Firepower 2100 series platform can run either FTD or ASA software.
When Firepower 2100 series platform running ASA, has two software, FXOS and ASA. Both have its own management IP address and share same physical Interface Management 1/1.
Both ASA and FXOS has its own authentication, same with SNMP, Syslog and tech-support logs.
Toggle between FXOS & ASA prompt:
From FXOS prompt, you can use "connect asa" to go to ASA prompt, "exit" to come back to FXOS.
From ASA prompt, you can use "connectfxos" to go to FXOS prompt, "exit" to come back to ASA.
When using Console, you'll login to fxos prmpt.
ssh/telnet to ASA Management IP to access ASA.
ssh to fxos management IP to access FXOS.
ASA & FXOS Management:
In order to manage ASA, you have ASDM or CLI (SSH, Telnet). To manager FXOS, we have CLI and FCM-Firepower Chassis Manager - Browser base GUI tool.
FXOS useful configurations:-
The Default IP address for FXOS IP address for FP2100 running ASA is 192.168.45.45.
Verify & Configuring Management IP address for FXOS:-
To Verify FXOS IP address
firepower-2110# scope fabric-interconnect a
firepower-2110 /fabric-interconnect #show detail
Product Name: Cisco FPR 2110
Vendor: Cisco Systems, Inc.
Serial (SN): JMX202820M4
OOB IP Addr: 192.168.45.45
OOB Netmask: 255.255.255.0
OOB Gateway: 192.168.45.1
OOB Gateway Use DataPort: No
OOB Boot Proto: Static
OOB IPv6 Address: ::
OOB IPv6 Gateway: ::
OOB IPv6 Gateway Use DataPort: No
IPv6 Boot Proto: Static
DHCPD Admin State: DHCP Server Enabled
Changing FXOS management IP address:
firepower# scope fabric-interconnect a
firepower /fabric-interconnect # set out-of-band static ip 10.106.143.40 netmask 255.255.255.0 gw 10.106.143.1
firepower /fabric-interconnect* #commit-buffer (Commit buffer to save config)
some time you may get below error:
" Error: Update failed: [Management ipv4 address (IP 10.106.143.40 / net mask 255.255.255.0 ) is not in the same network of current DHCP server IP range 192.168.45.5 - 192.168.45.10. Either disable DHCP server first or config with a different ipv4 address.] "
If you get above error, you need to either disable DHCP or change DHCP range in the same subnet as new Management IP address.
Disabling DHCP Server:
firepower# scope system
firepower /system* #scope services
firepower /system* # disable dhcp-server
firepower /system* # enable dhcp-server 10.106.143.10 10.106.143.20 (To enable DHCP server on FXOS)
Configuring NTP ortimezone on ASA running on FP2100 is restricted. Clock,timezone,ntp need to be configured on FXOS, which will besync to ASA.
firepower# scope system
firepower/system* #scope services
firepower/system/services *# set clockoct6 2017 17 12 00
Hello People,Wondering if anyone recently migrated from ACS to ISE with the latest version of ACS and ISE? I need some help to understand the whole procedure. I have gone through some wonderful documentation on the forum. Would like listen to the recent r...
Hi!I'm using a cisco ASA S690 v11.7.0 and I am trying to execute an APP through a script. For some reason the script doesnt execute automatically through the proxy. I'd like to know if there's something else to setup into the Cisco WSA.When the script is ...
Hi all,is there any reason why I don't see telnet as option on ISE 2.4? Do I need to enable somewhere as feature?It's really annoying if you want to test some connections from ISE. I have ACS 5.8 and telnet is there. ise02/admin# t?tech terminal trac...
I am just trying to understand the difference between the below two NAT statements. As far as I can tell both seem identical?Number 1. allows any outside ip to hit the public ip of FTD 22.214.171.124 on port 80 which gets translated to destination ...
Hi team I planning the upgrade from ise 2.3 to ise 2.4 in a two nodes deployment to a new HW. Already read the upgrade document and I think this is the procedure. ise01a = ise 2.3 primary node (3415)ise02a = ise 2.3 secondary node (3415)ise...