Step 1

In the Firewall Management Center, choose Integration > Cisco Security Cloud.

Step 2

Choose a Cisco regional cloud from the Current Region drop-down list.

Step 3

Click Enable Cisco Security Cloud.

Step 4

Click Continue to Cisco SSO.

Step 5

Log in to your CDO account.

If you do not have a Security Cloud Sign On account to log in to CDO and you want to create one, click Sign up now in the Security Cloud Sign On page. See Create a New Cisco Security Cloud Sign On Account.

Step 6

Choose a CDO tenant that you want to use for this integration. The Firewall Management Center and the managed devices get onboarded to the CDO tenant that you choose here.

If you do not already have a CDO tenant or if you want to use a new tenant for this integration, create a new tenant. See Request a CDO Tenant for more information.

Step 7

Verify that the code displayed in the CDO login page matches the code provided by the Firewall Management Center.

Step 8

Click Authorize FMC.

Step 9

In the Firewall Management Center, configure the following:

Step 10

Click Save.

Step 1

Click Integration > Cisco Security Cloud.

Step 2

Under Cisco Security Cloud Support, check the Enable Cisco Success Network check box to enable this service.

Step 3

Click Save.

Step 1

Choose Integration > Cisco Security Cloud.

Step 2

Under Cisco Security Cloud Support, check the Enable Cisco Support Diagnostics.

Step 3

Click Save.

Step 1

Choose System () > Configuration.

Step 2

(Optional) Click SNMP to configure SNMP if you want to add SNMP rules to the access list. By default, SNMP is disabled; see Configure SNMP Polling.

Step 3

Click Access List.

Step 4

To add access for one or more IP addresses, click Add Rules.

Step 5

In the IP Address field, enter an IP address or address range, or any.

Step 6

Choose SSH, HTTPS, SNMP, or a combination of these options to specify which ports you want to enable for these IP addresses.

Step 7

Click Add.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Audit Log.

Step 3

Choose Enabled from the Send Audit Log to Syslog drop-down menu.

Step 4

The following fields are applicable only for audit logs sent to syslog:

Step 5

(Optional) To test whether the IP address of the syslog servers is valid, click Test Syslog Server.

Step 6

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Audit Log.

Step 3

Optionally, in the Tag field, enter the tag name that you want to appear with the message. For example, if you want all audit log records to be preceded with FROMMC, enter FROMMC in the field.

Step 4

Choose Enabled from the Send Audit Log to HTTP Server drop-down list.

Step 5

In the URL to Post Audit field, designate the URL where you want to send the audit information. Enter a URL that corresponds to a Listener program that expects the HTTP POST variables as listed:

Step 6

Click Save.

Step 1

In the /etc/syslog-ng.conf file, comment out the @include "/etc/syslog-ng.d/*.conf" line.

#@include "/etc/syslog-ng.d/*.conf"

Step 2

Reload the syslog configuration file. Use the syslog-ng-ctl reload command to reload the configuration file without having to restart the application.

syslog-ng-ctl reload

Step 1

Obtain and install a signed client certificate on the Firewall Management Center:

1. Obtain a Signed Audit Log Client Certificate for the Firewall Management Center:

   Generate a Certificate Signing Request (CSR) from the Firewall Management Center based on your system information and the identification information you supply.

   Submit the CSR to a recognized, trusted certificate authority (CA) to request a signed client certificate.

   If you will require mutual authentication between the Firewall Management Center and the audit log server, the client certificate must be signed by the same CA that signed the server certificate to be used for the connection.

2. After you receive the signed certificate from the certificate authority, import it into the Firewall Management Center. See Import an Audit Log Client Certificate into the Firewall Management Center.

Step 2

Configure the communication channel with the server to use Transport Layer Security (TLS) and enable mutual authentication.

Step 3

Configure audit log streaming if you have not yet done so.

Step 1

Choose System () > Configuration.

Step 2

Click Audit Log Certificate.

Step 3

Click Generate New CSR.

Step 4

Enter a country code in the Country Name (two-letter code) field.

Step 5

Enter a state or province postal abbreviation in the State or Province field.

Step 6

Enter a Locality or City.

Step 7

Enter an Organization name.

Step 8

Enter an Organizational Unit (Department) name.

Step 9

Enter the fully qualified domain name of the server for which you want to request a certificate in the Common Name field.

Step 10

Click Generate.

Step 11

Open a new blank file with a text editor.

Step 12

Copy the entire block of text in the certificate request, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines, and paste it into a blank text file.

Step 13

Save the file as clientname.csr, where clientname is the name of the appliance where you plan to use the certificate.

Step 14

Click Close.

Step 1

On the Firewall Management Center, choose System () > Configuration.

Step 2

Click Audit Log Certificate.

Step 3

Click Import Audit Client Certificate.

Step 4

Open the client certificate in a text editor, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Paste this text into the Client Certificate field.

Step 5

To upload a private key, open the private key file and copy the entire block of text, including the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines. Paste this text into the Private Key field.

Step 6

Open any required intermediate certificates, copy the entire block of text for each, and paste it into the Certificate Chain field.

Step 7

Click Save.

Step 1

On the Firewall Management Center, choose System () > Configuration.

Step 2

Click Audit Log Certificate.

Step 3

To use Transport Layer Security to securely stream the audit log to an external server, select Enable TLS.

Step 4

If you do not want the client to authenticate itself against the server, but accept the server certificate when the certificate is issued by the same CA (not recommended):

1. Deselect Enable Mutual Authentication.

   Important

   Ensure that the server is configured to trust the client without verifying any client certificates.

2. Click Save and skip the remainder of this procedure.

Step 5

(Optional) To enable client certificate verification by the audit log server, select Enable Mutual Authentication.

openssl pkcs8 -topk8 -inform PEM -outform PEM 
-nocrypt -in PKCS1 key file name -out PKCS8 key filename

Step 6

(Optional) To automatically recognize server certificates that are no longer valid:

1. Select Enable Fetching of CRL.

   Important

   This option is displayed only when you select the Enable Mutual Authentication check box. However, the Enable Fetching of CRL option is applicable only when the TLS option is enabled. The use of CRL is for server certification verification, and it is not dependent on the use of Mutual Authentication which is for enabling client certificate verification.

   Enabling fetching of the CRL creates a scheduled task for the client to regularly update (download) the CRL or CRLs. The CRL(s) are used for server certificate verification, where, the verification fails if there is a CRL from the CA specifying that the server certificate being verified has been revoked by the CA.

2. Enter a valid URL to an existing CRL file and click Add CRL.

   Repeat to add up to 25 CRLs.

3. Click Refresh CRL to load the current CRL or CRLs from the specified URL or URLs.

Step 7

Verify that you have a valid server certificate generated by the same certificate authority that created the client certificate.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Audit Log Certificate.

Step 1

Choose System () > Configuration.

Step 2

Click Change Reconciliation.

Step 3

Check the Enable check box.

Step 4

Choose the time of day you want the system to send out the change reconciliation report from the Time to Run drop-down lists.

Step 5

Enter email addresses in the Email to field.

Step 6

If you want to include policy changes, check the Include Policy Configuration check box.

Step 7

If you want to include all changes over the past 24 hours, check the Show Full Change History check box.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose DNS Cache.

Step 3

From the DNS Resolution Caching drop-down list, choose one of the following:

• Enabled—Enable caching.
• Disabled—Disable caching.

Step 4

In the DNS Cache Timeout (in minutes) field, enter the number of minutes a DNS entry remains cached in memory before it is removed for inactivity.

Step 5

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Dashboard.

Step 3

Check the Enable Custom Analysis Widgets check box to allow users to add Custom Analysis widgets to dashboards.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Database.

Step 3

For each of the databases, enter the number of records you want to store.

Step 4

Optionally, in the Data Pruning Notification Address field, enter the email address where you want to receive pruning notifications.

Step 5

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Email Notification.

Step 3

In the Mail Relay Host field, enter the hostname or IP address of the mail server you want to use. The mail host you enter must allow access from the appliance.

Step 4

In the Port Number field, enter the port number to use on the email server.

Step 5

Choose an Encryption Method:

• TLS—Encrypt communications using Transport Layer Security.
• SSLv3—Encrypt communications using Secure Socket Layers.
• None—Allow unencrypted communication.

Step 6

In the From Address field, enter the valid email address you want to use as the source email address for messages sent by the appliance.

Step 7

Optionally, to supply a user name and password when connecting to the mail server, choose Use Authentication. Enter a user name in the Username field. Enter a password in the Password field.

Step 8

To send a test email using the configured mail server, click Test Mail Server Settings.

Step 9

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click External Database Access.

Step 3

Select the Allow External Database Access check box.

Step 4

Enter an appropriate value in the Server Hostname field. Depending on your third-party application requirements, this value can be either the fully qualified domain name (FQDN), IPv4 address, or IPv6 address of the Firewall Management Center.

Step 5

Next to Client JDBC Driver, click Download and follow your browser’s prompts to download the client.zip package.

Step 6

To add database access for one or more IP addresses, click Add Hosts. An IP Address field appears in the Access List field.

Step 7

In the IP Address field, enter an IP address or address range, or any.

Step 8

Click Add.

Step 9

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Click Generate New CSR.

Step 4

Enter a country code in the Country Name (two-letter code) field.

Step 5

Enter a state or province postal abbreviation in the State or Province field.

Step 6

Enter a Locality or City.

Step 7

Enter an Organization name.

Step 8

Enter an Organizational Unit (Department) name.

Step 9

Enter the fully qualified domain name of the server for which you want to request a certificate in the Common Name field.

Step 10

To request a certificate that secures multiple domain names or IP addresses, enter the following information in the Subject Alternative Name section:

1. Domain Names: Enter the fully qualified domains and subdomains (if any) secured by the Subject Alternative Name.

2. IP Addresses: Enter the IP addresses secured by the Subject Alternative Name.

Step 11

Click Generate.

Step 12

Open a text editor.

Step 13

Copy the entire block of text in the certificate request, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines, and paste it into a blank text file.

Step 14

Save the file as servername.csr, where servername is the name of the server where you plan to use the certificate.

Step 15

Click Close.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Click Import HTTPS Server Certificate.

Step 4

Open the server certificate in a text editor, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Paste this text into the Server Certificate field.

Step 5

Whether you must supply a Private Key depends on how you generated the Certificate Signing Request:

• If you generated the Certificate Signing Request using the Secure Firewall Management Center web interface (as described in Generating an HTTPS Server Certificate Signing Request), the system already has the private key and you need not enter one here.
• If you generated the Certificate Signing Request using some other means, you must supply the private key here. Open the private key file and copy the entire block of text, include the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines. Paste this text into the Private Key field.

Step 6

Open any required intermediate certificates, copy the entire block of text for each, and paste it into the Certificate Chain field. If you received a root certificate, paste it here. If you received an intermediate certificate, paste it below the root certificate. In both cases, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

Step 7

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Choose Enable Client Certificates. If prompted, select the appropriate certificate from the drop-down list.

Step 4

You have three options:

• To verify client certificates using one or more CRLS, select Enable Fetching of CRL and continue with Step 5.
• To verify client certificates using OCSP, select Enable OCSP and skip to Step 7.
• To accept client certificates without checking for revocation, skip to Step 8.

Step 5

Enter a valid URL to an existing CRL file and click Add CRL. Repeat to add up to 25 CRLs.

Step 6

Click Refresh CRL to load the current CRL or CRLs from the specified URL or URLs.

Step 7

Verify that the client certificate is signed by the certificate authority loaded onto the appliance and the server certificate is signed by a certificate authority loaded in the browser certificate store. (These should be the same certificate authority.)

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Click Renew HTTPS Certificate. (This option appears on the display below the certificate information only if your system is configured to use the default HTTPS server certificate.)

Step 4

(Optional) In the Renew HTTPS Certificate dialog box, select Generate New Key to generate a new key for the certificate.

Step 5

In the Renew HTTPS Certificate dialog box, click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Intrusion Policy Preferences.

Step 3

You have the following options:

Step 1

Choose System () > Configuration.

Step 2

Click Language.

Step 3

Choose the language you want to use.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Login Banner.

Step 3

In the Custom Login Banner field, enter the login banner text you want to use.

Step 4

Click Save.

Step 1

Choose System () > Configuration > Management Interfaces.

Step 2

In the Interfaces area, click Edit next to the interface that you want to configure.

Step 3

In the Routes area, edit a static route by clicking Edit (), or add a route by clicking Add ().

Step 4

In the Shared Settings area, set network parameters shared by all interfaces.

Step 5

In the ICMPv6 area, configure ICMPv6 settings.

Step 6

In the Proxy area, configure HTTP proxy settings.

1. Check the Enabled check box.

2. In the HTTP Proxy field, enter the IP address or fully qualified domain name of your proxy server.

   • For Smart Licensing, the proxy FQDN cannot have more than 64 characters.

   • For IPv6, you can only specify an FQDN for the proxy, not an IP address.

3. In the Port field, enter a port number.

4. Supply authentication credentials by choosing Use Proxy Authentication, and then provide a User Name and Password.

   For Smart Licensing, the proxy password should not contain special characters other than hyphen (-), underscore (_) and period (.).

Step 7

Click Save.

Step 8

If you change the Firewall Management Center IP address, then see Edit the Firewall Management Center IP Address or Hostname on the Device in the Cisco Secure Firewall Management Center Device Configuration Guide.

Step 1

Choose System () > Configuration.

Step 2

Choose Process.

Step 3

Do one of the following:

Step 1

Choose System () > Configuration

Step 2

Click REST API Preferences.

Step 3

To enable or disable REST API access to the Firewall Management Center, check or uncheck the Enable REST API check box.

Step 4

Click Save.

Step 5

Access the REST API Explorer at: https://<management_center_IP_or_name>:<https_port>/api/api-explorer

Step 1

Choose System () > Configuration.

Step 2

Click Console Configuration.

Step 3

Choose a remote console access option:

Step 4

Configure the CIMC port network settings for use with LOM.

Step 5

Click Save.

Step 6

The system displays the following warning: "You will have to reboot your system for these changes to take effect." Click OK to reboot now or Cancel to reboot later.

Step 1

Choose System () > Users > Users.

Step 2

To grant LOM user access to an existing user, click Edit () next to a user name in the list.

Step 3

Under User Configuration, enable the Administrator role.

Step 4

Check the Allow Lights-Out Management Access check box.

Step 5

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Remote Storage Device.

Step 3

Choose Local (No Remote Storage) from the Storage Type drop-down list.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose NFS from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required mount options in Command Line Options.

Step 6

Under System Usage:

Step 7

Click Test to test the connection.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose SMB from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required mount options in Command Line Options.

Step 6

Under System Usage:

• Choose Use for Backups to store backups on the designated host.
• Choose Use for Reports to store reports on the designated host.

Step 7

To test the settings, click Test.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose SSH from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required mount options in Command Line Options.

Step 6

Under System Usage:

• Choose Use for Backups to store backups on the designated host.
• Choose Use for Reports to store reports on the designated host.

Step 7

Click Test to test the connection.

Step 8

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click SNMP.

Step 3

From the SNMP Version drop-down list, choose the SNMP version you want to use:

• Version 1 or Version 2: Enter a read-only SNMP community name in the Community String field, then skip to the end of the procedure.

  Note	Do not include special characters (< > / % # & ? ', etc.) in the SNMP community string name.

• Version 3: Click Add User to display the user definition page. SNMPv3 only supports read-only users and encryption with AES128.

Step 4

Enter a Username.

Step 5

Choose the protocol you want to use for authentication from the Authentication Protocol drop-down list.

Step 6

Enter the password required for authentication with the SNMP server in the Authentication Password field.

Step 7

Re-enter the authentication password in the Verify Password field.

Step 8

Choose the privacy protocol you want to use from the Privacy Protocol list, or choose None to not use a privacy protocol.

Step 9

Enter the SNMP privacy key required by the SNMP server in the Privacy Password field.

Step 10

Re-enter the privacy password in the Verify Password field.

Step 11

Click Add.

Step 12

Click Save.

Step 1

Choose System () > Configuration > Session Timeout.

Step 2

Configure session timeouts:

Step 3

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click Time Synchronization.

Step 3

If Serve Time via NTP is Enabled, choose Disabled to disable the Firewall Management Center as an NTP server.

Step 4

For the Set My Clock option, choose Via NTP.

Step 5

Click Add.

Step 6

In the Add NTP Server dialog box, enter the host name or IPv4 or IPv6 address of an NTP server.

Step 7

(Optional) To secure communication between your Firewall Management Center and the NTP server:

1. Select MD5, SHA-1 or AES-128 CMAC from the Key Type drop-down list.

2. Enter an the corresponding MD5, SHA-1, or AES-128 CMAC Key Number and Key Value from the specified NTP server.

Step 8

Click Add.

Step 9

When only two NTP servers are configured, the offset difference between them becomes high. This results in the Firewall Management Center using the Local Time. Hence, we recommend that you configure atleast three NTP servers.

Step 10

(Optional) To force the Firewall Management Center to use only an NTP server that successfully authenticates, check the Use the authenticated NTP server only check box.

Step 11

Click Save.

Step 1

Manually set the system time on the Firewall Management Center:

1. Choose System () > Configuration.

2. Click Time Synchronization.

3. If Serve Time via NTP is Enabled, choose Disabled.

4. Click Save.

5. For Set My Clock, choose Manually in Local Configuration.

6. Click Save.

7. In the navigation panel at the left side of the screen, click Time.

8. Use the Set Time drop-down lists to set the time.

   Note	When you change the time on the management center by more than two hours, you must reboot the device as soon as possible, for example in a maintenance window, to avoid any malfunction.

9. If the time zone displayed is not UTC, click it and set the time zone to UTC.

10. Click Save.

11. Click Done.

12. Click Apply.

Step 2

Set the Firewall Management Center to serve as an NTP server:

1. In the navigation panel at the left side of the screen, click Time Synchronization.

2. For Serve Time via NTP, choose Enabled.

3. Click Save.

Step 3

Set managed devices to synchronize with the Firewall Management Center NTP server:

1. In the Time Synchronization settings for the platform settings policy assigned to your managed devices, set the clock to synchronize Via NTP from Management Center.

2. Deploy the change to managed devices.

Step 1

Choose System () > Configuration

Step 2

Check the Enable Post-Upgrade Report check box to enable the option.

Step 3

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click User Configuration.

Step 3

Set the Password Reuse Limit to the number of passwords you want to maintain in the history (maximum 256).

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click User Configuration.

Step 3

Set Track Successful Login Days to the number of days to track successful logins (maximum 365).

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click User Configuration.

Step 3

Set the Max Number of Login Failures to the maximum number of consecutive failed login attempts before the user is temporarily locked out.

Step 4

Set the Time in Minutes to Temporarily Lockout Users to the number of minutes to lock out users who have triggered a temporary lockout.

Step 5

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click User Configuration.

Step 3

For each type of session, set the Max Concurrent Sessions Allowed to the maximum number of sessions that can be open at the same time.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Click VMware Tools.

Step 3

Click Enable VMware Tools.

Step 4

Click Save.

Step 1

Choose System () > Configuration.

Step 2

Choose Vulnerability Mapping.

Step 3

You have the following choices:

• To prevent vulnerabilities for a server from being mapped to hosts that receive application protocol traffic without vendor or version information, clear the check box for that server.
• To cause vulnerabilities for a server to be mapped to hosts that receive application protocol traffic without vendor or version information, check the check box for that server.

Step 4

Click Save.