topic Re: Could not able to add firepower 1010 series after site to site vpn in Network Security

Could not able to add firepower 1010 series after site to site vpn

Sefa On — Wed, 26 Jul 2023 02:08:23 GMT

Dears

I need to very urgent your help.

I have 5 firepower 1010 series firewall and 1 FMC on vmware. I added a firepower 1010 in the head office to the fmc and made a site to site vpn to the firepowers in other offices over this firepower. I connected the switch to the management port by giving it an IP address in the local (as like 192.168.1.1 firepower adress 192.168.1.2 is management port ip address). All of the site to site vpns are active and they can able to acces ve each others but I cannot add the firepowers in the offices to the fmc, when I try to add it, I get a timeout error and the progress is cancelled.

what do you think is the reason?

Re: Could not able to add firepower 1010 series after site to site vpn

MHM Cisco World — Wed, 26 Jul 2023 02:12:34 GMT

s2s vpn' allow inside not mgmt interface pass through vpn.

You need to config inside with managment-access to make fpr connect to fmc through vpn

Re: Could not able to add firepower 1010 series after site to site vpn

Sefa On — Wed, 26 Jul 2023 02:23:55 GMT

Thanks a lot for your quick response how can i config to management access from inside

Re: Could not able to add firepower 1010 series after site to site vpn

MHM Cisco World — Wed, 26 Jul 2023 02:49:11 GMT

interface inside there is option management-access select it.

Re: Could not able to add firepower 1010 series after site to site vpn

Sefa On — Wed, 26 Jul 2023 08:34:49 GMT

losing the connection when i select under vlan1 interface management only option

Re: Could not able to add firepower 1010 series after site to site vpn

Sefa On — Wed, 26 Jul 2023 18:13:32 GMT

Dears

Do you have any thoughts on alternative Solution to fix it ?

regards

sefa

Re: Could not able to add firepower 1010 series after site to site vpn

MHM Cisco World — Wed, 26 Jul 2023 21:00:24 GMT

FMC-FPR1-VPN-FPR2

you want to add FPR2 tp FMC ?

Re: Could not able to add firepower 1010 series after site to site vpn

Sefa On — Thu, 27 Jul 2023 02:18:11 GMT

Yes I want to add FPR2 to FMC and manage over Fmc

Re: Could not able to add firepower 1010 series after site to site vpn

tvotna — Thu, 27 Jul 2023 14:56:30 GMT

Did you use FDM to pre-configure VPN on remote office firepowers or how you configured them? Or do you terminate VPN on some other remote office device and not on FTD? Obviously, if I understand correctly, there is a chicken and egg problem here. You need to at least configure routing on FTD to route traffic from FTD management interface to FTD inside and then to outside via VPN and you need working VPN on it before registering with FMC...

In general, there is special procedure for remote office deployments, which is documented here: https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp1100/firepower-1100-gsg/ftd-fmc-remote.html, but int this case FTD outside interface is used to connect to FMC and not VPN.

Re: Could not able to add firepower 1010 series after site to site vpn

MHM Cisco World — Thu, 27 Jul 2023 15:21:07 GMT

Fpr2-vpn-fpr1-fmc

Fpr2 use

Mgmt interface - inside interface use as gw -outside use as vpn end

Now what you need management-access not management-only config for inside interface' if fmc not have this option then you need flexconfig

Add mgmt subnet to acl policy of vpn.

Re: Could not able to add firepower 1010 series after site to site vpn

MHM Cisco World — Thu, 27 Jul 2023 15:26:29 GMT

Other option is use outside (same as outside interface you use for vpn) as mgmt interface to connect to FMC'

Outside to be use as mgmt interface you need also again management-access which as I mention above if not available in fmc use flexconfig.

Re: Could not able to add firepower 1010 series after site to site vpn

Sefa On — Thu, 27 Jul 2023 19:23:02 GMT

hi mate thanks for answer. just configred the vpn site and hub is spoke with each other and I can ping two way from fmc to ftd management port but I got the error when i try to add to fmc via vpn.

Re: Could not able to add firepower 1010 series after site to site vpn

Sefa On — Thu, 27 Jul 2023 20:32:52 GMT

still not joy 😞 not able to register. can you please let me know how can i add management-access to fmc with flexconfig ?