cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3169
Views
30
Helpful
14
Replies

Need FTD FXoS CLI commands to change IP addresses on 2100

jimmycher
Level 1
Level 1

Can someone give me the CLI commands to configure the IP addresses on a new FTD 2100?  Evidently, it involves "scope" commands.  My ISP uses 192.168.1.x for DHCP IP addresses, so I need to manually assign my local PC a different subnet (NOT 192.168.1.x).  I can't run the GUI until I get over this hurdle.  

14 Replies 14

balaji.bandi
Hall of Fame
Hall of Fame

here is the config guide :( hope this what are you looking ?)

 

https://www.cisco.com/c/en/us/td/docs/security/asa/fxos/config/asa-2100-fxos-config/cli.html#id_54695

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Marvin Rhoads
Hall of Fame
Hall of Fame

Are you asking about the IP addressing of the physical management interface? If so, it is setup during initial installation like this:

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp2100/firepower-2100-gsg/ftd-fdm.html#Cisco_Task.dita_e12c753f-4ce1-4a2b-936b-33c54f4ffb1d

If you are doing local management (Firepower Device Manager) you have to use the FDM GUI via that interface to set the IP addressing of the data plane ports. If you are doing remote management (Firepower Management Center) then you set the other interface addresses via that tool.

Per the set-up guide, my Eth1/2 is 192.168.1.1;  the FDM GUI confirms that.   

 

I believe the problem is my Eth1/1 is connected to my home FIOS router. The FDM GUI is not showing any IP address.   

 

Since my home network is 192.168.1.x, I think the 2100 is not accepting the FIOS supplied DHCP address, since that would put the same subnet on two physical interfaces.

 

From the FDM gui, I can not ping 8.8.8.8.

 

Any ideas?

Since you appear to be able to access the FDM GUI, can you change your Eth1/2 address to some other subnet? You're right in that you cannot have two routed interfaces in the same subnet.

You could also operate the device in transparent mode and only have an IP address for the management interface.

Marvin,

I changed the 2100 port to 192.168.2.1, and my local PC to 192.168.2.2.  I'm now locked out. 

Did I need to add access from the 192.168.2.x subnet, like I would on an ASDM?

 

I still have access via the console port, but those CLI commands are problematic.  Can I use CLI commands to get it back to 192.168.1.1 ?

Update.

I found a 4100 users guide, and was able to reset the config back to default.  I'm back in, and using the gui again.

FYI, "The local Firepower Device Manager supports routed mode only."   So it looks like I can't go to transparent mode.

 

I'll pause the conversation for the time being.

Thanks.

yes, correct, you need FMC if you like to run FTD in Transparent Mode.

 

below reference :

 

"You also must use Firepower Management Center if you want to run the device in transparent firewall mode"

 

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-mgmt.html

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Marvin, Balaji,    Thanks for the help.

Eventually, I got in, and am slogging my way through it.  But almost everything on-line and in print references using FMC, which I don't need or want for a single device.   I need a beginners guide to FDM.   How much of the FDM is the same as FMC?

Thanks again.

FDM has Limited Features compare to FMC (you get full-blown deployment)

 

if only 1 device you can manage with FDM for certain level.

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Where is the FDM beginners guide?

There isn't a separate "beginner's guide" but all of the FDM Configuration Guides are published here:

https://www.cisco.com/c/en/us/support/security/firepower-2100-series/products-installation-and-configuration-guides-list.html

If you're only managing a single Firepower device and don't need any of the more advanced features or the ability to examine historical events, drill down into IOCs etc. then FDM may be fine for you.

Thank you Marvin and BB,

 

I was expecting the FDM to be similar to ASA, it is not.  

In the FDM, you can not use the CLI to perform most functions, nor can you use it to review what the GUI builds.

 

Cisco changing the recent nomenclature from SourceFire, then again inside Cisco, has made this a torturous learning process.

It reminds me of the old CiscoWorks, a disjointed amalgam of products thrown together and sold as "seamless"....

It was very, very difficult to find concise instruction.

 

I did find a FDM seminar in the Cisco Live sessions, which helped considerably.

 

Best.

You can review the pending changes in the FDM GUI. In fact, this is one of the things FDM is able to do that's not currently a feature in FMC.

https://www.cisco.com/c/en/us/td/docs/security/firepower/650/fdm/fptd-fdm-config-guide-650/fptd-fdm-mgmt.html#task_A962AABC43B3499694DFCDABA932F0ED

 

By the way I remember CiscoWorks well. I started working with in back in the early 90s when it was available for Sun Solaris and IBM AIX distributions. I used everything from that to CSWI, CiscoView, CiscoWorks 2000, CiscoWorks RWAN and LMS, Prime LMS, Prime NCS, and Prime Infrastructure from 1.1 through the current 3.8. Also the wonderful Netsys product which Cisco acquired then abandoned (sold to Wandel and Goltermann actually where it died a slow painful death).

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: