此产品的文档集力求使用非歧视性语言。在本文档集中,非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言,文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。
思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言,希望全球的用户都能通过各自的语言得到支持性的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任,并建议您总是参考英文原始文档(已提供链接)。
本文档介绍如何使用FTD 7.6和相关详细信息在Firepower 4200防火墙系列中配置容器(多实例模式)。
注意:任何平台上的FDM均不支持多实例。
本文档不限于特定的软件和硬件版本。
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
注意:对于FPR4100系列,如果是FTD-HA,主节点和辅助节点必须位于两个不同的4200系列(MI模式)设备上。此外,此版本不支持MI集群。
7.6.0中多实例配置的更改:
实例密度由两个主要因素驱动:
1.给定平台上的CPU核心数量和磁盘空间量
2.这些资源中有多少可用于向实例提供资源。最小的实例大小需要3个物理CPU(6个逻辑)内核和48 GB磁盘空间。
4215 |
4225 |
4245 |
||||
实例大小 |
数据平面核心 |
Snort核心 |
数据平面核心 |
Snort核心 |
数据平面核心 |
Snort核心 |
6 |
2 |
2 |
2 |
2 |
2 |
2 |
8 |
2 |
4 |
2 |
4 |
2 |
4 |
10 |
4 |
4 |
4 |
4 |
4 |
4 |
12 |
4 |
6 |
4 |
6 |
4 |
6 |
14 |
6 |
8 |
6 |
6 |
6 |
6 |
16 |
6 |
8 |
6 |
6 |
8 |
8 |
18 |
8 |
10 |
8 |
8 |
8 |
10 |
20 |
8 |
10 |
8 |
8 |
10 |
10 |
22 |
10 |
12 |
10 |
10 |
10 |
12 |
24 |
12 |
12 |
10 |
10 |
10 |
12 |
26 |
12 |
14 |
12 |
12 |
12 |
12 |
28 |
14 |
14 |
12 |
14 |
12 |
14 |
30 |
14 |
16 |
14 |
14 |
14 |
14 |
32 |
14 |
16 |
14 |
16 |
14 |
16 |
34 |
16 |
16 |
16 |
16 |
16 |
16 |
36 |
16 |
18 |
16 |
18 |
16 |
18 |
38 |
18 |
18 |
18 |
18 |
18 |
18 |
40 |
18 |
20 |
18 |
20 |
18 |
20 |
42 |
20 |
20 |
20 |
20 |
20 |
20 |
44 |
20 |
22 |
20 |
22 |
20 |
22 |
46 |
22 |
22 |
22 |
22 |
22 |
22 |
48 |
22 |
24 |
22 |
24 |
22 |
24 |
50 |
24 |
24 |
24 |
24 |
24 |
24 |
52 |
24 |
26 |
24 |
26 |
24 |
26 |
54 |
26 |
26 |
26 |
26 |
24 |
26 |
56 |
26 |
28 |
26 |
28 |
26 |
28 |
58 |
28 |
28 |
28 |
28 |
28 |
28 |
60 |
28 |
30 |
28 |
39 |
28 |
30 |
62 |
30 |
30 |
30 |
30 |
30 |
30 |
64 |
30 |
32 |
30 |
32 |
||
66 |
30 |
34 |
30 |
34 |
||
68 |
32 |
34 |
32 |
34 |
||
70 |
32 |
36 |
32 |
36 |
||
72 |
34 |
36 |
34 |
36 |
||
74 |
34 |
38 |
34 |
38 |
||
76 |
36 |
38 |
36 |
38 |
||
78 |
36 |
40 |
36 |
40 |
||
80 |
38 |
40 |
38 |
40 |
||
82 |
38 |
42 |
38 |
42 |
||
84 |
40 |
42 |
40 |
42 |
||
86 |
40 |
44 |
40 |
44 |
||
88 |
42 |
44 |
42 |
44 |
||
90 |
42 |
46 |
42 |
46 |
||
92 |
44 |
46 |
44 |
46 |
||
94 |
44 |
48 |
44 |
48 |
||
96 |
46 |
48 |
46 |
48 |
||
98 |
46 |
50 |
46 |
50 |
||
100 |
48 |
50 |
48 |
50 |
||
102 |
48 |
52 |
48 |
52 |
||
104 |
50 |
52 |
50 |
52 |
||
106 |
50 |
54 |
50 |
54 |
||
108 |
52 |
54 |
52 |
54 |
||
110 |
52 |
56 |
52 |
56 |
||
112 |
54 |
56 |
54 |
56 |
||
114 |
54 |
58 |
54 |
58 |
||
116 |
56 |
58 |
56 |
58 |
||
118 |
56 |
60 |
56 |
60 |
||
120 |
58 |
60 |
58 |
60 |
||
122 |
58 |
62 |
58 |
62 |
||
124 |
60 |
62 |
60 |
62 |
||
128 |
60 |
64 |
||||
130 |
60 |
66 |
||||
132 |
62 |
66 |
||||
134 |
62 |
68 |
||||
136 |
64 |
68 |
||||
138 |
64 |
70 |
||||
140 |
66 |
70 |
||||
142 |
66 |
72 |
||||
144 |
68 |
72 |
||||
146 |
68 |
74 |
||||
148 |
70 |
74 |
||||
150 |
70 |
76 |
||||
152 |
72 |
76 |
||||
154 |
72 |
78 |
||||
156 |
74 |
78 |
||||
158 |
74 |
80 |
||||
254 |
120 |
130 |
默认情况下,4200处于本机模式。要在FMC中将4200系列转换为多实例模式,请执行以下操作:
注意:在本机模式和MI模式之间切换会重置机箱上的所有配置。从MI模式转换到本地模式仍然通过CLI。
1.要开始转换,请导航到设备>设备管理。
2.验证所选设备并点击继续:
验证所选设备
就绪性检查
结果设备管理页面列出4200系列(MI模式)设备:
FMC机箱概述页面提供了4200系列(MI模式)设备的完整摘要。此命令包括:
单击Manage导航到Chassis Overview:
机箱页面摘要选项卡:
“摘要”选项卡包含多个部分。单击以获取更多详细信息:
节按编号进行映射,如下图所示:
1.背板视图:
2.故障部分:
3. Interfaces部分:
4 .Instances部分:
实例从脱机状态到联机状态的转换如前面的图像所示。
5.硬件统计:
Interfaces选项卡支持的操作:
Interfaces选项卡的登录页显示机箱管理的所有类型的接口,例如物理接口、子接口和EtherChannel以及EtherChannel子接口。
可以更新物理接口的以下属性:
从Add按钮选择子接口选项以添加新接口。
可以修改子接口的以下属性:
要创建新的EtherChannel接口,请使用Add按钮下的“EtherChannel interface”。
可以为EtherChannel配置的属性包括:
在某些情况下,FMC配置和设备配置可能会不同步。一种情况是用户删除或插入netmod。在这种情况下可以执行同步设备。
您的文档中使用的“热插拔”在其他内部文档中称为“在线插拔”或OIR。
启用/禁用网络模块或中断或加入接口时可以立即进行部署。多实例模式与本地模式中的4200系列模式相同。
FMC将收到的响应与当前配置进行比较,然后创建接口更改通知供用户确认。
独立本地模式安全防火墙4200系列独立版已经支持EPM OIR和分支。
4200系列EPM OIR和分支FMC文档:
当用户切换启用模块时,会显示警告,以确保这不是偶然的点击。
此屏幕截图显示用于查看关联接口的选项:
接口列表页面列出了启用EPM时添加的接口。单击以了解更多信息,启动接口更改对话框。
保存后,单击了解更多信息不可用。
接口中断确认向导在中断选项触发时打开。
确认接口中断后,接口更新通知将显示在机箱页面上。
单击Accept Changes后,这些接口在要使用的FMC中变为可用:
实例管理使您能够:
单击Add Instance启动向导。
步骤1.协议:
Step 2.
步骤3.接口分配:
步骤4.设备管理:
步骤5.总结:
要完成配置,请保存并部署。
成功部署后FTD实例的自动注册:
注册到管理中心的实例:
点击铅笔图标编辑FTD实例:
步骤1.编辑FTD实例:
步骤2.编辑实例的接口分配:
步骤3.编辑实例摘要:
导航到用于配置SNMP的系统配置选项卡:
导航至管理机箱>系统配置>导入/导出:
导航至管理机箱>系统配置>导入/导出:
机箱平台设置策略允许用户配置以下平台特定配置:
提示:机箱平台设置仅适用于机箱。如果用户想要将平台设置应用于其实例,则可以使用威胁防御平台设置策略。
1.导航到机箱平台设置策略:
2.创建机箱平台设置:
3.机箱平台设置策略页:
在机箱平台设置策略的DNS部分下启用和添加DNS服务器组:
此选项卡仅在机箱平台设置的SSH部分下启用SSH后显示。
时间同步可通过两种方式完成:
设置时区:
保存机箱平台设置更改,然后部署:
要从FMC注销机箱,请导航至设备>设备管理>删除。
目前,FMC仅支持从本地到多实例的转换。因此,要将设备转换回本地模式,用户必须使用CLI。
步骤 1:从FMC注销机箱。
步骤 2:使用此CLI命令将4200系列设备转换为本地模式:
firepower-4215# scope system
firepower-4215 /system # set deploymode native
FMC公共REST API可用于FMC支持的所有操作。
POST API用于验证本地设备是否准备好进行多实例转换:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/operational/switchmodereadinessccheck
POST请求JSON示例:
{
"devices": [
{
"id": "DeviceUUID",
"type": "Device"
}
],
"conversionType": "NATIVE_TO_MULTI_INSTANCE"
}
POST API以触发单个本机到多实例转换:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/operational/switchmode
POST请求JSON示例:
{
"items": [
{
"id": "",
"displayName": "Sample_Chassis_Name1"
}
],
"conversionType": "NATIVE_TO_MULTI_INSTANCE"
}
POST API以触发批量本地到多实例转换:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/operational/switchmode
POST请求JSON示例:
{
"items": [
{
"id": "",
"displayName": "Sample_Chassis_Name1"
},
{
"id": "",
"displayName": "Sample_Chassis_Name2"
}
],
"conversionType": "NATIVE_TO_MULTI_INSTANCE"
}
POST将机箱添加到管理中心:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis
获取所有机箱:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/
通过uuid获取特定机箱:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{objectId}
通过uuid删除机箱:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{objectId}
POST请求JSON示例:
{
"type": "FMCManagedChassis",
"chassisName": "CHASSIS123",
"chassisHostName": "192.168.xx.74",
"regKey": "*****"
}
通过uuid获取网络模块:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/networkmodules/{objectId}
获取所有网络模块:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/networkmodules/
PUT — 通过uuid编辑现有网络模块:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/networkmodules/{objectId}
PUT — 从FXOS检索网络模块数据并更新管理中心:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/operational/syncnetworkmodule
GET响应示例
{
"metadata": {
"timestamp": 1688670821060,
"domain": {
"name": "Global",
"id": "e276abec-e0f2-11e3-8169-************",
"type": "Domain"
}
},
"links": {
"self": "https://u32c01p10-vrouter.cisco.com:32300/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-************/chassis/fmcmanagedchassis/f0f11b69-4229-4025-b0b9-************/networkmodules/0050568A-3F3F-0ed3-0000-0************"
},
"id": "0050568A-3F3F-0ed3-0000-************",
"moduleState": "ENABLED",
"type": "NetworkModule",
"description": "Cisco FPR 8X1G 8X10G 1RU Module",
"model": "FPR-3120",
"operationState": "ok",
"numOfPorts": 16,
"slotId": "1",
"vendor": "Cisco Systems, Inc.",
"name": "Network Module 1"
}
POST将机箱添加到管理中心:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/logicaldevices
获取所有机箱:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/logicaldevices
通过uuid获取特定实例:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/logicaldevices/{objectId}
PUT — 按uuid编辑实例:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/logicaldevices/{objectId}
通过uuid删除机箱:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/logicaldevices/{objectId}
PUT请求示例:
{
"name": "ftd1",
"operationalState": "string",
"deviceRegistration": {
"licenseCaps": [
"MALWARE",
"URLFilter",
"CARRIER",
"PROTECT"
],
"accessPolicy": {
"name": "AC Policy name",
"id": "",
"type": "AccessPolicy"
},
"deviceGroup": {
"name": "DeviceGroup name",
"id": "",
"type": "DeviceGroup"
}
},
"managementBootstrap": {
"ipv4": {
"gateway": "192.168.xx.68",
"ip": "192.168.xx.78",
"mask": "255.255.255.0"
},
"adminState": "enable",
"firepowerManagerIP": "192.168.xx.32",
"permitExpertMode": "yes",
"searchDomain": "string",
"firewallMode": "Routed",
"dnsServers": "192.168.xx.123",
"natId": "natId",
"registrationKey": "regKey",
"adminPassword": "adminPwd",
"fqdn": "fqdn"
},
"externalPortLink": [
{
"name": "Ethernet1/1",
"id": "",
"type": "ChassisInterface"
},
{
"name": "Ethernet2/2.1",
"id": "",
"type": "ChassisInterface"
}
],
"type": "LogicalDevice"
}
通过uuid获取SNMP设置:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/snmpsettings/{objectId}
获取所有SNMP设置:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/snmpsettings/
PUT — 按uuid编辑现有网络模块:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/snmpsettings/{objectId}
GET响应示例:
{
"snmpAdminInstance": {
"id": "logicalDeviceUuid",
"type": "LogicalDevice",
"name": "ftd3"
},
"id": "snmpsettingsUUID2",
"type": "SnmpSetting"
}
此列表包含有关用于获取摘要的REST API的详细信息:
机箱的GET故障摘要:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/faultsummary
示例响应:
{
"links": {
"self": "/api/fmc_config/v1/domain/domainUUID/chassis/fmcmanagedchassis/containerUUID/faultsummary?offset=0&limit=25&expanded=true"
},
"items": [
{
"faultList": [
{
"id": 27429,
"isAcknowledged": "no",
"cause": "device-registration-pending",
"gateway": "3::1",
"ip": "3::2",
"prefixLength": "33"
}
],
"managementPort": "Management1",
"operationalState": "online",
"adminState": "enabled",
"deployType": "container"
}
],
"modifiedTime": "2022-07-05T06:39:25Z",
"type": "InstanceSummary"
],
"paging": {
"offset": 0,
"limit": 25,
"count": 1,
"pages": 1
}
}
机箱的GET实例摘要:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/instancesummary
示例响应:
{
"links": {
"self": "/api/fmc_config/v1/domain/domainUUID/chassis/fmcmanagedchassis/containerUUID/instancesummary?offset=0&limit=25&expanded=true"
},
"items": [
{
"instanceList": [
{
"name": "ftdmi2",
"startupVersion": "7.3.0.1402",
"coresUsed": 6,
"ipv4": {
"gateway": "192.168.xx.68",
"ip": "192.168.xx.78",
"mask": "255.255.255.0"
},
"ipv6": {
"gateway": "3::1",
"ip": "3::2",
"prefixLength": "33"
},
"managementPort": "Management1",
"operationalState": "online",
"adminState": "enabled",
"deployType": "container"
}
],
"modifiedTime": "2022-07-05T06:39:25Z",
"type": "InstanceSummary"
}
],
"paging": {
"offset": 0,
"limit": 25,
"count": 1,
"pages": 1
}
}
获取机箱的资产摘要:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/inventorysummary
示例响应:
{
"links": {
"self": "/api/fmc_config/v1/domain/domainUUID/chassis/fmcmanagedchassis/containerUUID/inventorysummary?offset=0&limit=25&expanded=true"
},
"items": [
{
"fanList": [
{
"operationalState": "operable",
"operability": "operable",
"power": "on",
"thermalStatus": "ok",
"module": 1,
"tray": 1,
"id": 1,
"model": "N/A",
"vendor": "N/A"
},
{
"operationalState": "operable",
"operability": "operable",
"power": "on",
"thermalStatus": "ok",
"module": 1,
"tray": 1,
"id": 2,
"model": "N/A",
"vendor": "N/A"
}
],
"powerSupplyList": [
{
"id": 2,
"operationalState": "operable",
"operability": "operable",
"serialNumber": "***********",
"thermalStatus": "ok",
"model": "FPR2K-PWR-AC-400",
"vendor": "Cisco Systems, Inc"
}
],
"processorList": [
{
"id": 1,
"operationalState": "operable",
"operability": "operable",
"vendor": "AuthenticAMD",
"model": "49 AMD EPYC 7282 16-Core Processor",
"type": "CPU",
"thermalStatus": "ok"
}
],
"securityModuleList": [
{
"id": 1,
"operationalState": "ok",
"operability": "operable",
"serialNumber": "***********",
"vendor": "Cisco Systems, Inc",
"model": "FPR-3120",
"availableCores": 24,
"totalCores": 32
}
],
"memoryList": [
{
"capacity": 65536,
"id": 1,
"array": 1,
"bank": 0,
"model": "HMAA8GR7AJR4N-XN",
"operationalState": "operable",
"operability": "operable",
"performance": "ok",
"power": "not-supported",
"serialNumber": "********",
"thermalStatus": "ok",
"vendor": "Hynix"
}
],
"model": "FPR-3120",
"availableCores": 24,
"totalCores": 32
}
],
"paging": {
"offset": 0,
"limit": 25,
"count": 1,
"pages": 1
}
}
机箱的GET接口摘要:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/interfacesummary
示例响应:
{
"links": {
"self": "/api/fmc_config/v1/domain/domainUUID/chassis/fmcmanagedchassis/containerUUID/interfacesummary?offset=0&limit=25"
},
"items": [
{
"interfaceList": [
{
"name": "Ethernet1/8",
"operationalState": "up",
"adminState": "disabled",
"portType": "data",
"operationalSpeed": "10mbps",
"adminSpeed": "1gbps",
"adminDuplex": "fullDuplex",
"autoNegotiation": "yes",
"mediaType": "rj45",
"type": "PhysicalInterface"
},
{
"name": "Ethernet1/7",
"operationalState": "up",
"adminState": "disabled",
"portType": "data",
"operationalSpeed": "1gbps",
"adminSpeed": "1gbps",
"adminDuplex": "fullDuplex",
"autoNegotiation": "yes",
"mediaType": "rj45",
"type": "PhysicalInterface"
},
{
"name": "Ethernet1/6",
"operationalState": "up",
"adminState": "disabled",
"portType": "data",
"operationalSpeed": "1gbps",
"adminSpeed": "1gbps",
"adminDuplex": "fullDuplex",
"autoNegotiation": "yes",
"mediaType": "rj45",
"type": "PhysicalInterface"
},
{
"name": "Ethernet1/3",
"operationalState": "up",
"adminState": "disabled",
"portType": "data",
"operationalSpeed": "1gbps",
"adminSpeed": "1gbps",
"adminDuplex": "fullDuplex",
"autoNegotiation": "yes",
"mediaType": "rj45",
"type": "PhysicalInterface"
},
{
"name": "Ethernet1/2",
"operationalState": "up",
"adminState": "enabled",
"portType": "data",
"operationalSpeed": "1gbps",
"adminSpeed": "1gbps",
"adminDuplex": "fullDuplex",
"autoNegotiation": "yes",
"mediaType": "rj45",
"type": "PhysicalInterface"
},
{
"name": "Ethernet1/1",
"operationalState": "up",
"adminState": "enabled",
"portType": "data",
"operationalSpeed": "1gbps",
"adminSpeed": "1gbps",
"adminDuplex": "fullDuplex",
"autoNegotiation": "yes",
"mediaType": "rj45",
"type": "PhysicalInterface"
},
{
"name": "Port-channel48",
"operationalState": "up",
"adminState": "enabled",
"portType": "data",
"operationalSpeed": "1gbps",
"adminSpeed": "1gbps",
"adminDuplex": "fullDuplex",
"autoNegotiation": "yes",
"mediaType": "rj45",
"type": "EtherChannelInterface"
}
],
"modifiedTime": "2022-07-05T06:39:25Z",
"type": "InterfaceSummary"
}
],
"paging": {
"offset": 0,
"limit": 25,
"count": 1,
"pages": 1
}
}
获取机箱的应用信息:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID} /inventorysummary
示例响应:
{
"links": {
"self": "/api/fmc_config/v1/domain/domainUUID/chassis/fmcmanagedchassis/containerUUID/appinfo?offset=0&limit=25&expanded=true"
},
"items": [
{
"appVersion": "7.4.0.1024",
"type": "AppInfo"
},
{
"appVersion": "7.4.0.1075",
"type": "AppInfo"
}
],
"paging": {
"offset": 0,
"limit": 25,
"count": 1,
"pages": 1
}
}
本节包含有关用于接口配置管理的REST API的详细信息:
为了支持物理接口的更新,引入了这些URL。
GET所有物理接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/physicalinterfaces
通过接口uuid获取特定物理接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/physicalinterface s/{interfaceUUID}
按接口uuid更新接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/physicalinterface s/{interfaceUUID}
物理接口模型如下所示:
{
"metadata": {
"supportedSpeed": "TEN_GBPS,ONE_GBPS,TWENTY_FIVE_GBPS,DETECT_SFP",
"mediaType": "sfp",
"sfpType": "none",
"isBreakoutCapable": false,
"isSplitInterface": false,
"timestamp": 1692344434067,
"domain": {
"name": "Global",
"id": "e276abec-e0f2-11e3-8169-**********",
"type": "Domain"
}
},
"type": "PhysicalInterface",
"name": "Ethernet2/2",
"portType": "DATA",
"adminState": "DISABLED",
"hardware": {
"flowControlSend": "OFF",
"fecMode": "AUTO",
"autoNegState": true,
"speed": "DETECT_SFP",
"duplex": "FULL"
},
"LLDP": {
"transmit": false,
"receive": false
},
"id": "*************************************"
}
为了支持子接口管理,引入了这些URL。
获取所有子接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/subinterfaces
通过接口uuid获取特定子接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/subinterfaces/{interfaceUUID}
POST新子接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/subinterfaces
UPDATE interface by interface uuid(通过接口uuid更新接口):
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/subinterfaces/{interfaceUUID}
通过接口uuid删除子接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/subinterfaces/{interfaceUUID}
子接口模型如下所示:
{
"metadata": {
"isBreakoutCapable": false,
"isSplitInterface": false,
"timestamp": 1692536476265,
"domain": {
"name": "Global",
"id": "e276abec-e0f2-11e3-8169-**********",
"type": "Domain"
}
},
"type": "SubInterface",
"name": "Ethernet1/3.3",
"portType": "DATA",
"subIntfId": 3,
"parentInterface": {
"type": "PhysicalInterface",
"id": "00505686-9A51-0ed3-0000-**********",
"name": "Ethernet1/3"
},
"vlanId": 3,
"id": "*************************************"
}
为了支持EtherChannel EtherChannel接口的管理,引入了这些URL。
获取所有etherchannel接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/etherchannelinterfaces/{interfaceUUID}
按接口uuid获取特定etherchannel接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/etherchannelinterfaces/{interfaceUUID}
对新的etherchannel接口执行POST:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/etherchannel接口
UPDATE interface by interface uuid(通过接口uuid更新接口):
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/etherchannelinterfaces/{interfaceUUID}
通过接口uuid删除etherchannel接口:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/etherchannelinterfaces/{interfaceUUID}
EtherChannel接口型号如下所示:
{
"metadata": {
"supportedSpeed": "HUNDRED_MBPS,TEN_MBPS,ONE_GBPS",
"timestamp": 1692536640172,
"domain": {
"name": "Global",
"id": "e276abec-e0f2-11e3-8169-**********",
"type": "Domain"
}
},
"type": "EtherChannelInterface",
"name": "Port-channel45",
"portType": "DATA",
"etherChannelId": 45,
"selectedInterfaces": [
{
"type": "PhysicalInterface",
"id": "00505686-9A51-0ed3-0000-**********",
"name": "Ethernet1/4"
},
{
"type": "PhysicalInterface",
"id": "00505686-9A51-0ed3-0000-**********",
"name": "Ethernet1/5"
}
],
"lacpMode": "ON",
"lacpRate": "FAST",
"adminState": "DISABLED",
"hardware": {
"flowControlSend": "OFF",
"autoNegState": true,
"speed": "ONE_GBPS",
"duplex": "FULL"
},
"LLDP": {
"transmit": true,
"receive": true
},
"id": "00505686-9A51-0ed3-0000-**********"
}
要支持4200系列中的接口分组/加入,可以使用以下URL:
GET :
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/chassisinterfaces/{interfaceUUID}/evaluateoperation
评估接口中断/加入的可行性
POST:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/operational/breakoutinterfaces
中断接口
POST:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/operational/joininterfaces
连接一组断开的接口
1.使用fmcmanagedchassis终端查找FMC受管机箱设备(4200)。
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis
返回FMC受管机箱设备列表以及多实例设备,以及每个设备的ID、名称和型号等详细信息。选择“MULTIINSTANCE”设备。
示例响应:
{
"id": "fcaa9ca4-85e5-4bb0-b049-**********",
"type": "FMCManagedChassis",
"chassisName": "192.168.0.75",
"chassisMode": "MULTIINSTANCE",
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22512/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-**********/chassis/fmcmanagedchassis/fcaa9ca4-85e5-4bb0-b049-**********"
}
}
2.使用接口/物理接口端点检查接口是否支持分流。
只有当“isBreakoutCapable”为true且mediaType为QSFP时,才能进行分流。
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/interfaces
示例响应:
{
"metadata": {
"supportedSpeed": "FORTY_GBPS,DETECT_SFP", >>>>>>>>>
"mediaType": "qsfp", >>>>>>>>>
"sfpType": "none",
"isBreakoutCapable": true, >>>>>>>>>
"breakoutFactor": "4", >>>>>>>>>
"isSplitInterface": false,
"timestamp": 1692344434067,
"domain": {
"name": "Global",
"id": "e276abec-e0f2-11e3-8169-**********",
"type": "Domain"
}
},
"type": "PhysicalInterface",
"name": "Ethernet2/4",
"portType": "DATA",
"adminState": "DISABLED",
"hardware": {
"flowControlSend": "OFF",
"fecMode": "AUTO",
"autoNegState": true,
"speed": "DETECT_SFP",
"duplex": "FULL"
},
"LLDP": {
"transmit": false,
"receive": false
},
"id": "00505686-9A51-0ed3-0000-**********"
}
3.在接口上,使用evaluateoperation endpoint评估break操作的可行性。
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/chassisinterfaces/{interfaceUUID}/evaluateoperation
如果响应中没有警告/错误,用户可以执行中断操作。
示例响应:
如果响应中存在错误,则不允许用户执行中断操作:
{
"operationType": "BREAKOUT",
"interfaceUsages": [
{
"conflictType": "Interface usage on instance(s)",
"severity": "ERROR", >>>>>>>>>
"description": "Interface Ethernet2/4 can not be split. Remove it from instances [FTD1] and try again.\n"
}
],
"readinessState": "NOT_READY", >>>>>>>>>
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22542/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-**********/chassis/fmcmanagedchassis/19d967e6-ef81-4f2e-b311-**********/chassisinterfaces/00505686-662F-0ed3-0000-004294969274/evaluateoperation/00505686-662F-0ed3-0000-**********"
},
"type": "ChassisInterface",
"id": "00505686-662F-0ed3-0000-**********"
}
4.如果接口支持分流,并且就绪状态为“就绪”,请使用分流接口终结点断开接口。
POST /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/operational/breakoutinterfaces
请求:
{
"targetInterfaces": [
{
"id": "***************ed3-0000-004294969276",
"metadata": {
"type": "PhysicalInterface"
}
}
],
"type": "BreakoutInterface"
}
回复 :
{
"id": "4294969716",
"type": "TaskStatus",
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22542/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-**********/job/taskstatuses/4294969716"
},
"taskType": "DEVICE_DEPLOYMENT",
"message": "Deployment status for ************************************: SUCCEEDED",
"status": "Interface notification received"
}
5.使用中断响应中的任务ID跟踪任务完成。将Task状态设置为“Interface Notification received”。
GET /api/fmc_config/v1/domain/{domainUUID}/job/taskstatuses/{objectId}
{
"metadata": {
"task": {
"id": "4294969699",
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22542/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-**********/job/taskstatuses/4294969699"
}
}
},
"targetInterfaces": [
{
"id": "00505686-662F-0ed3-0000-**********",
"type": "PhysicalInterface"
}
],
"type": "BreakoutInterface"
}
{
"id": "4294969716",
"type": "TaskStatus",
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22542/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-**********/job/taskstatuses/4294969716"
},
"taskType": "DEVICE_DEPLOYMENT",
"message": "Deployment status for ************************************: SUCCEEDED",
"status": "Interface notification received"
}
6.使用机箱接口事件终结点获取接口更改。
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/ fmcmanagedchassis/{containerUUID}/chassisinterfaceevents
示例响应:
[
{
"change": "Interface is deleted",
"type": "PhysicalInterface",
"state": "DISASSOCIATED",
"name": "Ethernet2/3"
},
{
"change": "Interface is associated",
"type": "PhysicalInterface",
"state": "ASSOCIATED",
"name": "Ethernet2/3/2"
},
{
"change": "Interface is associated",
"type": "PhysicalInterface",
"state": "ASSOCIATED",
"name": "Ethernet2/3/3"
},
{
"change": "Interface is associated",
"type": "PhysicalInterface",
"state": "ASSOCIATED",
"name": "Ethernet2/3/4"
}
]
7.如果未收到接口通知,请使用机箱接口事件终结点同步设备,并检查是否有挂起的更改。
POST /api/fmc_config/v1/domain/{domainUUID}/devices/devicereces/{containerUUID}/机箱接口事件
请求:
{
"action": "SYNC_WITH_DEVICE"
}
回复 :
{
"action": "SYNC_WITH_DEVICE",
"hasPendingChanges": true
}
8.收到通知后,使用机箱接口事件终结点接受更改。
POST /api/fmc_config/v1/domain/{domainUUID}/devices/devicereces/{containerUUID}/机箱接口事件
请求:
{
"action":"ACCEPT_CHANGES"
}
9.获取所有机箱接口,并使用接口端点查找拆分(中断)接口。
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/interfaces
一个40G接口(例如eth2/2)拆分为4x10G接口 — eth2/2/1、eth2/2/2、eth2/2/3和eth2/2/4
1.使用接口/物理接口终结点检查接口是否已断开。
只有当“isSplitInterface”为true且mediaType为SFP时,才能执行加入操作
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/interfaces
{
"metadata": {
"supportedSpeed": "TEN_GBPS,DETECT_SFP",
"mediaType": "sfp",
"sfpType": "none",
"isBreakoutCapable": false,
"breakoutFactor": "4",
"isSplitInterface": true,
"timestamp": 1692541554935,
"domain": {
"name": "Global",
"id": "e276abec-e0f2-11e3-8169-**********",
"type": "Domain"
}
},
"type": "PhysicalInterface",
"name": "Ethernet2/3/4",
"portType": "DATA",
"adminState": "DISABLED",
"LLDP": {
"transmit": false,
"receive": false
},
"hardware": {
"flowControlSend": "OFF",
"speed": "DETECT_SFP",
"duplex": "FULL",
"fecMode": "AUTO",
"autoNegState": true
},
"id": "00505686-662F-0ed3-0001-**********"
}
2.使用四个拆分接口之一上的evaluateoperation endpoint评估Join操作的可行性。
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/ch assisinterfaces/{interfaceUUID}/evaluateoperation
{
"operationType": "JOIN",
"readinessState": "READY",
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22542/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-**********/chassis/fmcmanagedchassis/19d967e6-ef81-4f2e-b311-**********/chassisinterfaces/00505686-662F-0ed3-0001-**********/evaluateoperation/00505686-662F-0ed3-0001-**********"
},
"type": "ChassisInterface",
"id": "00505686-662F-0ed*******************"
}
{
"operationType": "JOIN",
"interfaceUsages": [
{
"conflictType": "Interface used in EtherChannel Configuration",
"severity": "ERROR",
"description": "Interface (Ethernet2/3/4) referred to in Ether Channel Interface (Port-channel32) configurations will be impacted due to the JOIN operation."
}
],
"readinessState": "NOT_READY",
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22542/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-*********/chassis/fmcmanagedchassis/19d967e6-ef81-4f2e-b311-********/chassisinterfaces/00505686-662F-0ed3-0001-692539698200/evaluateoperation/00505686-662F-0ed3-0001-***********"
},
"type": "ChassisInterface",
"id": "00505686-662F-0ed*******************"
}
3.如果接口已断开,并且就绪状态为“就绪”,请使用联合接口终结点加入接口。Interface_uuid可以是4个中断接口中任意一个的ID。
POST/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/operational/joininterfaces
请求:
{
"targetInterfaces": [
{
"id": "***************ed3-0001-692539698200",
"type": "PhysicalInterface"
}
],
"type": "JoinInterface"
}
回复 :
{
"metadata": {
"task": {
"id": "4294970217",
"links": {
"self": "/api/fmc_config/v1/domain/e27"***************-8169-6d9ed49b625f/job/taskstatuses/4294970217"
}
}
},
"targetInterfaces": [
{
"id": "***************ed3-0001-692539698200",
"type": "PhysicalInterface"
},
{
"id": "***************ed3-0001-692539698201",
"type": "PhysicalInterface"
},
{
"id": "***************ed3-0001-692539698202",
"type": "PhysicalInterface"
},
{
"id": "***************ed3-0001-692539698203",
"type": "PhysicalInterface"
}
],
"type": "JoinInterface"
}
4.使用加入响应中的任务ID跟踪任务完成。将Task状态设置为“Interface Notification received”。
GET /api/fmc_config/v1/domain/{domainUUID}/job/taskstatuses/{objectId}
回复 :
{
"id": "4294970237",
"type": "TaskStatus",
"links": {
"self": "https://u32c01p06-vrouter.cisco.com:22542/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/job/taskstatuses/4294970237"
},
"taskType": "SSP_EPM_OIR",
"message": "Deployment status for 19d967e6-xxxx-xxxx-xxxx-85ff6cef6d3f: SUCCEEDED",
"status": "Interface notification received"
}
5.使用机箱接口事件终结点获取接口更改。
GET /api/fmc_config/v1/domain/{domainUUID}/devices/devicereces/{containerUUID}/chassisinterfaceevents
回复 :
[
{
"change": "Interface is associated",
"type": "PhysicalInterface",
"state": "ASSOCIATED",
"name": "Ethernet2/3"
},
{
"change": "Interface is deleted",
"type": "PhysicalInterface",
"state": "DISASSOCIATED",
"name": "Ethernet2/3/1"
},
{
"change": "Interface is deleted",
"type": "PhysicalInterface",
"state": "DISASSOCIATED",
"name": "Ethernet2/3/2"
},
{
"change": "Interface is deleted",
"type": "PhysicalInterface",
"state": "DISASSOCIATED",
"name": "Ethernet2/3/3"
},
{
"change": "Interface is deleted",
"type": "PhysicalInterface",
"state": "DISASSOCIATED",
"name": "Ethernet2/3/4"
}
]
6.如果未收到接口通知,请使用机箱接口事件终结点同步设备,并检查是否有挂起的更改。
POST /api/fmc_config/v1/domain/{domainUUID}/devices/devicereces/{containerUUID}/chassisinterfaceevents
请求:
{
"action":"SYNC_WITH_DEVICE"
}
回复 :
{
"action":"SYNC_WITH_DEVICE",
"hasPendingChanges":true
}
7.收到通知后,使用机箱接口事件终结点接受更改。
POST /api/fmc_config/v1/domain/{domainUUID}/devices/devicerecories/{containerUUID}/chassisinterfac eevents
请求:
{
"action":"ACCEPT_CHANGES"
}
8.获取所有机箱接口,并使用接口终端查找连接的接口和其他接口。
GET /api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/interfaces
假设eth2/2/1在10G接口上发起加入,则响应中会提供40G接口eth2/2。
为了支持网络模块和接口的同步,引入了这些URL。
POST:
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/chassisinterface events
带负载
{“操作”:"SYNC_WITH_DEVICE"} - >触发同步
{“操作”:"ACCEPT_CHANGES"} - >接受更改
GET :
/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/chassisinterface events
列出生成的已更改事件
如果注册失败,这些FXOS CLI可用于检查sftunnel、sfipproxy进程是否已启动。
firepower# connect local-mgmt
firepower-4215(local-mgmt)# show processes | include sftunnel grep: (standard input): binary file matches
3323 root 20 0 80328 2024 1544 S 0.0 0.0 0:11.53 /opt/cisco/sftunnel/sfipproxy -d –f /etc/sf/sfipproxy.conf
22066 root 20 0 376880 7140 5944 S 0.0 0.0 0:41.18 /opt/cisco/sftunnel/sftunnel -d -f /etc/sf/sftunnel.conf
如果使用终端控制台进行CLI,请使用以下CLI将终端宽度设置为适当的值,以确保show processes的输出不会被截断:
firepower-4215(local-mgmt)# terminal width 100
如果SFTunnel进程已启动且正在运行,但注册失败,则可以使用这些命令查找失败的任何潜在原因。
在FXOS中从connect local-mgmt引入新的CLI以查看/opt/cisco/platform/logs/sfmessages中的系统日志消息
firepower# connect local-mgmt
firepower(local-mgmt)# tail-mgmt-log sfmessages
Dec 9 18:31:17 firepower Ipc [30483]: add ep: 1,0x5613aa0e2fe8 total = 1
Dec 9 18:31:17 firepower Ipc [30483]: add ep: 1,0x5613aa0ec528 total = 2
Dec 9 18:31:17 firepower Ipc [30483]: add ep: 1,0x5613aa0f5ea8 total = 3
Dec 9 18:31:18 firepower SF-IMS[12621]: [12625] sftunneld:SYNC_PROC [INFO] Change in directory /var/sf/sync detected (0 vs 1670610348)
FMC支持从设备管理页面生成机箱故障排除(FPRM)。
机箱故障排除选项和生成:
机箱故障排除进度和下载:
问题:在FMC中机箱自动注册失败。
预期结果:
实际结果:
1.支票兑换:
firepower# scope sys
firepower /system # show
Systems:
Name Mode Deploy Mode System IP Address System IPv6 Address
---------- ----------- ----------- ----------------- -------------------
firepower Stand Alone Container 192.168.xx.xx ::
2.检查设备管理器:
firepower# show device-manager
Device manager:
Name: manager
Hostname: 10.10.xx.xx
NAT id: 3ab4bb1a-d723-11ee-a694-89055xxxxxxx
Registration Status: Completed
Error Msg:
3.1.导航至/var/opt/CSCOpx/MDC/log/operation/vmssharedsvcs.log和/var/opt/CSCOpx/MDC/log/operation/usmsharedsvcs.log
3.2.在文件中搜索关键字“NATIVE_TO_MI_CONVERSION”和“CHASSIS DISCOVERY”,查找失败原因。
问题:FMC中的实例自动注册失败。
预期结果:
实际结果:
ps -ef | grep -i "sftunnel”
pmtool restartById sftunnel
问题:将设备转换回本机模式后,FMC中的本机设备注册失败
configure network ipv4 manual 192.168.0.xx 255.255.255.0 192.168.0.1 management1
版本 | 发布日期 | 备注 |
---|---|---|
1.0 |
29-Oct-2024
|
初始版本 |