FTD · BUILD

FTD-style: manage the firewall through a data interface

FTD1 is registered over its Management0/0 port. Many branch firewalls have no separate management network, so the manager reaches them through a data interface instead. MGR1 sits behind R1, so it can reach FTD1’s outside interface. Move manager access to outside, in the order the move must happen: change the manager, deploy while the old path still works, then switch the firewall and the manager’s address for it.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 5 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On MGR1, set manager access for FTD1 to the data interface outside (Device page → Change manager access, or tick Manager Access on outside’s interface form; console: device access FTD1 data outside). Only one physical, routed data interface can have it.
FTD1 must be able to route to MGR1 through outside: add a static route on FTD1 to 10.0.0.0/24 via 203.0.113.2.
Deploy, while Management0/0 still carries the connection. FTD1’s show running-config sftunnel now shows the manager access lines.
On FTD1: keep a static management address, and set its gateway to data-interfaces: configure network ipv4 manual 10.0.0.2 255.255.255.0 data-interfaces. The manager now shows FTD1 as not connected, and says why.
On MGR1, update FTD1’s Remote Host Address to 203.0.113.1 (Device page: turn Management off, edit the Remote Host Address, turn Management on; or device management FTD1 off, device host FTD1 203.0.113.1, device management FTD1 on). On FTD1, sftunnel-status-brief shows the connection over tap_nlp.

Start this lab

Before you start

The order matters: deploying is what tells FTD1 which data interface carries manager traffic, and a deploy needs the connection that still works. In between, the manager names the one step left. show network, show nat (the internal nlp_int_tap rule), show interface detail and ping system 10.0.0.5 all show the new path. Don’t delete the manager on FTD1 during the move. SSH on data interfaces (Platform Settings) is not modelled here.

Concept

Manager access: Management0/0 or a data interface

A managed firewall talks to its manager over one connection (sftunnel, port 8305). It starts on Management0/0, whose br1 side carries manager traffic while its diagnostic side is the data plane’s management-only interface. A firewall with no management network can move that connection to one routed data interface instead. The firewall’s management port keeps a static address, and its gateway becomes data-interfaces: manager traffic then crosses the internal tap_nlp interface to that data interface.

Concept

A managed firewall takes its policy from a manager

An FTD-style firewall has a console for showing and testing, and it refuses configuration. Its policy lives on a manager and arrives by deployment. Before that, the two must register over a separate management network: each needs an address, the firewall names its manager and a key, and the manager adds the device with the same key.