the appliance.

Step 7

To supply a username and password when connecting to the mail server, choose Use Authentication. Enter the username in the Username field. Enter a password in the Password field.

Step 8

To send a test email using the configured mail server, click Test Mail Server Settings.

Step 9

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click External Database Access.

Step 3

Select the Allow External Database Access check box.

Step 4

Enter an appropriate value in the Server Hostname field. Depending on your third-party application requirements, this value can be either the fully qualified domain name (FQDN), IPv4 address, or IPv6 address of the Firewall Management Center.

Step 5

Next to Client JDBC Driver, click Download and follow your browser’s prompts to download the client.zip package.

Step 6

To add database access for one or more IP addresses, click Add Hosts. An IP Address field appears in the Access List field.

Step 7

In the IP Address field, enter an IP address or address range, or any.

Step 8

Click Add.

Step 9

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 1

Choose System () > Configuration and click HTTPS Certificate.

Step 2

Click Generate New CSR.

Step 3

Enter a country code in the Country Name (two-letter code) field and a state or province postal abbreviation in the State or Province field.

Step 4

Enter a Locality or City, Organization name, and an Organizational Unit (Department) name.

Step 5

Enter the fully qualified domain name of the server for which you want to request a certificate in the Common Name field.

Step 6

To request a certificate that secures multiple domain names or IP addresses, enter this information in the Subject Alternative Name section:

1. Domain Names: Enter the fully qualified domains and subdomains (if any) secured by the Subject Alternative Name.

2. IP Addresses: Enter the IP addresses secured by the Subject Alternative Name.

Step 7

Click Generate. Then, open a text editor.

Step 8

Copy the entire block of text in the certificate request, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines. Paste it into a blank text file.

Step 9

Save the file as servername.CSR, where servername is the name of the server where you plan to use the certificate. Click Close.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS CERTIFICATE.

Step 3

Click Import HTTPS Server Certificate.

Step 4

Open the server certificate in a text editor, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Paste this text into the Server CERTIFICATE field.

Step 5

Whether you must supply a PRIVATE KEY depends on how you generated the certificate Signing Request:

• If you generated the certificate Signing Request using the Secure Firewall Management Center web interface (as described in Generate an HTTPS server certificate signing request), the system already has the PRIVATE KEY and you need not enter one here.
• If you generated the certificate Signing Request using some other means, you must supply the private key here. Open the private key file and copy the entire block of text, include the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines. Paste this text into the Private Key field.

Step 6

Open each required intermediate certificate, copy the entire block of text, and paste it into the Certificate Chain field. If you have a root certificate, paste it into the same field. For all certificates, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

Step 7

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Choose Enable Client Certificates. If prompted, select the appropriate certificate from the drop-down list.

Step 4

You have three options:

• To verify client certificates using one or more CRLS, select Enable Fetching of CRL and continue with Step 5.
• To verify client certificates using OCSP, select Enable OCSP and skip to Step 7.
• To accept client certificates without checking for revocation, skip to Step 8.

Step 5

Enter a valid URL to an existing CRL file and click Add CRL. Repeat this step to add up to 25 CRLs.

Step 6

Click Refresh CRL to load the current CRL or CRLS from the specified URLs.

Step 7

Verify that the client certificate is signed by the certificate authority loaded onto the appliance and the server certificate is signed by a certificate authority loaded in the browser certificate store. (These should be the same certificate authority.)

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Click Renew HTTPS Certificate. (This option appears on the display under the certificate information only if your system is configured to use the default HTTPS server certificate.)

Step 4

(Optional) In the Renew HTTPS Certificate dialog box, select Generate New Key to generate a new key for the certificate.

Step 5

In the Renew HTTPS Certificate dialog box, click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Intrusion Policy Preferences.

Step 3

You have these options:

Step 1

Choose System () > Configuration.

Step 2

Click Language.

Step 3

Choose the language you want to use.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Login Banner.

Step 3

In the Custom Login Banner field, enter the login banner text you want to use.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Process.

Step 3

Do one of these actions:

Step 1

Choose System () > Configuration.

Step 2

Click REST API Preferences.

Step 3

To enable or disable REST API access to the Firewall Management Center, check or uncheck the Enable REST API check box.

Step 4

Click Save.

Step 5

Access the REST API Explorer at: https://<management_center_IP_or_name>:<https_port>/API/API-explorer

Step 1

Choose System () > Configuration.

Step 2

Click Console Configuration.

Step 3

Choose a remote console access option:

Step 4

Configure the CIMC port network settings for use with LOM.

Step 5

Click Save.

Step 6

The system displays this warning: "You will have to reboot your system for these changes to take effect." Click OK to reboot the system immediately or Cancel to to postpone the reboot.

Step 1

Choose System () > Users > Users.

Step 2

To grant LOM user access to an existing user, click Edit () next to a user name in the list.

Step 3

Under User Configuration, enable the Administrator role.

Step 4

Check the Allow Lights-Out Management Access check box.

Step 5

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Remote Storage Device.

Step 3

Choose Local (No Remote Storage) from the Storage Type drop-down list.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose NFS from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required mount options in Command Line Options.

Step 6

Under System Usage:

Step 7

Click Test to test the connection.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose SMB from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required mount options in Command Line Options.

Step 6

Under System Usage:

• Choose Use for Backups to store backups on the designated host.
• Choose Use for Reports to store reports on the designated host.

Step 7

To test the settings, click Test.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose SSH from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required mount options in Command Line Options.

Step 6

Under System Usage:

• Choose Use for Backups to store backups on the designated host.
• Choose Use for Reports to store reports on the designated host.

Step 7

Click Test to test the connection.

Step 8

Click Save.

Step 1

Choose System () > Configuration and click SNMP.

Step 2

From the SNMP Version drop-down list, choose the SNMP version you want to use:

• Version 1 or Version 2: Enter a read-only SNMP community name in the Community String field, then skip to the end of the procedure.

  Note	Do not include special characters (< > / % # & ? ', etc.) in the SNMP community string name.

• Version 3: Click Add User to display the user definition page. SNMPv3 only supports read-only users and encryption with AES128.

Step 3

Enter a Username.

Step 4

Choose the protocol you want to use for authentication from the Authentication Protocol drop-down list.

Step 5

Enter the password required for authentication with the SNMP server in the Authentication Password field. Re-enter the authentication password in the Verify Password field.

Step 6

Choose the privacy protocol you want to use from the Privacy Protocol list, or choose None to not use a privacy protocol.

Step 7

Enter the SNMP privacy key required by the SNMP server in the Privacy Password field.

Step 8

Re-enter the privacy password in the Verify Password field.

Step 9

Click Add. Click Save.

Step 1

Choose System () > Configuration > Session Timeout.

Step 2

Configure session timeouts:

Step 3

Click Save.

Step 1

Choose System () > Configuration and click Time Synchronization.

Step 2

If Serve Time via NTP is Enabled, choose Disabled to disable the Firewall Management Center as an NTP server.

Step 3

For the Set My Clock option, choose Via NTP. Click Add.

Step 4

In the Add NTP Server dialog box, enter the host name or the IPv4 or IPv6 address of an NTP server.

Step 5

(Optional) To secure communication between your Firewall Management Center and the NTP server:

1. Select MD5, SHA-1 or AES-128 CMAC from the Key Type drop-down list.

2. Enter the corresponding MD5, SHA-1, or AES-128 CMAC Key Number and Key Value from the specified NTP server.

Step 6

Click Add.

Step 7

Configure at least three NTP servers. When only two NTP servers are configured, the offset difference between them becomes high. As a result, the Firewall Management Center uses Local Time.

Step 8

(Optional) To force the Firewall Management Center to use only an NTP server that successfully authenticates, check the Use the authenticated NTP server only check box.

Step 9

Click Save.

Step 1

Manually set the system time on the Firewall Management Center:

1. Choose System () > Configuration.

2. Click Time Synchronization.

3. If Serve Time via NTP is Enabled, choose Disabled.

4. Click Save.

5. For Set My Clock, choose Manually in Local Configuration.

6. Click Save.

7. In the navigation panel at the left side of the screen, click Time.

8. Use the Set Time drop-down lists to set the time.

   Note	When you change the time on the management center by more than 2 hours, you must reboot the device as soon as possible, for example in a maintenance window, to avoid any malfunction.

9. If the time zone displayed is not UTC, click it and set the time zone to UTC.

10. Click Save.

11. Click Done.

12. Click Apply.

Step 2

Set the Firewall Management Center to serve as an NTP server:

1. In the navigation panel at the left side of the screen, click Time Synchronization.

2. For Serve Time via NTP, choose Enabled.

3. Click Save.

Step 3

Set managed devices to synchronize with the Firewall Management Center NTP server:

1. In the Time Synchronization settings for the platform settings policy assigned to your managed devices, set the clock to synchronize Via NTP from Management Center.

2. Deploy the change to managed devices.

Step 1

Choose System () > Configuration.

Step 2

Click VMware Tools.

Step 3

Click Enable VMware Tools.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Vulnerability Mapping.

Step 3

Select from these options:

• Clear the check box for a server to prevent its vulnerabilities from being mapped to hosts that receive application protocol traffic without vendor or version information.
• Check the box for a server to map its vulnerabilities to hosts that receive application protocol traffic without vendor or version information.

Step 4

Click Save.