FTD · TROUBLESHOOT

FTD-style: the firewall lost its manager after the move

Someone moved FTD1’s manager access to its outside interface and then unplugged Management0/0: this branch has no management network. Now MGR1 shows FTD1 as unreachable, and nothing can be deployed. Find out why from FTD1’s own console, and fix it there.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 3 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On MGR1, open the Device page for FTD1 (or show device FTD1) and read the connection status.
On FTD1, check the manager connection and the management settings: sftunnel-status-brief and show network.
Fix it on FTD1, then prove MGR1 manages FTD1 again: sftunnel-status-brief shows connected, and a deploy from MGR1 succeeds.

Start this lab

Before you start

Manager access is deployed on outside and the Remote Host Address is right. What does Management0/0’s gateway say? While it is not data-interfaces, FTD1 still sends its manager traffic out a port with no cable.

Concept

Manager access: Management0/0 or a data interface

A managed firewall talks to its manager over one connection (sftunnel, port 8305). It starts on Management0/0, whose br1 side carries manager traffic while its diagnostic side is the data plane’s management-only interface. A firewall with no management network can move that connection to one routed data interface instead. The firewall’s management port keeps a static address, and its gateway becomes data-interfaces: manager traffic then crosses the internal tap_nlp interface to that data interface.