Firepower integrated with public cloud

[peter.peng]

Hi Sir:

    When I want to integrated with public cloud. I can't link to public cloud. I had tried to ping below server. But I just can ping to one server. I had confimed with FW. The policy from inside to outside is permit all. Could you help to find the root cause ? Thanks

[Francesco Molino]

Hi

The Cloud server fqdn is cloud-ec.amp.cisco.com

Take a look on this documentation:
https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html

Your firewall should let passes tcp-443 towards AMP Cloud servers.
You can validate it doing the following command on your firewall:
packet-tracer input inside tcp a.b.c.d 12345 e.f.g.h 443 detail
- a.b.c.d is your fmc ip
- e.f.g.h is public ip of AMP Cloud server
- inside is your zone where fmc sits in (LAN)

[peter.peng]

Hi Sir:

   I can't find this command. You can refer to below information. I can't type any IP address after https.

 

I had confirmed the FTD policy rule. From inside to outside, we permit any to any. 

So I think we should not confirm the traffic from inside to Cisco cloud. 

[Abheesh Kumar]

Hi,
enter below commads
system support diagnostic-cli
enable
Then enter, type the packet tracer command

Packet-tracer input INSIDE_INTERFACE tcp 192.168.0.120 443 8.8.8.8 443

below is the cli commad reference guide for FTD

https://www.cisco.com/c/en/us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense/dr.html

Hope This Helps

Abheesh

[Francesco Molino]

On your command you forgot the end as I gave you in my previous post: e.f.g.h 443

[peter.peng]

Hi Sir:

    I had found the root cause and fixed it. But I had tried to type the command that you suggested. But I can't type it. You can refer to below photo.

I can't type the destination IP address,it just can type the MAC address.

[Francesco Molino]

Your interface is really need inside_interface?

Anyways, what was your issue?

[peter.peng]

Hi Sir:

   Root Cause:

          When I setup the public cloud. I choose the "Use for AMP for Firepower"