Install a Firewall Manager Connector to Support an SEC Using Your VM Image

The Firewall Manager Connector VM is a virtual machine on which you install an SEC. The purpose of the Firewall Manager Connector is solely to support an SEC for Cisco Security Analytics and Logging (SaaS) customers.

This is the first of three steps you need to complete in order install and configure your Secure Event Connector (SEC). After this procedure, you need to complete the following procedures:

Before you begin

Purchase the Cisco Security and Analytics Logging, Logging and Troubleshootinglicense, you may also purchase the Logging Analytics and Detection and Total Network Analytics and Monitoring licenses to apply Secure Cloud Analytics to the events.

If you would rather, you can request a trial version of Security Analytics and Logging by logging in to Firewall Manager, and on the main navigation bar, choose Events & Logs > Events > Event Logging and click Request Trial.
Firewall Manager requires strict certificate checking and does not support a Web/Content Proxy between the Firewall Manager Connector and the Internet.
The Firewall Manager Connector must have full outbound access to the Internet on TCP port 443.
Review Connect to Security Cloud Control Firewall Management using Secure Device Connector to ensure proper network access for the Firewall Manager Connector.
VMware ESXi host installed with vCenter web client or ESXi web client.

We do not support installation using the vSphere desktop client.
ESXi 5.1 hypervisor.
Ubuntu 22.04 and Ubuntu 24.04.
System requirements for a VM to host only a Firewall Manager Connector and an SEC:
- CPU: Assign 4 CPUs to accommodate the SEC.
- Memory: Assign 8 GB of memory for the SEC.
- Disk Space: 64 GB
Users performing this procedure should be comfortable working in a Linux environment and using the vi visual editor for editing files.
Gather this information before you begin the installation:
- Static IP address you want to use for your Firewall Manager Connector.
- Passwords for the root and Firewall Manager users that you create during the installation process.
- The IP address of the DNS server your organization uses.
- The gateway IP address of the network the Firewall Manager Connector address is on.
- The FQDN or IP address of your time server.
The Firewall Manager Connector virtual machine is configured to install security patches on a regular basis and in order to do this, opening port 80 outbound is required.
Before you get started: Do not copy and paste the commands in this procedure into your terminal window, type them instead. Some commands include an "n-dash" and in the cut and paste process, these commands can be applied as an "m-dash" and that may cause the command to fail.

Procedure

Log on to Firewall Manager.

In the Security Cloud Control platform menu, choose Products > Firewall.

From the left pane, Administration > Secure Connectors.

Click the icon and then click Secure Event Connector.

Using the link provided, copy the SEC Bootstrap Data in step 2 of the "Deploy an On-Premises Secure Event Connector" window.

Once installed, configure basic networking such as specifying the IP address for the Firewall Manager Connector, the subnet mask, and gateway.

Configure a DNS (Domain Name Server) server.

Configure a NTP (Network Time Protocol) server.

Install an SSH server for easy interaction with Firewall Manager Connector's CLI.

Install the AWS CLI package ( https://docs.aws.amazon.com/cli/latest/userguide/awscli-install-linux.html)

Do not use the --user flag.

Install the Docker CE packages ( https://docs.docker.com/install/linux/docker-ce/centos/#install-docker-ce)

Use the "Install using the repository" method.

Start the Docker service and enable it to start on boot:

[root@sdc-vm ~]# systemctl start docker
 [root@sdc-vm ~]# systemctl enable docker 
Created symlink from /etc/systemd/system/multiuser.target.wants/docker.service to /usr/lib/systemd/system/docker.service.

Create two users: Firewall Manager and sdc. The Firewall Manager user will be the one you log-into to run administrative functions (so you don't need to use the root user directly), and the sdc user will be the user to run the Firewall Manager Connector docker container.

[root@sdc-vm ~]# useradd
                    Firewall Manager
                    
                    
                  
 [root@sdc-vm ~]# useradd sdc –d /usr/local/
                    Firewall Manager

Configure the sdc user to use crontab:

[root@sdc-vm ~]# touch /etc/cron.allow
[root@sdc-vm ~]# echo "sdc" >> /etc/cron.allow

Set a password for the Firewall Manager user.

[root@sdc-vm ~]# passwd
                    Firewall Manager
                    
                    
                   
Changing password for user 
                    Firewall Manager
                    
                    
                  . 
New password: <type password>  
Retype new password: <type password> 
passwd: all authentication tokens updated successfully.

Add the Firewall Manager user to the "wheel" group to give it administrative (sudo) privileges.

[root@sdc-vm ~]# usermod -aG wheel
                    Firewall Manager
                    
                    
                  
 [root@sdc-vm ~]#

When Docker is installed, there is a user group created. Depending on the version of CentOS/Docker, this may be called either "docker" or "dockerroot". Check the /etc/group file to see which group was created, and then add the sdc user to this group.


 [root@sdc-vm ~]# grep docker /etc/group 
docker:x:993:
[root@sdc-vm ~]# 
[root@sdc-vm ~]# usermod -aG docker sdc 
[root@sdc-vm ~]#

If the /etc/docker/daemon.json file does not exist, create it, and populate with the contents below. Once created, restart the docker daemon.

Make sure that the group name entered in the "group" key matches the group you found in the /etc/group file.

 [root@sdc-vm ~]# cat /etc/docker/daemon.json 
{
 "live-restore": true, 
 "group": "docker" 
} 
[root@sdc-vm ~]# systemctl restart docker 
[root@sdc-vm ~]#

If you are currently using a vSphere console session, switch over to SSH and log in as the Firewall Manager user. Once logged in, change to the sdc user. When prompted for a password, enter the password for the Firewall Manager user.

[
                    Firewall Manager
                    
                    
                  @sdc-vm ~]$ sudo su sdc 
[sudo] password for 
                    Firewall Manager
                    
                    
                  : <type password for
                    Firewall Manager
                    
                    
                  user > 
[sdc@sdc-vm ~]$

Change directories to /usr/local/Firewall Manager.

Create a new file called bootstrapdata and paste the bootstrap data from Step 1 of the deployment wizrd into this file. Save the file. You can use vi or nano to create the file.

The bootstrap data comes encoded in base64. Decode it and export it to a file called extractedbootstrapdata

 [sdc@sdc-vm ~]$ base64 -d /usr/local/
                    Firewall Manager
                    
                    
                  /bootstrapdata > /usr/local/
                    Firewall Manager
                    
                    
                  /extractedbootstrapdata 
[sdc@sdc-vm ~]$

Run the cat command to view the decoded data. The command and decoded data should look similar to this:

[sdc@sdc-vm ~]$ cat /usr/local/
                    Firewall Manager
                    
                    
                  /extractedbootstrapdata
                    Firewall Manager
                    
                    
                  _TOKEN="<token string>" 

                    Firewall Manager
                    
                    
                  _DOMAIN="www.defenseorchestrator.com" 

                    Firewall Manager
                    
                    
                  _TENANT="<tenant-name>" 
<
                    Firewall Manager
                    
                    
                  _URL>/sdc/bootstrap/
                    Firewall Manager
                    
                    
                  _acm="https://www.defenseorchestrator.com/sdc/bootstrap/tenant-name/<tenant-name-SDC>" 
ONLY_EVENTING="true"

Run the following command to export the sections of the decoded bootstrap data to environment variables.


[sdc@sdc-vm ~]$ sed -e 's/^/export /g' extractedbootstrapdata > secenv && source secenv 
[sdc@sdc-vm ~]$

Download the bootstrap bundle from Firewall Manager.

 [sdc@sdc-vm ~]$ curl -H "Authorization: Bearer $
                    Firewall Manager
                    
                    
                  _TOKEN" "$
                    Firewall Manager
                    
                    
                  _BOOTSTRAP_URL" -o $
                    Firewall Manager
                    
                    
                  _TENANT.tar.gz 
100 10314 100 10314 0 0 10656 0 --:--:-- --:--:-- --:--:-- 10654 
[sdc@sdc-vm ~]$ ls -l /usr/local/
                    Firewall Manager
                    
                    
                  /*SDC 
-rw-rw-r--. 1 sdc sdc 10314 Jul 23 13:48 /usr/local/
                    Firewall Manager
                    
                    
                  /
                    Firewall Manager
                    
                    
                  _<tenant_name>

Extract the Firewall Manager Connector tarball, and run the bootstrap_sec_only.sh file to install the Firewall Manager Connector package.

 [sdc@sdc-vm ~]$ tar xzvf /usr/local/
                    Firewall Manager
                    
                    
                  /tenant-name-SDC 
<snipped – extracted files> 
[sdc@sdc-vm ~]$ 
[sdc@sdc-vm ~]$ /usr/local/
                    Firewall Manager
                    
                    
                  /bootstrap/bootstrap_sec_only.sh 
[2018-07-23 13:54:02] environment properly configured 
download: s3://onprem-sdc/toolkit/prod/toolkit.tar to toolkit/toolkit.tar 
toolkit.sh 
common.sh 
es_toolkit.sh 
sec.sh 
healthcheck.sh 
troubleshoot.sh 
no crontab for sdc 
-bash-4.2$ crontab -l 
*/5 * * * * /usr/local/
                    Firewall Manager
                    
                    
                  /toolkit/es_toolkit.sh upgradeEventing 2>&1 >> /usr/local/
                    Firewall Manager
                    
                    
                  /toolkit/toolkit.log 
0 2 * * * sleep 30 && /usr/local/
                    Firewall Manager
                    
                    
                  /toolkit/es_toolkit.sh es_maintenance 2>&1 >> /usr/local/
                    Firewall Manager
                    
                    
                  /toolkit/toolkit.log 
You have new mail in /var/spool/mail/sdc

What to do next

Continue to Additional Configuration for SDCs and Firewall Manager Connectors Installed on a VM You Created .

Previous topic Install an SEC Using Your VM Image Next topic Additional Configuration for SDCs and Firewall Manager Connectors Installed on a VM You Created