Cisco FMC & WinSCP

[keithcclark71]

I have connected WinSCP in a previous version of firepower.  The version 6.6.1 I am trying to connnect to using WinSCP says i'm authenticating but it won't connect. Is anyone using WinSCP anymore or is there something better that can be used???

[eruizrub]

Hi Keith, it should work, have you tried to update winscp ?

you can also cretaed a user on root mode to transfer and get files using scp:

useradd <user>
passwd <user>

then you can use the user for scp transfers

[Oliver Kaiser · Accepted solution]

The problem is that Cisco introduced SFCLI to FMC, which does not support directory listing by default. Therefore it is not possible to transfer files to FMC without adding a user and setting its shell to /bin/bash or bin/sh, which is kinda awkward as a workaround but then again it works.

@OP  you need to do the following

1. SSH to FMC

2. Change to Bash

> expert

3. Change to root user

sudo su -

4. Add a new user that you can use for file transfer

useradd scpuser

5. Set password for scpuser

passwd scpuser

6. Set shell for scpuser

chsh --shell /bin/sh scpuser

7. Retry scp to FMC

> scp test.txt scpuser@fmc01.example.com:~/
Password: 
test.txt                                                                                                             100%    0     0.0KB/s   00:00    

8. Navigate to /Volume/home/scpuser - you'll find the transfered file in the users home directory

Hope that helps

[keithcclark71]

thanks Oliver Ill give it a try 

[Yordan Yordanov]

Hi Oliver,

is it possible to transfer Files from FMC to expertnal scp/ftp Server. i need to download some files from fmc, but fmc act as client and not like server. This is error that i get:

root@firepower:/var/common# scp results-02-17-2022--72526.tar.gz dafmc1812@xxxxxxxxxxx:/ftp
dafmc1812@xxxxxxxxx's password:
This service allows sftp connections only.
root@firepower:/var/common#

br

Yordan

[Marvin Rhoads · Accepted solution]

FMC allows you to download files from var/common via its web UI.

https://<fmc address>/ddd/#ATFileDownload;deviceId=0

You can also navigate there via System > Health Monitor > select the FMC > Advanced Troubleshooting tools

[CiscoPurpleBelt]

I am trying to upload a script to FTD preferrably through FMC, how do I do that? My Import/export option is only Package then it says unkown package file type. I am trying to upload a bash script.

[Marvin Rhoads]

To copy a non-package (upgrade, VDB  etc.) to the system you need to use something like scp from the cli as mentioned in this thread. Or if it's a small text file like a script you could even just paste the contents into a new file using vi - all from the expert cli as root user. There you basically have a purpose-built Linux OS to work with.

Note - do be careful not to change or remove any system files. That could leave your system in a corrupted and unrecoverable state!

[keithcclark71]

Oliver I don't know if you are still on the boards here but your procedure just worked for me in getting WINSCP connected to FMC 6.6.5.  I could not get it working when I initially opened this post but 2 years later I just got it working in a new deployment.