Modify the Firewall Threat Defense Data Interface Used for Management at the CLI
If the management connection between the Firewall Threat Defense and the Firewall Management Center was disrupted, and you want to specify a new data interface to replace the old interface, use the Firewall Threat Defense CLI to configure the new interface. This procedure assumes you want to replace the old interface with a new interface on the same network. If the management connection is active, then you should make any changes to an existing data interface using the Firewall Management Center. For initial setup of the data management interface, see the configure network management-data-interface command.
For high-availability pairs, perform all CLI steps on both units. Within the Firewall Management Center, perform steps only on the active unit. Once the configuration changes are deployed, the standby unit synchronizes configuration and other state information from the active unit.
|
This topic applies to the data interface that you configured for Management, not the dedicated Management interface. If you want to change network settings for the Management interface, see Modify Firewall Threat Defense Management Interfaces at the CLI. |
For information about the Firewall Threat Defense CLI, see the Cisco Secure Firewall Threat Defense Command Reference.
Before you begin
You can create user accounts that can log into the CLI using the configure user add command. You can also configure AAA users according to External Authentication.
Procedure
| 1 |
If you are changing the data management interface to a new interface, move the current interface cable to the new interface. |
| 2 |
Connect to the device CLI. You should use the console port when using these commands. If you are performing initial setup, then you may be disconnected from the Management interface. If you are editing the configuration due to a disrupted management connection, and you have SSH access to the dedicated Management interface, then you can use that SSH connection.
|
| 3 |
Log in with the Admin username and password. |
| 4 |
Disable the interface so you can reconfigure its settings. configure network management-data-interface disable
|
| 5 |
Configure the new data interface for manager access. configure network management-data-interface You are then prompted to configure basic network settings for the data interface. When you change the data management interface to a new interface on the same network, use the same settings as for the previous interface except the interface ID. In addition, for the Do you wish to clear all the device configuration before applying ? (y/n) [n]: option, choose y. This choice will clear the old data management interface configuration, so that you can successfully reuse the IP address and interface name on the new interface.
|
| 6 |
(Optional) Limit data interface access to the Firewall Management Center on a specific network. configure network management-data-interface client ip_address netmask By default, all networks are allowed. |
| 7 |
The connection will be reestablished automatically, but disabling and reenabling the connection in the Firewall Management Center will help the connection reestablish faster. See Update the Hostname or IP Address in the Firewall Management Center. |
| 8 |
Check that the management connection was reestablished. sftunnel-status-brief See the following sample output for a connection that is up, with peer channel and heartbeat information shown:
|
| 9 |
In the Firewall Management Center, choose , and click Refresh. The Firewall Management Center detects the interface and default route configuration changes, and blocks deployment to the Firewall Threat Defense. When you change the data interface settings locally on the device, you must reconcile those changes in the Firewall Management Center manually. You can view the discrepancies between the Firewall Management Center and the Firewall Threat Defense on the Configuration tab. |
| 10 |
Choose , and make the following changes. |
| 11 |
Choose and change the default route from the old data management interface to the new one. |
| 12 |
Return to the Manager Access - Configuration Details dialog box, and click Acknowledge to remove the deployment block. The next time you deploy, the Firewall Management Center configuration will overwrite any remaining conflicting settings on the Firewall Threat Defense. It is your responsibility to manually fix the configuration in the Firewall Management Center before you re-deploy. You will see expected messages of "Config was cleared” and “Manager access changed and acknowledged.” |