FTD · FOUNDATIONS

FTD-style: DNS and time on a standalone firewall

FTD1 runs from its own device manager, and traffic works. But a firewall also needs names and the right time: licences, certificates and log times depend on the clock, and NTP servers are often given by name. Out of the box its DNS and NTP servers are on the Internet, and this lab has no Internet. NS1 (10.0.0.53), on the management network, is a DNS server for lab.test and an NTP server.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On FTD1, see the problem: show ntp (or Device Manager: System Settings, Time Services) says the default servers are unavailable, and ping system ns1.lab.test cannot resolve the name.
DNS Server page: a DNS group LAB-DNS with server 10.0.0.53 and the domain search name lab.test, used by the management interface. Deploy. ping system ns1 now resolves ns1.lab.test (the search domain is added) and reaches 10.0.0.53.
Time Services page: User Defined NTP server 10.0.0.53. Deploy. show ntp says Being Used.
Time zone UTC+05:00, deployed. show clock shows it.

Start this lab

Before you start

Both DNS and NTP for the device itself go over the management interface, so the servers must be reachable from Management0/0: ping system 10.0.0.53. A name without a dot gets the search domain first. On NS1, show dns-server lists the queries it answered, and show ntp-server its clients. On the console, every page is also fdm : fdm dns-group, fdm dns management, fdm ntp servers, fdm time-zone.

Concept

A firewall needs names and the right time

A firewall resolves names for itself over its management interface (NTP server names, updates, licensing) and, separately, on its data interfaces. It keeps time by NTP, also over the management interface. Licences, certificates and log times depend on the clock. The defaults point to the Internet, so a site without it needs its own servers.

Concept

A managed firewall takes its policy from a manager

An FTD-style firewall has a console for showing and testing, and it refuses configuration. Its policy lives on a manager and arrives by deployment. Before that, the two must register over a separate management network: each needs an address, the firewall names its manager and a key, and the manager adds the device with the same key.