topic Can't update anything via proxy in Cisco FMC in Network Security

Can't update anything via proxy in Cisco FMC

sina.naser — Sun, 28 May 2023 07:00:38 GMT

Hi everyone

Due to oraganization's policies We Update our servers through HTTP proxy.

We have a Cisco FMC (VM, version 7.0.5) and want to system, VDB, Snort update through proxy. proxy server connection is ok. But when I hit download after few minutes I encounter this error "Peer certificate cannot be authenticated with known CA certificates" .

What should I suppose to do in this case?

I appreciate any help

Tnx in advance

Re: Can't update anything via proxy in Cisco FMC

Rob Ingram — Sun, 28 May 2023 08:37:17 GMT

@sina.naser are you doing SSL decryption on the proxy? If so perhaps add an exclusion for the FMC or add the proxy root cert to the FMC as a trusted certificate.

Re: Can't update anything via proxy in Cisco FMC

sina.naser — Sun, 28 May 2023 09:25:13 GMT

Tnx for your reply. No SSL decryption. It's simple Mikrotik Proxy

Re: Can't update anything via proxy in Cisco FMC

sina.naser — Mon, 29 May 2023 10:03:22 GMT

This is a forced task that assigned to me. Do you have any other idea?

Tnx

Re: Can't update anything via proxy in Cisco FMC

MHM Cisco World — Mon, 29 May 2023 10:31:40 GMT

If you face issue with ssl inspection then why you not make this traffic bypass ssl inspection?

Re: Can't update anything via proxy in Cisco FMC

sina.naser — Mon, 29 May 2023 11:32:57 GMT

I fastpath the traffic to the proxy via prefilter. So no SSL inspection in FTD. I saw this message a bug in previous versions. But This FMC updated to the latest suggested version

Re: Can't update anything via proxy in Cisco FMC

MHM Cisco World — Mon, 29 May 2023 11:56:33 GMT

what is Firepower platform you have ?

Re: Can't update anything via proxy in Cisco FMC

sina.naser — Mon, 29 May 2023 12:04:07 GMT

FPR 2110 running FTD 7.0.5

Re: Can't update anything via proxy in Cisco FMC

Sheraz.Salim — Mon, 29 May 2023 12:12:04 GMT

If you are using a MikroTik proxy server and encountering the "Peer certificate cannot be authenticated with known CA certificates" error while trying to update your Cisco FMC (Firepower Management Center) through the HTTP proxy, the issue is likely related to SSL certificate verification.

can you also check proxy server logs, examine the logs on your MikroTik proxy server to identify any errors or issues related to the SSL handshake or certificate verification. The logs may provide valuable information and lead to reslove the FMC issue.

Re: Can't update anything via proxy in Cisco FMC

sina.naser — Mon, 29 May 2023 12:44:23 GMT

Mikrotik doesn't show any descriptive logs just show the IPs. Is there any specific configuration that I must consider in mikrotiK for this issue?

Re: Can't update anything via proxy in Cisco FMC

MHM Cisco World — Mon, 29 May 2023 13:38:13 GMT

clear conn address <<- clear the traffic in FPR and check again.

Re: Can't update anything via proxy in Cisco FMC

Sheraz.Salim — Mon, 29 May 2023 15:05:51 GMT

Its difficult to say could you confirm if you can run the packet capture on both end and capture the data.

also please confirm if anything is change in the path for FMC. how it was upgraded (fmc) last time where the same proxy was used?

Re: Can't update anything via proxy in Cisco FMC

sina.naser — Sat, 10 Jun 2023 06:19:27 GMT

Last week Cisco made the version 7.2.4 suggested. I have updated to this version and the problem solved!