topic Re: Restricting Access to FTD Management Interface in Network Security

Restricting Access to FTD Management Interface

mumbles202 — Thu, 06 Apr 2023 22:50:28 GMT

I'm trying to restrict access to the management interface of a pair of 1150s running 7.2.0. I've run the following command:

configure ssh-access-list 8.8.8.8/32

which appears to complete successfully("The ssh access list was changed successfully." is returned) but then if I issue "show ssh-access-list" following this nothing is displayed. If I log out and back in via ssh I get the following:

> show ssh-access-list
f2b-sshd tcp -- anywhere anywhere tcp dpt:ssh
Chain f2b-sshd (1 references)

Once I try to edit the ACL again I get the same behavior described above and if I re-run the show ssh-access-list command nothing is displayed. Strangely enough, this worked fine on a pair of 1140s running the same code.

Re: Restricting Access to FTD Management Interface

balaji.bandi — Fri, 07 Apr 2023 05:04:12 GMT

is this managed by FMC or FDM ?

configure ssh-access-list 8.8.8.8/32 <-- Hope 8.8.8.8 dummy one, if you do this only 8.8.8.8 can access rest will be denied. (bare in mind before you issue that command)

try :

> show running-config ssh

Note: since you confirmed the old version working 7.2 has an issue, may syntax change or could be a bug, I have not tested myself n 7.2 - 7.0 works as expected.

Re: Restricting Access to FTD Management Interface

mumbles202 — Wed, 12 Apr 2023 01:35:18 GMT

This pair of 1150s is managed by the same FMC that manages the 1140 that took the commands successfully.

Re: Restricting Access to FTD Management Interface

Gustavo Medina — Wed, 12 Apr 2023 02:32:22 GMT

Maybe iptables is corrupt... can you show me the iptables file?

/ngfw/etc/sysconfig# cat iptables

Re: Restricting Access to FTD Management Interface

mumbles202 — Wed, 12 Apr 2023 13:35:14 GMT

When I do that I get this:

admin@ftd-02:/ngfw/etc/sysconfig$ cat iptables
admin@ftd-02:/ngfw/etc/sysconfig$

Re: Restricting Access to FTD Management Interface

Gustavo Medina — Wed, 12 Apr 2023 17:46:28 GMT

I see... can you share the same from the working 1140?