cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
180
Views
6
Helpful
7
Replies

Management Interface x Data Interfaces

Otvforte
Level 1
Level 1

Hello,

I understood that connections to the FTD itself, cannot be filtered using FDM ACE only.

So, I'm looking for the right option where I can ensure that the connections to manage FTD (web/ssh) are disable and not exposed to the internet (default). 

Cisco documentation mentions these two options, but I couldn't understand exactly the difference: Management Interface and Management Data.

Thank you

 

 

1 Accepted Solution

Accepted Solutions

@Otvforte not quite. the "Management Access" section relates to the management and data interfaces. You would select the correct tab - "Management Interface" or "Data Interface", then configured required access on the specific interface.

https://www.cisco.com/c/en/us/td/docs/security/firepower/770/fdm/fptd-fdm-config-guide-770/fptd-fdm-system.html#concept_6FFA959431C84299B9EDCF19160266AD

 

View solution in original post

7 Replies 7

@Otvforte the management interface is optional (you don't need to use it), is dedicated for management purposes, usually connected to the internal LAN.

The data interfaces are the inside, outside or dmz etc, typically you would not enable mgmt services (ssh, https) on the outside or dmz interfaces. If you do enable management services on the outside interface, restrict this to known hosts.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/222872-configure-management-access-for-ssh-and.html

this guide for SSH/HTTP access to FTD 

mgmt interface use for FMC and FDM 
data interface use mostly for FDM 

MHM

Otvforte
Level 1
Level 1

I see, so Management Access / Management Interface option is about that one exclusive for management purposes:

Otvforte_0-1752000397774.png

Thank you for this clarification

 

Correct 
you access FTD via mgmt interface so select it to harden your FTD 

Screenshot (275).png

MHM

@Otvforte not quite. the "Management Access" section relates to the management and data interfaces. You would select the correct tab - "Management Interface" or "Data Interface", then configured required access on the specific interface.

https://www.cisco.com/c/en/us/td/docs/security/firepower/770/fdm/fptd-fdm-config-guide-770/fptd-fdm-system.html#concept_6FFA959431C84299B9EDCF19160266AD

 

Otvforte
Level 1
Level 1

My mistake, I wrote Management Access / Management Access, it should be Management Access / Management Interface. Thank you.

https://youtu.be/-bS8-iwhyMc?si=XvP9m93AuJVMDoa4

This how we can mgmt ftd from data interface instead of mgmt interface.

But I must mention it local mgmt fdm so I dont prefer you use data interface at all.

Use for local mgmt mgmt interface.

Anyway this for your info

BUT cor FMC data interface is better 

MHM

Review Cisco Networking for a $25 gift card