topic Re: Firepower integrated with public cloud in Network Security

Firepower integrated with public cloud

peter.peng — Tue, 12 Mar 2019 14:10:30 GMT

Hi Sir:

When I want to integrated with public cloud. I can't link to public cloud. I had tried to ping below server. But I just can ping to one server. I had confimed with FW. The policy from inside to outside is permit all. Could you help to find the root cause ? Thanks

Re: Firepower integrated with public cloud

Francesco Molino — Fri, 14 Dec 2018 04:32:03 GMT

Hi

The Cloud server fqdn is cloud-ec.amp.cisco.com

Take a look on this documentation:
https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html

Your firewall should let passes tcp-443 towards AMP Cloud servers.
You can validate it doing the following command on your firewall:
packet-tracer input inside tcp a.b.c.d 12345 e.f.g.h 443 detail
- a.b.c.d is your fmc ip
- e.f.g.h is public ip of AMP Cloud server
- inside is your zone where fmc sits in (LAN)

Re: Firepower integrated with public cloud

peter.peng — Fri, 14 Dec 2018 05:45:13 GMT

Hi Sir:

I can't find this command. You can refer to below information. I can't type any IP address after https.

I had confirmed the FTD policy rule. From inside to outside, we permit any to any.

So I think we should not confirm the traffic from inside to Cisco cloud.

Re: Firepower integrated with public cloud

Abheesh Kumar — Fri, 14 Dec 2018 07:00:05 GMT

Hi,
enter below commads
system support diagnostic-cli
enable
Then enter, type the packet tracer command

Packet-tracer input INSIDE_INTERFACE tcp 192.168.0.120 443 8.8.8.8 443

below is the cli commad reference guide for FTD

https://www.cisco.com/c/en/us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense/dr.html

Hope This Helps

Abheesh

Re: Firepower integrated with public cloud

Francesco Molino — Fri, 14 Dec 2018 13:47:13 GMT

On your command you forgot the end as I gave you in my previous post: e.f.g.h 443

Re: Firepower integrated with public cloud

peter.peng — Fri, 14 Dec 2018 15:31:09 GMT

Hi Sir:

I had found the root cause and fixed it. But I had tried to type the command that you suggested. But I can't type it. You can refer to below photo.

I can't type the destination IP address,it just can type the MAC address.

Re: Firepower integrated with public cloud

Francesco Molino — Sat, 15 Dec 2018 05:55:36 GMT

Your interface is really need inside_interface?

Anyways, what was your issue?

Re: Firepower integrated with public cloud

peter.peng — Sun, 16 Dec 2018 04:34:04 GMT

Hi Sir:

Root Cause:

When I setup the public cloud. I choose the "Use for AMP for Firepower"