topic Re: Change FMC managed FTD Access Control Policy assignment via CLI in Network Security

Change FMC managed FTD Access Control Policy assignment via CLI

a12288 — Sun, 25 Sep 2022 04:43:27 GMT

We have a need to manually change FTD Access Control Policy assignment via CLI in the event of maintenance or outage. Our FTD is being managed by FMC however our FMC is not on out-of-bound network but rather hosted in the inside zone data plane.

We would need to SSH to FTD and switch FTD ACP to a permit any-any like ACP via CLI (while FMC is unreachable) in order to let certain traffics passing though FTD, and switch back to production ACP afterwards. Is it possible? Thanks.

Leo

Re: Change FMC managed FTD Access Control Policy assignment via CLI

Marvin Rhoads — Mon, 26 Sep 2022 17:37:06 GMT

As far as I know, what you are asking is not possible. On an FTD device that is registered to an FMC manager, only the managing FMC can change the ACP.

Re: Change FMC managed FTD Access Control Policy assignment via CLI

a12288 — Tue, 27 Sep 2022 16:54:01 GMT

Since I am able to use LinaConfigTool to modify routing table so I am hoping there is something similar to modify ACP, in the event of FTD lost access to FMC.

Re: Change FMC managed FTD Access Control Policy assignment via CLI

Marvin Rhoads — Wed, 28 Sep 2022 09:16:00 GMT

There is a new feature in 7.2 that may help with your use case. It is as follows:

Auto rollback of a deployment that causes a loss of management connectivity.

You can now enable auto rollback of the configuration if a deployment causes the management connection between the management center and the threat defense to go down. Previously, you could only manually rollback a configuration using the configure policy rollback command.

New/modified screens:

Devices > Device Management > Device > Deployment Settings
Deploy > Advanced Deploy > Preview
Deploy > Deployment History > Preview

For more information, see Device Management in the device configuration guide.

Re: Change FMC managed FTD Access Control Policy assignment via CLI

a12288 — Fri, 30 Sep 2022 20:12:22 GMT

Hi, Marvin.

Will Cisco support FMC4500 to have multiple NICs / IPs to manage different FTDs? I am thinking to put an extra FMC NIC (eth1) to have an IP address in the same subnet as FTD's management interface, so this connection won't be lost and I can use FMC (eth1) to change ACP of the FTD when FMC eth0 is lost network connectivity. Thanks.

Leo

Re: Change FMC managed FTD Access Control Policy assignment via CLI

Marvin Rhoads — Sun, 02 Oct 2022 03:08:59 GMT

You can (and always have been able to) use the second (or third etc.) NIC in an FMC to manage devices. It comes down to the routing for that NIC and managed devices. As long as that is working as desired in the underlying OS (Linux) then the FMC application will use the best route to reach the managed devices. You need to be sure to understand it from the device side as you add the manager by its IP address and that must be the same as the NIC of the FMC that will be used for that device.