Need FTD FXoS CLI commands to change IP addresses on 2100

[jimmycher]

Can someone give me the CLI commands to configure the IP addresses on a new FTD 2100?  Evidently, it involves "scope" commands.  My ISP uses 192.168.1.x for DHCP IP addresses, so I need to manually assign my local PC a different subnet (NOT 192.168.1.x).  I can't run the GUI until I get over this hurdle.  

[balaji.bandi]

here is the config guide :( hope this what are you looking ?)

https://www.cisco.com/c/en/us/td/docs/security/asa/fxos/config/asa-2100-fxos-config/cli.html#id_54695

[Marvin Rhoads]

Are you asking about the IP addressing of the physical management interface? If so, it is setup during initial installation like this:

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp2100/firepower-2100-gsg/ftd-fdm.html#Cisco_Task.dita_e12c753f-4ce1-4a2b-936b-33c54f4ffb1d

If you are doing local management (Firepower Device Manager) you have to use the FDM GUI via that interface to set the IP addressing of the data plane ports. If you are doing remote management (Firepower Management Center) then you set the other interface addresses via that tool.

[jimmycher]

Per the set-up guide, my Eth1/2 is 192.168.1.1;  the FDM GUI confirms that.   

I believe the problem is my Eth1/1 is connected to my home FIOS router. The FDM GUI is not showing any IP address.   

Since my home network is 192.168.1.x, I think the 2100 is not accepting the FIOS supplied DHCP address, since that would put the same subnet on two physical interfaces.

From the FDM gui, I can not ping 8.8.8.8.

Any ideas?

[Marvin Rhoads]

Since you appear to be able to access the FDM GUI, can you change your Eth1/2 address to some other subnet? You're right in that you cannot have two routed interfaces in the same subnet.

You could also operate the device in transparent mode and only have an IP address for the management interface.

[jimmycher]

Marvin,

I changed the 2100 port to 192.168.2.1, and my local PC to 192.168.2.2.  I'm now locked out. 

Did I need to add access from the 192.168.2.x subnet, like I would on an ASDM?

I still have access via the console port, but those CLI commands are problematic.  Can I use CLI commands to get it back to 192.168.1.1 ?

[jimmycher]

Update.

I found a 4100 users guide, and was able to reset the config back to default.  I'm back in, and using the gui again.

FYI, "The local Firepower Device Manager supports routed mode only."   So it looks like I can't go to transparent mode.

I'll pause the conversation for the time being.

Thanks.

[balaji.bandi]

yes, correct, you need FMC if you like to run FTD in Transparent Mode.

below reference :

"You also must use Firepower Management Center if you want to run the device in transparent firewall mode"

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-mgmt.html

[jimmycher]

Marvin, Balaji,    Thanks for the help.

Eventually, I got in, and am slogging my way through it.  But almost everything on-line and in print references using FMC, which I don't need or want for a single device.   I need a beginners guide to FDM.   How much of the FDM is the same as FMC?

Thanks again.

[balaji.bandi]

FDM has Limited Features compare to FMC (you get full-blown deployment)

if only 1 device you can manage with FDM for certain level.

[jimmycher]

Where is the FDM beginners guide?

[Marvin Rhoads]

There isn't a separate "beginner's guide" but all of the FDM Configuration Guides are published here:

https://www.cisco.com/c/en/us/support/security/firepower-2100-series/products-installation-and-configuration-guides-list.html

If you're only managing a single Firepower device and don't need any of the more advanced features or the ability to examine historical events, drill down into IOCs etc. then FDM may be fine for you.

[balaji.bandi]

i found some good guide :

https://www.cisco.com/c/en/us/td/docs/security/firepower/650/fdm/fptd-fdm-config-guide-650/fptd-fdm-get-started.html

[jimmycher]

Thank you Marvin and BB,

I was expecting the FDM to be similar to ASA, it is not.  

In the FDM, you can not use the CLI to perform most functions, nor can you use it to review what the GUI builds.

Cisco changing the recent nomenclature from SourceFire, then again inside Cisco, has made this a torturous learning process.

It reminds me of the old CiscoWorks, a disjointed amalgam of products thrown together and sold as "seamless"....

It was very, very difficult to find concise instruction.

I did find a FDM seminar in the Cisco Live sessions, which helped considerably.

Best.

[Marvin Rhoads]

You can review the pending changes in the FDM GUI. In fact, this is one of the things FDM is able to do that's not currently a feature in FMC.

https://www.cisco.com/c/en/us/td/docs/security/firepower/650/fdm/fptd-fdm-config-guide-650/fptd-fdm-mgmt.html#task_A962AABC43B3499694DFCDABA932F0ED

By the way I remember CiscoWorks well. I started working with in back in the early 90s when it was available for Sun Solaris and IBM AIX distributions. I used everything from that to CSWI, CiscoView, CiscoWorks 2000, CiscoWorks RWAN and LMS, Prime LMS, Prime NCS, and Prime Infrastructure from 1.1 through the current 3.8. Also the wonderful Netsys product which Cisco acquired then abandoned (sold to Wandel and Goltermann actually where it died a slow painful death).