topic Re: FTD: Need to Change MGMT IP in Network Security

FTD: Need to Change MGMT IP

Piyush_Sharma — Fri, 21 Feb 2020 16:00:51 GMT

Hi,

I need to change the management IP of both FTD running in HA and FMC will be the same.

Please suggest how to do it best way, as after de-registering from previously IP from FMC, we need to re-register to FMC with new IP.

Re: FTD: Need to Change MGMT IP

Rodrigo Gurriti — Wed, 25 Jul 2018 15:15:10 GMT

I would:

1 - Place the HA in maintenance to suspend them up. ( do not break because that will erase the failover config)

2- delete the manager from the FTD:

configure manager delete

3 - remove the device from FMC

Devices > Device Management

4 - change the IPs of the FTD:

configure network ipv4 manual ipaddr netmask gw [ management_interface]

5 - Add the manager back on FTD:

configure manager add

6 - Add the FTD to the FMC and reply the configuration.

Devices > Device Management

7 - When you re-deploy your policies there will be a traffic interruption. I would do this during a maintenance window.

I haven't seen any documentation on Cisco's website for this procedure.

Re: FTD: Need to Change MGMT IP

Piyush_Sharma — Fri, 27 Jul 2018 05:05:12 GMT

HI Rodrigo Gurriti,

While re-adding the device to FMC againg HA-needs to be configured...??

Will FMC automatically detect the HA..??? i just need to add both device..???

Re: FTD: Need to Change MGMT IP

Shinhas.Shajahan — Tue, 24 Dec 2019 11:43:47 GMT

Wow. It worked well. Many thanks

Re: FTD: Need to Change MGMT IP

brandonbittinger — Thu, 26 Dec 2019 19:09:28 GMT

Does the act of deleting the manager from the FTD device cause the device to loose its configuration? The way you worded your steps it sounds like the answer is no (which is great!) but I just wanted to verify. If the only traffic interruption you get it from the policy redeployment and there is no need to reconfigure all of the interfaces that is actually a very seamless process. I am in a similar situation and will need to do this myself soon.

Re: FTD: Need to Change MGMT IP

Rob Ingram — Thu, 26 Dec 2019 19:25:36 GMT

Hi @brandonbittinger

The command "configure manager delete" resets the FTD configuration to default, so completely removes the FTD configuration (access control policies, data interfaces etc). The management interface configuration is not removed.

Reference here.

HTH

Re: FTD: Need to Change MGMT IP

John Hinckley — Wed, 19 Feb 2020 23:23:12 GMT

Hi Rodrigo - How do you put an HA pair into "maintenance mode"? I can't find that anywhere in the documentation and I don't see anything in the GUI about maintenance mode.

Also, you can't remove a device from FMC that has VPN config applied. Sadly, you can't unapply the config, you can only delete it. Make sure you have the settings handy because you will be reconfiguring all the VPN tunnels.

Re: FTD: Need to Change MGMT IP

Marvin Rhoads — Thu, 20 Feb 2020 12:18:25 GMT

Try this method instead:

1. Disable management of the device in FMC. Do that via Device Management > edit the Device > Device tab > move slider next to management section.

2. Change the address on the device directly using "configure network ..." command from the cli.

3. Edit the management address in FMC from the same place you disabled management. Then move the slider back to enable management.

Re: FTD: Need to Change MGMT IP

John Hinckley — Tue, 25 Feb 2020 18:38:53 GMT

Marvin - This actually worked nicely, thanks! The problem I have now is that I need to change the IP of the FMC but idk how to do it without breaking the sensor comms to the FMC. Any ideas?

Hopefully this is relevant enough to the OP. Don't want to hijack the thread. =]

Re: FTD: Need to Change MGMT IP

Marvin Rhoads — Wed, 26 Feb 2020 11:53:50 GMT

As far as I know, changing the FMC address will require you to "configure manager delete" on the managed devices, change the address on FMC, "configure manager add" using the new address on the devices and then redeploy from FMC to sync everything.

If this is production, I'd definitely recommend raising a TAC case as my information is based on general understanding of the product and not any published procedure.

Re: FTD: Need to Change MGMT IP

Cristian Matei — Wed, 26 Feb 2020 13:59:27 GMT

Hi,

You can't do it without breaking the communication between the sensor and the manager. Is the FMC configured on the sensor only via the IP address, or do you also have the hostname configured?

Regards,

Cristian Matei.

Re: FTD: Need to Change MGMT IP

John Hinckley — Wed, 26 Feb 2020 21:27:49 GMT

Cristian,
I see where you're going with this and unfortunately it's configured using the IP. I always use IPs for the device communication because I've run into problems before using DNS. Kinda surprised that Cisco wouldn't code in a way to change the manager IP on the sensor. I can't be the only person needing to make a subnet change.

Re: FTD: Need to Change MGMT IP

Furqan Khan — Tue, 24 Mar 2020 20:02:43 GMT

only version 6.5 and later have the ability to change the FMC IP...you have to have delete the FTD from FMC first onearlier versions!!

Re: FTD: Need to Change MGMT IP

Rodrigo Gurriti — Tue, 05 May 2020 19:36:06 GMT

One last update.
If you need to change the management IP address from the FMC, but you dont want to lose the configuration on the FTD you need to visit the FMC and go to the FTD device page and disable management of it. Then go to the FTD device and change your IP address. Then go back to the FMC on the same FTD device page you want to change the management IP then enable the management.

Re: FTD: Need to Change MGMT IP

Shinhas.Shajahan — Thu, 28 May 2020 15:27:58 GMT

Delete the manager from the FTD: configure manager delete

Remove the device from FMC: Devices > Device Management

Change the IPs of the FTD:

configure network ipv4 manual 10.34.45.64 255.255.255.248 10.34.45.1

Add the manager back on FTD: configure manager add 10.2.9.288 password

Add the FTD to the FMC and reapply the configuration: Devices > Device Management

Re: FTD: Need to Change MGMT IP

MaeltorSHI — Thu, 13 Aug 2020 19:29:38 GMT

Furqan,

At the risk of resurrecting a dead thread, where did you happen to read that it was possible to change the Management IP in version 6.5 and higher?

I looked through the release notes and I wasn't able to find it.

Thanks!

Re: FTD: Need to Change MGMT IP

Furqan Khan — Thu, 13 Aug 2020 20:46:39 GMT

I had participated in 6.5 beta program and tested that feature but I believe they have removed it from the final release and moved that feature to FMC Model Migration for 6.5 version. That allows you to change MGMT IP address with out deleting the FTDs from the FMC.

Re: FTD: Need to Change MGMT IP

MaeltorSHI — Thu, 13 Aug 2020 21:15:18 GMT

Interesting, thanks for that. I'll reach out to our Cisco rep for further info. Appreciate your quick response.

Re: FTD: Need to Change MGMT IP

kumarpadala — Wed, 03 Mar 2021 19:19:23 GMT

Hi Marvin, Thank you very much for the quick & easy method to change the FTD IP. I have a quick query.

Our FTD registered on FMC via hostname (FQDN), in this case, is it sufficient to change the IP address on host record in DNS server and change the IP on FTD without touching the FMC? would FMC detects the new IP with the FQDN? or do I need to follow the above procedure?

Re: FTD: Need to Change MGMT IP

John Hinckley — Wed, 03 Mar 2021 19:55:04 GMT

If you initially registered the FTD using FQDN, then you should be able to change the IP in the DNS host record without losing connectivity. You should only have a problem if the FTD can't resolve the name. I would first test that the FTD can ping the current FQDN just to make sure it's still seeing the FMC by name before changing the record.

-John