Step 1

From Devices > Device Management, click Manage in the Chassis column or click Edit ().

The Chassis Manager page opens for the chassis to the Summary page.

Step 2

Click Interfaces.

Step 3

Click Edit () for the interface you want to edit.

Step 4

Enable the interface by checking the Enabled check box.

Step 5

For the Port Type, choose Data or Data Sharing.

Step 6

Set the Admin Duplex.

Step 7

Set the Admin Speed.

Step 8

(Optional) Check LLDP Transmit and/or LLDP Receive to enable Link Layer Discovery Protocol (LLDP) packets.

Step 9

(Optional) Check Flow Control Send to enable pause (XOFF) frames for flow control.

Step 10

(Optional) Check Auto Negotiation to set the interface to negotiate the speed, link status, and flow control. You cannot edit this setting for speeds lower than 1Gbps. For SFP interfaces, you can only disable auto-negotiation when the speed is set to 1Gbps.

Step 11

Click Save and then Save in the top right of the Interfaces page.

Step 1

From Devices > Device Management, click Manage in the Chassis column or click Edit ().

The Chassis Manager page opens for the chassis to the Summary page.

Step 2

Click Interfaces.

Step 3

Click Add > EtherChannel Interface.

Step 4

Set the following Interfaces parameters.

1. For the EtherChannel ID, specify an ID between 1 and 48.

2. Check Enabled.

3. For the Port Type, choose Data or Data Shared.

   For information about the port type, see Interface Types.

4. To add a physical interface to the EtherChannel, select click Add () in the Available Interfaces list to move it to the Selected Interfaces list.

   To add or remove all interfaces, click the double arrow button.

   Note	You cannot add an interface that is already assigned to an instance.

Step 5

(Optional) Set the following Configuration parameters.

Many of these settings (excluding the LACP settings) set the requirements for interfaces to be included in the EtherChannel; they do not override the settings of member interfaces. So if you check LLDP Transmit, for example, you should only add interfaces that have that setting. If you set the Admin Speed to 1Gbps, then only 1Gbps interfaces can be included.

1. Choose the required Admin Duplex for the member interfaces, Full Duplex or Half Duplex.

   If you add a member interface that is configured with the specified duplex, it will not successfully join the port channel.

2. Choose the required Admin Speed for the member interfaces from the drop-down list.

   If you add a member interface that is not at the specified speed, it will not successfully join the port channel.

3. Choose the LACP Mode, Active or On.

   • Active—Sends and receives LACP updates. An active EtherChannel can establish connectivity with either an active or a passive EtherChannel. You should use the active mode unless you need to minimize the amount of LACP traffic.

   • On—The EtherChannel is always on, and LACP is not used. An “on” EtherChannel can only establish a connection with another “on” EtherChannel.

   Note	It may take up to three minutes for an EtherChannel to come up to an operational state if you change its mode from On to Active or from Active to On.

4. Choose the LACP Rate, Default, Fast, or Normal.

   The default is Fast.

5. Choose the required Link Layer Discovery Protocol (LLDP) settings for member interfaces by checking LLDP Transmit and/or LLDP Receive.

6. Check the required Flow Control Send setting for member interfaces.

Step 6

Click Save and then Save in the top right of the Interfaces page.

Step 1

From Devices > Device Management, click Manage in the Chassis column or click Edit ().

The Chassis Manager page opens for the chassis to the Summary page.

Step 2

Click Interfaces.

Step 3

Click Add > Subinterface.

Step 4

Set the following parameters.

Step 5

Click Save and then Save in the top right of the Interfaces page.

Step 1

From Devices > Device Management, click Manage in the Chassis column or click Edit ().

The Chassis Manager page opens for the chassis to the Summary page.

Step 2

Click System Configuration.

Step 3

Click SNMP, and choose the instance from the drop-down list.

SNMP on the chassis will be accessible from the selected instance.

Step 4

Click Save.

Step 5

Deploy the chassis configuration.

Step 1

From Devices > Device Management, click Manage in the Chassis column or click Edit ().

The Chassis Manager page opens for the chassis to the Summary page.

Step 2

Click System Configuration.

Step 3

Click Import/Export.

Step 4

To export the configuration, follow these steps.

1. In the Export area, click Click here to export.

   

2. Monitor the notifications for the Export file created successfully message.

   

3. Download the export file by clicking the notification message (Download Export Package) or by clicking Download.

   

   The file is saved with the .sfo extension.

Step 5

To import a configuration, drag the .sfo file on the Import > Drop File here area.

Step 1

Choose Devices > Platform Settings.

Step 2

For an existing policy, you can Copy (), Edit (), or Delete () the policy.

Step 3

To create a new policy, click New Policy.

1. Choose Chassis Platform Settings from the drop-down list.

2. Enter a Name for the new policy and optionally, a Description.

3. Optionally, choose the Available Chassis where you want to apply the policy and click Add (or drag and drop) to add the selected chassis. You can enter a search string in the Search field to narrow the list of chassis.

4. Click Save.

   The system creates the policy and opens it for editing.

Step 4

To change the target chassis for a policy, click Edit () next to the platform settings policy that you want to edit.

1. Click Policy Assignment.

2. To assign a chassis to the policy, select it in the Available Chassis list and click Add. You can also drag and drop.

3. To remove a chassis assignment, click Delete () next to a chassis in the Selected Chassis list.

4. Click OK.

Step 1

Choose Devices > Platform Settings and create or edit the chassis policy.

Step 2

Choose DNS.

Step 3

Enable the Enable DNS name resolution by device slider.

Step 4

Click Add to add a DNS server group.

Step 5

Either select an existing DNS server group (see Creating DNS Server Group Objects), or click New Group.

If you add a new group, you see the following dialog box. Provide a name and up to four DNS server IP addresses as comma-separated values, and click Add.

Step 6

Click Save to add the DNS server to the list.

Step 7

Repeat these steps to add additional server groups.

Step 8

Click Save to save all policy changes.

Step 1

Choose Devices > Platform Settings and create or edit the chassis policy.

Step 2

Choose SSH.

Step 3

To enable SSH access to the chassis, enable the Enable SSH Server slider.

Step 4

To set the allowed Algorithms, click Edit ().

1. Select the Encryption algorithms.

2. Select the Key Exchange algorithms.

   The key exchange provides a shared secret that cannot be determined by either party alone. The key exchange is combined with a signature and the host key to provide host authentication. This key-exchange method provides explicit server authentication.

3. Select the Mac integrity algorithms.

Step 5

For Host Key, enter the modulus size for the RSA key pairs.

Step 6

For the server Volume Rekey Limit, set the amount of traffic in KB allowed over the connection before FXOS disconnects from the session.

Step 7

For the server Time Rekey Limit, set the minutes for how long an SSH session can be idle before FXOS disconnects the session.

Step 8

For the SSH Client, configure the following settings.

• Strict Host Keycheck—Choose enable, disable, or prompt to control SSH host key checking.

  • enable—The connection is rejected if the host key is not already in the FXOS known hosts file. You must manually add hosts at the FXOS CLI using the enter ssh-host command in the system/services scope.

  • prompt—You are prompted to accept or reject the host key if it is not already stored on the chassis.

  • disable—(The default) The chassis accepts the host key automatically if it was not stored before.

• Algorithms—Click Edit (). and select the Encryption, Key Exchange, and Mac algorithms.

• Volume Rekey Limit—Set the amount of traffic in KB allowed over the connection before FXOS disconnects from the session.

• Time Rekey Limit—Set the minutes for how long an SSH session can be idle before FXOS disconnects the session.

Step 9

Choose SSH Access List. You need to allow access to IP addresses or networks before you can use SSH.

Step 10

Click Edit () to add network objects and click Save. You can also manually enter IP addresses.

Step 11

Click Save to save all policy changes.

Step 1

Choose Devices > Platform Settings and create or edit the chassis policy.

Step 2

Choose Syslog.

Step 3

Click the Local Destinations tab, and complete the following fields.

Name	Description
Console Section
Admin State field	Whether the chassis displays syslog messages on the console. Check the Enable check box if you want to have syslog messages displayed on the console as well as added to the log. If the Enable check box is unchecked, syslog messages are added to the log but are not displayed on the console.
Level field	If you checked the Enable check box for Console - Admin State, select the lowest message level that you want displayed on the console. The chassis displays that level and above on the console. This can be one of the following: Emergencies Alerts Critical
Monitor Section
Admin State field	Whether the chassis displays syslog messages on the monitor. Check the Enable check box if you want to have syslog messages displayed on the monitor as well as added to the log. If the Enable check box is unchecked, syslog messages are added to the log but are not displayed on the monitor.
Level drop-down list	If you checked the Enable check box for Monitor - Admin State, select the lowest message level that you want displayed on the monitor. The system displays that level and above on the monitor. This can be one of the following: Emergencies Alerts Critical Errors Warnings Notifications Information Debugging

Step 4

On the Remote Destinations tab, complete the following fields for up to three external logs that can store messages generated by the chassis:

By sending syslog messages to a remote destination, you can archive messages according to the available disk space on the external syslog server, and manipulate logging data after it is saved. For example, you could specify actions to be executed when certain types of syslog messages are logged, extract data from the log and save the records to another file for reporting, or track statistics using a site-specific script.

Name	Description
Admin State field	Check the Enable check box if you want to have syslog messages stored in a remote log file.
Level drop-down list	Select the lowest message level that you want the system to store. The system stores that level and above in the remote file. This can be one of the following: Emergencies Alerts Critical Errors Warnings Notifications Information Debugging
Hostname/IP Address field	The hostname or IP address on which the remote log file resides. Note   You must configure a DNS server if you use a hostname rather than an IP address.
Facility drop-down list	Choose a system log facility for syslog servers to use as a basis to file messages. This can be one of the following: Local0 Local1 Local2 Local3 Local4 Local5 Local6 Local7

Step 5

Click the Local Sources tab, and complete the following fields.

Name	Description
Faults > Enable Admin State	Enable system fault logging.
Audits > Enable Admin State	Enable audit logging.
Events > Enable Admin State	Enable system event logging.

Step 6

Click Save to save all policy changes.

Step 1

Choose Devices > Platform Settings and create or edit the chassis policy.

Step 2

Choose Time Synchronization.

Step 3

If you want to obtain the time from the management center, click Via NTP from Management Center.

Step 4

To use an external NTP server, click Use Custom NTP Server.

1. Click Add to add a server.

   

2. Choose any already-defined servers from the drop-down menu and click Add, or click New Server to add a new server.

   

3. For a new server, enter the following fields, and click Add.

   • NTP Server Name—A name to identify this server.

   • IP/FQDN—The IP address or hostname of the server.

   • Authentication Key and Authentication Value—Obtain the key ID and value from the NTP server. For example, to generate the SHA1 key on NTP server Version 4.2.8p8 or later with OpenSSL installed, enter the ntp-keygen -M command, and then view the key ID and value in the ntp.keys file. The key is used to tell both the client and server which value to use when computing the message digest.

     Only SHA1 is supported for NTP server authentication.

Step 5

Click Save to save all policy changes.

Step 1

Choose Devices > Platform Settings and create or edit the chassis policy.

Step 2

Choose Time Zones.

Step 3

Choose your Time Zone from the drop-down menu.

Step 4

Click Save to save all policy changes.

Step 1

From Devices > Device Management, click Manage in the Chassis column or click Edit ().

The Chassis Manager page opens for the chassis to the Summary page.

Step 2

Click Instances, and click Edit () next to the instance for which you want to change interfaces.

Step 3

Click Next until you get to the Interface Assignment screen.

Shared interfaces show the sharing icon ().

Step 4

Make your interface changes, and then click Next.

Step 5

Click Save on the Summary screen.

Step 6

For high availability, you need to make the same interface changes for the other unit. Otherwise, high availability might not operate correctly.

Step 1

Connect to the chassis console port.

Step 2

Log in with the username admin and the password you set during initial setup.

Step 3

Change the Management IP address. You can use a static IPv4 and/or IPv6 address.

firepower-3110# scope fabric-interconnect
firepower-3110 /fabric-interconnect # set out-of-band static ip 10.5.23.8 netmask 255.255.255.0
gw 10.5.23.1

 

firepower-3110# scope fabric-interconnect
firepower-3110 / fabric-interconnect # scope ipv6-config
firepower-3110 / fabric-interconnect /ipv6-config # set out-of-band static ipv6 2001:DB8::34
ipv6-prefix 64 ipv6-gw 2001:DB8::1

Step 4

Change the management center.

firepower-3110# enter device-manager boulder_fmc hostname 10.89.5.35 nat-id 93002
(Valid registration key characters: [a-z],[A-Z],[0-9],[-]. Length: [2-36])
Registration Key: Impala67

Step 5

Change the admin password.

firepower-3110# scope security
firepower-3110 /security # set password
Enter new password: Sw@nsong67
Confirm new password: Sw@nsong67
firepower-3110 /security # 
 

Step 6

Disable multi-instance mode and set the system back to appliance mode.

firepower-3110# scope system
firepower-3110 /system # set deploymode native
All configuration and bootable images will be lost and system will reboot.
If there was out of band upgrade, it might reboot with the base version and
need to re-image to get the expected running version.
Do you still want to change deploy mode? (yes/no):yes
firepower-3110 /system #