Change IP address on Cisco Firepower 1140 via CLI

[BeckyBoo123]

Hey!

I have Googled the life out of this question and I am not getting very far.

I have console access to my 1140 but I cannot gain GUI access to set it up as its still configured with default settings.

I wasn't presented with the setup wizard on the CLI when I first connected to it so I wasn't able to change the LAN IP address.

Is there a way to do it via CLI?

[balaji.bandi]

you can do factory reset :

https://www.cisco.com/c/en/us/td/docs/security/firepower/2100/troubleshoot_fxos/b_2100_CLI_Troubleshoot/b_2100_CLI_Troubleshoot_chapter_011.html

Quick start guide give you to change the information :

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp1100/firepower-1100-gsg/ftd-fdm.html?referring_site=RE&pos=4&page=https://www.cisco.com/c/en/us/support/security/firepower-1140-security-appliance/model.html

[BeckyBoo123]

Hi @balaji.bandi 

Thank you for the information and links.

I have now reset and applied a static IP via the FTD but I still cannot get it to ping back.

For local access on my LAN, should I be using the management interface or Ethernet1/2?

Have I just configured the management port? I think I need to configure Ethernet1/2.

> show network
===============[ System Information ]===============
Hostname                  : firepower
DNS Servers               : 208.67.222.222
                            208.67.220.220
Management port           : 8305
IPv4 Default route
  Gateway                 : 10.11.9.254
  Netmask                 : 0.0.0.0


==================[ management0 ]===================
State                     : Enabled
Link                      : Up
Channels                  : Management & Events
Mode                      : Non-Autonegotiation
MDI/MDIX                  : Auto/MDIX
MTU                       : 1500
MAC Address               : C4:4D:84:B0:01:00
----------------------[ IPv4 ]----------------------
Configuration             : Manual
Address                   : 10.11.9.152
Netmask                   : 255.255.255.0
Gateway                   : 10.11.9.254
----------------------[ IPv6 ]----------------------
Configuration             : Disabled

===============[ Proxy Information ]================
State                     : Disabled
Authentication            : Disabled

root@firepower:/# ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/24 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default
    link/ether ca:b5:11:04:da:fe brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master management0 state UP group default qlen 1000
    link/ether c4:4d:84:b0:01:00 brd ff:ff:ff:ff:ff:ff
    inet 127.128.254.1/24 brd 127.128.254.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::c64d:84ff:feb0:100/64 scope link
       valid_lft forever preferred_lft forever
4: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 00:a0:c9:00:00:00 brd ff:ff:ff:ff:ff:ff
5: eth2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 34:12:78:56:01:01 brd ff:ff:ff:ff:ff:ff
6: eth3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 00:a0:c9:00:00:02 brd ff:ff:ff:ff:ff:ff
7: eth4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 34:12:78:56:01:03 brd ff:ff:ff:ff:ff:ff
8: tap_nlp: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 500
    link/ether 62:60:0a:2d:89:d4 brd ff:ff:ff:ff:ff:ff
    inet 169.254.1.3/29 brd 169.254.1.7 scope global tap_nlp:1
       valid_lft forever preferred_lft forever
    inet6 fd00:0:0:1::3/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::6060:aff:fe2d:89d4/64 scope link
       valid_lft forever preferred_lft forever
9: management0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether c4:4d:84:b0:01:00 brd ff:ff:ff:ff:ff:ff
    inet 10.11.9.152/24 brd 10.11.9.255 scope global management0
       valid_lft forever preferred_lft forever
    inet6 fe80::c64d:84ff:feb0:100/64 scope link
       valid_lft forever preferred_lft forever
10: tap0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 500
    link/ether ea:ad:01:3d:f5:85 brd ff:ff:ff:ff:ff:ff
    inet 127.0.2.2/24 brd 127.0.2.255 scope global tap0
       valid_lft forever preferred_lft forever
11: ccl_ha_tap_nlp: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1300 qdisc pfifo_fast state UP group default qlen 500
    link/ether 8e:f8:dd:53:17:93 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::8cf8:ddff:fe53:1793/64 scope link
       valid_lft forever preferred_lft forever
12: ctl_ha_tap_nlp: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1300 qdisc pfifo_fast state UP group default qlen 500
    link/ether 72:98:4d:85:35:98 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::7098:4dff:fe85:3598/64 scope link
       valid_lft forever preferred_lft forever
13: tap_M0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master management0 state UP group default qlen 500
    link/ether 9e:a3:55:de:0a:d6 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::9ca3:55ff:fede:ad6/64 scope link
       valid_lft forever preferred_lft forever
14: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 500
    link/none
    inet 169.254.0.1/16 scope global tun1
       valid_lft forever preferred_lft forever
    inet6 fdcc::bd:0:ffff:a9fe:1/64 scope global
       valid_lft forever preferred_lft forever

[Amine ZAKARIA]

@BeckyBoo123 ,

Does ping system 10.11.9.254 is working ?

Did you plug the management cable to your computer directly and test? does ping, ssh and/or https works ?

Regards!

[balaji.bandi]

9: management0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default

we can see the management port up, what is your PC IP address ? from PC can you able to ping your gateway? from FTD same you able to ping gateway ?

[Aref Alsouqi]

The FTD wizard can only run once and that would be when the device has never been configured through the wizard. In your case, it seems that the device has already been configured through the wizard, so you won't see the wizard again unless you reimage.

As you have access to the console and you configured the management port, the next step would be to connect the management port to your switch, or to your laptop, and open up the FTD GUI through the web browser.

If you connect the FTD management port to a switch, then that management port and your laptop should be within the same VLAN.  If they are not within the same VLAN then you would need a L3 device to route the traffic between your laptop and the FTD management port.

However, if you don't have a switch or if you want to carry on with the configuration through your laptop, then it would be enough to connect the FTD management port to your laptop, and then configure your laptop with an unused temporary IP within the management port subnet 10.11.9.0/24.

One that is done you just need to open up a browser and navigate to the URL https://10.11.9.152. Once you log into the FTD dashboard, which in this case I assume is gonna be the local management console (FDM), you can carry on with all the device settings as you wish.

Typically we use the console access only to amend the configs related to the device management port, but we don't apply any configs through the console to the user data ports or any other settings. The data ports and all the remaining configs would be done through GUI as mentioned above.

The user data interfaces can be selected as you wish, there is no right or wrong in deciding if the Gi1 would be for the outside or the inside etc, but personally I would always prefer using the lowest interface ID for the untrusted segment, for example, Gi1 for the outside, G2 for the DMZ, G3 for the inside, something like this.