Creating SSH access to a Firepower 4110 Multi-context using a certific

[majoroumar]

Hello,

We have a firewall cluster made up of Firepower hardware appliances, each simultaneously running a piece of ASA firmware and a piece of FxOS firmware. This deployment mode is Firepower "Appliance mode".
The cluster can communicate directly with the ASA layer, directly with the FxOS layer, or even indirectly with the ASA layer by first passing through the FxOS layer.

We want to retrieve the result of the sh failover command via an SSH connection with certificate authentication on the FxOS layer.
it's possible in this multiple-context environment, and if so, how to set up the SSH parameters on the FxOS layer, and if not, what the best practice is.

Thank you

[Cisco_Virtual_Engineer]

In a multiple-context environment, you cannot directly run the "sh failover" command on the FxOS layer. The "sh failover" command is an ASA command, and to retrieve the output of this command, you need to access the ASA context.

To achieve this, you can follow these steps:

1. First, ensure that you have configured certificate-based authentication for SSH on the ASA context. Refer to the Cisco documentation for configuring certificate-based authentication for SSH on ASA: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/admin_management.html#pgfId-1121520

2. Next, establish an SSH connection to the FxOS layer.

3. After successfully connecting to FxOS, enter "connect asa" command to access the ASA context.

4. Once you are in the ASA context, you can then run the "sh failover" command to retrieve the desired information.

Remember that you need to configure certificate-based authentication separately for the ASA context and the FxOS layer, as they are treated as independent entities.

If you have any further questions or need assistance with the configuration, please feel free to ask.

[majoroumar]

Hello,

Thank you for your reply.

In this case, how can I configure SSH authentication by certificate on the FxOS layer in  multiple-context? Could I have the commands please?

[Marvin Rhoads]

As far as I know, FXOS only supports RADIUS, TACACS or LDAP for remote authentication.

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/fxos271/cli-guide/b_CLI_ConfigGuide_FXOS_271/user_management.html#concept_2770BFB3259042F5A4420595A0A6946C

[Cisco_Virtual_Engineer]

In a multiple-context environment, you cannot directly run the "sh failover" command on the FxOS layer. The "sh failover" command is an ASA command, and to retrieve the output of this command, you need to access the ASA context.

To achieve this, you can follow these steps:

1. First, ensure that you have configured certificate-based authentication for SSH on the ASA context. Refer to the Cisco documentation for configuring certificate-based authentication for SSH on ASA: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/admin_management.html#pgfId-1121520

2. Next, establish an SSH connection to the FxOS layer.

3. After successfully connecting to FxOS, enter "connect asa" command to access the ASA context.

4. Once you are in the ASA context, you can then run the "sh failover" command to retrieve the desired information.

Remember that you need to configure certificate-based authentication separately for the ASA context and the FxOS layer, as they are treated as independent entities.

If you have any further questions or need assistance with the configuration, please feel free to ask.