topic Re: Cisco FMC & WinSCP in Network Security

Cisco FMC & WinSCP

keithcclark71 — Wed, 10 Feb 2021 19:57:24 GMT

I have connected WinSCP in a previous version of firepower. The version 6.6.1 I am trying to connnect to using WinSCP says i'm authenticating but it won't connect. Is anyone using WinSCP anymore or is there something better that can be used???

Re: Cisco FMC & WinSCP

eruizrub — Wed, 10 Feb 2021 20:36:12 GMT

Hi Keith, it should work, have you tried to update winscp ?

you can also cretaed a user on root mode to transfer and get files using scp:

useradd <user>
passwd <user>

then you can use the user for scp transfers

Re: Cisco FMC & WinSCP

Oliver Kaiser — Thu, 11 Feb 2021 10:24:58 GMT

The problem is that Cisco introduced SFCLI to FMC, which does not support directory listing by default. Therefore it is not possible to transfer files to FMC without adding a user and setting its shell to /bin/bash or bin/sh, which is kinda awkward as a workaround but then again it works. 😉

@OP you need to do the following

1. SSH to FMC

2. Change to Bash

> expert

3. Change to root user

sudo su -

4. Add a new user that you can use for file transfer

useradd scpuser

5. Set password for scpuser

passwd scpuser

6. Set shell for scpuser

chsh --shell /bin/sh scpuser

7. Retry scp to FMC

> scp test.txt scpuser@fmc01.example.com:~/
Password: 
test.txt                                                                                                             100%    0     0.0KB/s   00:00

8. Navigate to /Volume/home/scpuser - you'll find the transfered file in the users home directory

Hope that helps 🙂

Re: Cisco FMC & WinSCP

keithcclark71 — Thu, 18 Feb 2021 23:38:35 GMT

thanks Oliver Ill give it a try

Re: Cisco FMC & WinSCP

Yordan1 — Thu, 17 Feb 2022 11:01:29 GMT

Hi Oliver,

is it possible to transfer Files from FMC to expertnal scp/ftp Server. i need to download some files from fmc, but fmc act as client and not like server. This is error that i get:

root@firepower:/var/common# scp results-02-17-2022--72526.tar.gz dafmc1812@xxxxxxxxxxx:/ftp
dafmc1812@xxxxxxxxx's password:
This service allows sftp connections only.
root@firepower:/var/common#

Yordan

Re: Cisco FMC & WinSCP

Marvin Rhoads — Thu, 17 Feb 2022 15:10:01 GMT

FMC allows you to download files from var/common via its web UI.

https://<fmc address>/ddd/#ATFileDownload;deviceId=0

You can also navigate there via System > Health Monitor > select the FMC > Advanced Troubleshooting tools

Re: Cisco FMC & WinSCP

keithcclark71 — Wed, 15 Jun 2022 18:35:19 GMT

Oliver I don't know if you are still on the boards here but your procedure just worked for me in getting WINSCP connected to FMC 6.6.5. I could not get it working when I initially opened this post but 2 years later I just got it working in a new deployment.

Re: Cisco FMC & WinSCP

CiscoBrownBelt — Fri, 17 Mar 2023 16:38:59 GMT

I am trying to upload a script to FTD preferrably through FMC, how do I do that? My Import/export option is only Package then it says unkown package file type. I am trying to upload a bash script.

Re: Cisco FMC & WinSCP

Marvin Rhoads — Fri, 17 Mar 2023 19:22:56 GMT

To copy a non-package (upgrade, VDB etc.) to the system you need to use something like scp from the cli as mentioned in this thread. Or if it's a small text file like a script you could even just paste the contents into a new file using vi - all from the expert cli as root user. There you basically have a purpose-built Linux OS to work with.

Note - do be careful not to change or remove any system files. That could leave your system in a corrupted and unrecoverable state!