FTD · FOUNDATIONS

FTD-style: register a firewall with its manager

An FTD-style firewall is managed. Its console shows and tests, and its policy comes from a manager. Before anything else, the two must find and trust each other, over a separate management network: MGR1 and FTD1’s Management0/0 are both on switch SWM. Try configure terminal on FTD1 first, and read why it refuses.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On MGR1: give the manager the address 10.0.0.5/24 (configure network ipv4 manual 10.0.0.5 255.255.255.0, or Device Management in FTD Manager).
On FTD1: give the management interface 10.0.0.2/24 (configure network ipv4 manual 10.0.0.2 255.255.255.0). MGR1 can now ping it. From FTD1, test the same path with ping system 10.0.0.5: a plain ping uses the data interfaces, which have no addresses yet.
On FTD1: name the manager and a registration key: configure manager add 10.0.0.5 LABKEY. show managers says Pending.
On MGR1: add the device. In FTD Manager (select MGR1, Open FTD Manager): Devices, Add, Device: step 1 Registration key and Basic, Next; step 2 Hostname or IP address 10.0.0.2, Display name FTD1, Registration key LABKEY, Next; step 3 Access control policy (+ Create a new policy, Block all traffic), Add device. Or type device add FTD1 host 10.0.0.2 key LABKEY. show managers on FTD1 says Completed.

Start this lab

Before you start

The manager checks each step and names what is missing: an address, reachability, the manager’s address on the firewall, or the key. The key is only for this first handshake, and the logs hide it. On FTD1, ping tests the data interfaces and ping system tests the management interface, so the management network answers only to ping system. Press Open FTD Manager with MGR1 selected to use the screens.

Concept

A managed firewall takes its policy from a manager

An FTD-style firewall has a console for showing and testing, and it refuses configuration. Its policy lives on a manager and arrives by deployment. Before that, the two must register over a separate management network: each needs an address, the firewall names its manager and a key, and the manager adds the device with the same key.