topic Re: Cisco Firepower FMC Export Configuration option using CLI mode in Network Security

Cisco Firepower FMC Export Configuration option using CLI mode

VeeraselvamManoharan53181 — Mon, 04 Jan 2021 10:05:21 GMT

Is there any way to export Cisco Firepower FMC configuration using CLI mode? Cisco Firepower FTD case I am using "show running-config" CLI command to get configuration data.

Re: Cisco Firepower FMC Export Configuration option using CLI mode

balaji.bandi — Mon, 04 Jan 2021 10:10:43 GMT

what is the use case here, did you lost GUI, the config can be backup from GUI, that what intention of making Manamgement as FMC.

Re: Cisco Firepower FMC Export Configuration option using CLI mode

Marvin Rhoads — Mon, 04 Jan 2021 10:36:57 GMT

No. FMC configuration can only be backed up using the FMC backup feature from within the GUI.

(Or, if it is a VM, via an external VM backup tool)

Re: Cisco Firepower FMC Export Configuration option using CLI mode

VeeraselvamManoharan53181 — Tue, 05 Jan 2021 03:53:34 GMT

I am using a third-party tool to generate rule management reports. (like policy optimization report, security audit reports). Currently my organization using 2 FortiGate firewalls and Cisco Firepower FMC, FortiGate firewall case our third-party tool providing all rule management related reports, but Cisco Firepower FMC case they requested CLI commands to get complete configuration data.(Policy/Network/Interface/Service object data).

In my google search I found below Cisco Firepower FMC CLI command reference document:
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/command_line_reference.pdf

In the above document listed below command options:

1) system generate-troubleshoot SYS (System Configuration, Policy, and Logs)

2) system generate-troubleshoot DES (Detection Configuration, Policy, and Logs)

3) system generate-troubleshoot NET (Interface and Network Related Data)

What is the usage of "system generate-troubleshoot" command? Above command output file will contain Policy/Network/Interface/Service object information?

Re: Cisco Firepower FMC Export Configuration option using CLI mode

Marvin Rhoads — Tue, 05 Jan 2021 18:49:30 GMT

The problem is that FMC does not store all of its configuration in a text file. There are multiple database tables and elements that comprise both an FMC configuration and that of a managed device.

If you want a human readable export of a managed device configuration, you can always generate a report for that policy. Go to Policies > Access Control and click the icon on the right to generate a report for the policy or policies you need.