topic Re: Cisco CSSM IP address for FTD in Network Security

Cisco CSSM IP address for FTD

yuanqiao58820 — Mon, 08 Aug 2022 08:59:53 GMT

Hi friends

I have deployed several FTDs in the network, but there is a problem with registering these FTDs through the internal network. Routing information and firewall ACL need to be configured. What is the IP address of the relevant CSSM registration?

Thanks a lot in advance

Yuan

Re: Cisco CSSM IP address for FTD

balaji.bandi — Mon, 08 Aug 2022 10:35:19 GMT

What is the IP address of the relevant CSSM registration?

if this is on-prem CSSM you can find the IP with your Infra team, since this is VM.

example config as below

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/16-10/configuration_guide/syst_mgmt/b_1610_sys_mgmt_9500_cg/cisco_smart_licensing_client.html

Re: Cisco CSSM IP address for FTD

yuanqiao58820 — Mon, 08 Aug 2022 16:57:58 GMT

Re: Cisco CSSM IP address for FTD

yuanqiao58820 — Mon, 08 Aug 2022 16:55:12 GMT

Hi Balaji

We are trying to connect onto Cisco.com directly for registration.

Does this domain(tools.cisco.com, correct me if I'm wrong) for registration have a set of IP addresses by different regions?

Based on the documents from this link, example configured as below: ip host tools.cisco.com ip-address

Example:

Device(config)# ip host tools.cisco.com 209.165.201.30

Re: Cisco CSSM IP address for FTD

Marvin Rhoads — Mon, 08 Aug 2022 17:03:35 GMT

If possible, allow access to the FQDN tools.cisco.com. It normally resolves worldwide to:

Name: tools.cisco.com
Addresses: 2001:420:1201:5::a
72.163.4.38

...but that is subject to change.

Re: Cisco CSSM IP address for FTD

yuanqiao58820 — Mon, 08 Aug 2022 17:24:03 GMT

Thanks a lot. I will keep it in mind regarding changes.

Re: Cisco CSSM IP address for FTD

yuanqiao58820 — Thu, 11 Aug 2022 10:16:07 GMT

Hi Marvin

Whitelisted the IP and got the following results:

> ping 173.37.145.8
Sending 5, 100-byte ICMP Echos to 173.37.145.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 110/118/120 ms

The device was unable to connect to the Smart Licensing server. This might indicate a gateway problem for the management interface. Please select Evaluation Mode for now. Then, after completing setup, go to Device > System Settings > Management Interface and verify the management address and gateway configuration. There must be a path from the management IP address to the Internet to complete Smart License registration. You can then go to Device > Smart License and try registering again.

But registration is still failed. any more suggestions?

Thanks

Re: Cisco CSSM IP address for FTD

balaji.bandi — Thu, 11 Aug 2022 10:43:30 GMT

Do you have any Firewall in the path, it requied 443 also to be open, (not just ping).

Follow below troubleshooting guide:

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9500-series-switches/214484-cisco-smart-licensing-troubleshooting.html

Re: Cisco CSSM IP address for FTD

yuanqiao58820 — Thu, 11 Aug 2022 12:48:15 GMT

It might casued by the default syncro gateway of management, which has been set via data interface but not working, cannt receive any register packet from FW in the path.

Re: Cisco CSSM IP address for FTD

balaji.bandi — Thu, 11 Aug 2022 13:34:33 GMT

try using that source interface to connect to tools.cisco.com

if that is not showing FW, that means may be need to look what path it taking to go out, setup that as source interface for the devices to connect to License Servers.

Re: Cisco CSSM IP address for FTD

yuanqiao58820 — Tue, 16 Aug 2022 07:38:39 GMT

Thank you very much for help.

It works now, but it is strange that only the primary FTDs of the HA pairs are synchronized with CSSM, based on the instance displayed in smart accounts.

Re: Cisco CSSM IP address for FTD

yuanqiao58820 — Mon, 07 Nov 2022 11:03:12 GMT

Is it https based traffic? tcp 443? We need to minimize external threats from the internet.

We can register FTD to CSSM as an instance, but VBD update is interrupted. Any information regarding FQDN or IP address need to be whitelisted?

thanks

Re: Cisco CSSM IP address for FTD

Marvin Rhoads — Mon, 07 Nov 2022 11:28:42 GMT

@yuanqiao58820

The required URL is tools.cisco.com (via https)

Please see this article for many more details:

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/215838-fmc-and-ftd-smart-license-registration-a.html#anc4