topic Re: How to bring up a port channel interface that was shut through cli in Network Security

How to bring up a port channel interface that was shut through cli

Ditter — Mon, 23 Sep 2024 08:46:34 GMT

Hi,

i came across a problem and i would like your help.

During test procedures i did a shutdown of the outside interface in FTD-1 which is in failover pair. Deliberately, i had no monitoring interfaces nor backup IPs in the secondary FTD-2 as i wanted to test what happens in this case (no monitor, no backup IPs)

The result was to lose connectivity to the firewall pair.

My question is the following:

Is it possible through the CLI to bring up again an interface that is in shutdown state? I digged in the CLI and i found only :

> configure network

dns Configure DNS servers
hostname Set the hostname
http-proxy Configure HTTP Proxy settings
http-proxy-disable Disable HTTP Proxy settings
ipv4 Configure IPv4 networking
ipv6 Configure IPv6 networking
management-data-interface Wizard for Management Data interface setup
management-interface Change to Management Port Configuration Mode
management-port Change TCP port for management
mtu Configure Management and Eventing Interface MTU
speed Set interface speed
static-routes Change to Static Route Configuration Mode

So my question is if there are any commands that can bring up again an interface that is in shutdown state:

interface Port-channel1.271
description FTD-Outside-Interface
shutdown
vlan 271
nameif vlan_271
cts manual

Thanks,

Ditter.

Re: How to bring up a port channel interface that was shut through cli

Rob Ingram — Mon, 23 Sep 2024 08:50:54 GMT

@Ditter the only supported method is via the GUI (FMC/FDM however you manage the FTDs). The configure-network command relates to the mangement interface, not the data interfaces.

Re: How to bring up a port channel interface that was shut through cli

Ditter — Mon, 23 Sep 2024 09:29:50 GMT

Thanks for the fast reply Rob,

just thinking it would be nice to have this capability also from the CLI for the data interfaces.

Re: How to bring up a port channel interface that was shut through cli

Rob Ingram — Mon, 23 Sep 2024 09:34:07 GMT

@Ditter yes I agree. I believe in future versions there may be the ability to configure additional settings from the CLI, not sure what settings and when though tbh.

Re: How to bring up a port channel interface that was shut through cli

MHM Cisco World — Mon, 23 Sep 2024 09:37:30 GMT

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215351-configure-verify-and-troubleshoot-port.html

There is via cli but it depends on ftd platform.

MHM

Re: How to bring up a port channel interface that was shut through cli

Ditter — Mon, 23 Sep 2024 11:22:20 GMT

Thanks MHM,

i read through the document you provided and through various commands i finally got in the following menu (via fxos commands)

ftd-1 /eth-uplink/fabric # show port-channel

Port Channel:
Port Channel Id Name Port Type Admin State Oper State State Reason
--------------- ---------------- ------------------ ----------- ---------------- ------------
1 Port-channel1 Data Enabled Up Up
2 Port-channel2 Data Disabled Link Down Down

Then i entered the port-channel 1 under which i have configured the sub-interface 271 which i wanted to re-enable (no shut) but i do not see any relevant info under port-channel 1 .

ftd-1 /eth-uplink/fabric # enter port-channel 1

ftd-1 /eth-uplink/fabric/port-channel # show

But no sub-interfaces show with this command although i have 4 of them configured in the GUI.

And even in the upper menu , there are not port-channel subinterfaces available

ftd-1 /eth-uplink/fabric # scope
interface Interface
port-channel Port Channel
switching Ethernet LAN Switching
vlan VLAN

Thanks,

Ditter

Re: How to bring up a port channel interface that was shut through cli

Rob Ingram — Mon, 23 Sep 2024 11:37:25 GMT

@Ditter

If you have a 1000/2000 series hardware you manage Port Channels and interfaces from the GUI.

If you have a 3000, 4000 or 9300 series you manage/allocate interfaces from FXOS, but if you shutdown the interfaces from the FMC you must still un-shutdown from there also.

Re: How to bring up a port channel interface that was shut through cli

MHM Cisco World — Mon, 23 Sep 2024 11:36:29 GMT

PO done by cli and subinterface done by gui.

MHM