topic Proxy exceptions on FMC Version 6.0 in Network Security

Proxy exceptions on FMC Version 6.0

DavideRanalli97851 — Fri, 03 Sep 2021 15:23:13 GMT

I am using version on 6.0 on a physical 1600 FMC, we have configured a proxy in order to download updates from FMC and things like this. In house we also have the Smart Software Manager Satellite for licenses.

From FMC we are able to download updates but we can't reach the Satellite from the FMC after pasting the token generated from Satellite, my worry is that exceptions have to be configured on FMC but it has no options for that, looks like a limitation.

Does anyone know if exceptions can be configured, if they are needed at all, or any idea?

Thanks

Davide

Re: Proxy exceptions on FMC Version 6.0

Milos_Jovanovic — Sat, 04 Sep 2021 05:44:11 GMT

Hi @DavideRanalli97851,

Unfortunatelly, there is no possibility to configure exceptions list, while using proxy on Firepower. There is an enhancement request filed as CSCva74145, which is still open.

What stops you of permitting Satelite communication over proxy? If you are using TLS, just create TLS decryption exception (otherwise you would need to think of a way FMC trusts your TLS-decryption certificate). You could also try communicating over plain HTTP.

BR,

Milos

Re: Proxy exceptions on FMC Version 6.0

Mohammed al Baqari — Sat, 04 Sep 2021 07:02:06 GMT

Hi,

No, you can't configure proxy exceptions on FMC. These have to be
configured on proxy to bypass FMC traffic when going to SSM.

Also, try to move from 6.0. It's very outdated.

**** please remember to rate useful posts

Re: Proxy exceptions on FMC Version 6.0

DavideRanalli97851 — Sat, 04 Sep 2021 12:25:24 GMT

Hi Milos,

thanks for the ideas, i tried configuring a "Do not decrypt" policy clicking on SSL tab under the Access Control tab, but still not able to reach the Satellite, why would a TLS decryption exception policy need to be configured?

Satellite and FMC both refer to the same pki we have in house.

Thanks

Davide

Re: Proxy exceptions on FMC Version 6.0

Milos_Jovanovic — Sat, 04 Sep 2021 20:05:03 GMT

No, not on FMC/FTD. What I meant, you should configure proxy on FMC (like you need to), but then configure exception on proxy - when traffic is coming from FMC, bypass it from TLS decryption on proxy and/or permit it towards Satelite (and Internet, in order to download updates).

BR,

Milos