FTD · FOUNDATIONS

FTD-style: give a new FTD Manager its management address

A new management center starts with a default address (192.168.45.45) that is not on your network, and its web interface can be reached only once it has the right one. As on an FMC 10.x, its > prompt has no command for the address (configure network has only dns): you set it from the expert shell, as root, with configure-network, which asks its questions one at a time. MGR1 is the new manager, and ADM is your admin PC on the management network. RouteBuddy skips the login and passwords.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On MGR1’s console: show network (no address yet). Then expert, sudo su, and /usr/local/sf/bin/configure-network. Answer: configure IPv4 y; address 10.0.0.5; netmask 255.255.255.0; gateway 10.0.0.1; correct y; configure IPv6 n. Check it with ip route get 1, then exit twice, show network and show network dns router.
On ADM: https 10.0.0.5 reaches FTD Manager’s login page.
In the web interface (select MGR1, Open FTD Manager): System › Management Interfaces, Shared Settings: Domains lab.test, Primary DNS Server 10.0.0.53. Apply, then Send. (On the > prompt: configure network dns servers 10.0.0.53.)
The manager is not registered with Smart Licensing, so it adds no firewall yet: try Devices › Device Management › Add › Device. Then System › Smart Licenses: Evaluation Mode, Send. (Console: smart-license evaluation.)

Start this lab

Before you start

Each answer is one line: press Enter to keep the value in brackets. Answer n to "Are these settings correct?" to go round again. ip route get 1 shows the way out (via the gateway, from eth0); an address on the management network goes straight out of eth0. Once the manager has its address, its firewalls register to it, and a later change must be told to each of them (configure manager edit). On a real FMC the address can also come from DHCP, and the Management Interfaces page can change it later, which can cut off your browser.

Concept

A managed firewall takes its policy from a manager

An FTD-style firewall has a console for showing and testing, and it refuses configuration. Its policy lives on a manager and arrives by deployment. Before that, the two must register over a separate management network: each needs an address, the firewall names its manager and a key, and the manager adds the device with the same key.

Concept

The screens and the console do the same thing

A manager’s screens are forms that produce configuration lines. Here every screen shows those lines before it sends them, and the console takes the same lines, so either way gives the same result. A managed firewall’s own management address and manager stay on its console, because the manager reaches it through them.