Management Interface x Data Interfaces

[Otvforte]

Hello,

I understood that connections to the FTD itself, cannot be filtered using FDM ACE only.

So, I'm looking for the right option where I can ensure that the connections to manage FTD (web/ssh) are disable and not exposed to the internet (default). 

Cisco documentation mentions these two options, but I couldn't understand exactly the difference: Management Interface and Management Data.

Thank you

[Rob Ingram]

@Otvforte the management interface is optional (you don't need to use it), is dedicated for management purposes, usually connected to the internal LAN.

The data interfaces are the inside, outside or dmz etc, typically you would not enable mgmt services (ssh, https) on the outside or dmz interfaces. If you do enable management services on the outside interface, restrict this to known hosts.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/222872-configure-management-access-for-ssh-and.html

this guide for SSH/HTTP access to FTD 

mgmt interface use for FMC and FDM 
data interface use mostly for FDM 

MHM

[Otvforte]

I see, so Management Access / Management Interface option is about that one exclusive for management purposes:

Thank you for this clarification

[MHM Cisco World]

Correct 
you access FTD via mgmt interface so select it to harden your FTD 

MHM

[Rob Ingram · Accepted solution]

@Otvforte not quite. the "Management Access" section relates to the management and data interfaces. You would select the correct tab - "Management Interface" or "Data Interface", then configured required access on the specific interface.

https://www.cisco.com/c/en/us/td/docs/security/firepower/770/fdm/fptd-fdm-config-guide-770/fptd-fdm-system.html#concept_6FFA959431C84299B9EDCF19160266AD

[Otvforte]

My mistake, I wrote Management Access / Management Access, it should be Management Access / Management Interface. Thank you.

[MHM Cisco World]

https://youtu.be/-bS8-iwhyMc?si=XvP9m93AuJVMDoa4

This how we can mgmt ftd from data interface instead of mgmt interface.

But I must mention it local mgmt fdm so I dont prefer you use data interface at all.

Use for local mgmt mgmt interface.

Anyway this for your info

BUT cor FMC data interface is better 

MHM