cisco firepower 2100 fxos cli configuration guide

enter it takes to generate an RSA key pair. cipher_suite_string. email-addr. seconds. By default, AES-128 encryption is disabled. If the passphrases are specified in clear text, you can specify a maximum of 80 characters. Encryption keys can vary in gw The chassis supports the HMAC-SHA-96 (SHA) authentication protocol for SNMPv3 users. eth-uplink, scope (For RSA) Set the SSL key length in bits. Because the DHCP server is enabled by default on Management 1/1, you must disable DHCP before you change the management IP month day year hour min sec. set expiration-warning-period Firepower 2100 uses NTP version 3. scope By default, a self-signed SSL certificate is generated for use with the chassis manager. CLI, or Elliptic Curve Digital Signature Algorithm (ECDSA) encryption keys, , curve25519, ecp256, ecp384, ecp521, modp3072, modp4096, Secure Firewall chassis system, scope Strong password check is enabled by default. create set tr Translates, squeezes, and/or deletes For FIPS mode, the IPSec peer must support RFC 7427. scope Specify the IP address or FQDN of the Firepower 2100. phone-num. To set the gateway to the ASA data interfaces, set the gw to ::. The documentation set for this product strives to use bias-free language. Specify the port to be used for the SNMP trap. You can log in with any username (see Add a User). System clock modifications take set syslog file level {emergencies | alerts | critical | errors | warnings | notifications | information | debugging}. Repeat Password: ******, Introduction to FXOS for Firepower 2100 ASA Platform Mode, Commit, Discard, and View Pending Commands, Save and Filter Show Command Output, Filter Show Command Output, Save Show Command Output, Configure Certificates, Key Rings, and Trusted Points for HTTPS or IPSec, About Certificates, Key Rings, and Trusted Points, Regenerate the Default Key Ring Certificate, Configure the DHCP Server for Management Clients, Supported Combinations of SNMP Security Models and Levels, Change the FXOS Management IP Addresses or Gateway, http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite, Cisco Firepower 2100 FXOS MIB Reference the actual passwords. We recommend that you first set FIPS mode on the ASA, wait for the device to reload, and then set FIPS mode in FXOS. start_ip end_ip. Cisco Firepower 2100 ASA Platform Mode FXOS Configuration Guide, View with Adobe Reader on a variety of devices. interface_id, set Saving and filtering output are available with all show commands but out-of-band static Must include at least one non-alphanumeric (special) character. trustpoint Several of these subcommands have additional options that let you further control the filtering. The strong password check is enabled by default. You can, however, configure the account with the latest expiration date available. The default is no limit (none). (exclamation point), + (plus sign), - (hyphen), and : (colon). A locally-authenticated user account can be enabled or disabled by anyone with admin privileges. despite the failure. an upgrade. You can optionally configure a minimum password length of 15 characters on the system, to comply with Common Criteria requirements. Display the certificate request, copy the request, and send it to the trust anchor or certificate authority. Copy the text of the certificate request, including the BEGIN and END lines, and save it in a file. can show all or parts of the configuration by using the show a connection, loss of connection to a neighbor router, or other significant events. single or double-quotesthese will be seen as part of the expression. For example, if you set the history count to 3, and the reuse After you change the management IP address, you need to reestablish any chassis manager and SSH connections using the new address. The chassis uses the privacy password to generate a 128-bit AES key. mode is set to Active; you can change the mode to On at the CLI. the FXOS CLI. These notifications do not require that no-more Turns off pagination for command output. DNS is required to communicate with the NTP server. SNMPv3 provides secure access to devices by a combination of authenticating and encrypting frames over the network. For IPSec, enforcement is enabled by default, except for connections created prior to 9.13(1); you must manually To disallow changes, set the set change-interval to disabled . The following example sets many user requirements: You can upgrade the ASA package, reload, or power off the chassis. The system contact name can be any alphanumeric string up to 255 characters, such as an email address or name and telephone wc Displays a count of lines, words, and The old limit was 80 characters. DNS is configured by default with the following OpenDNS servers: 208.67.222.222, 208.67.220.220. enter set After you complete the HTTPS configuration, including changing the port and key ring to be used by HTTPS, all current HTTP FXOS rejects any password that does not meet the following requirements: Must contain a minimum of 8 characters and a maximum of 127 characters. Do not enclose the expression in set community reconfigure the account to not expire. These vulnerabilities are due to insufficient input validation. The following example enables HTTPS, sets the port number to 4443, sets the key ring name to kring7984, and sets the Cipher manager, Secure Firewall eXtensible set If the system clock is currently being synchronized with an NTP server, you will not be able to set the ip/mask, set last-name. cisco cisco firepower threat defense configuration guide for firepower cisco . with the other key. Specify the city or town in which the company requesting the certificate is headquartered. to authentication based on the Cipher Block Chaining (CBC) DES (DES-56) standard. View the current management IPv6 address. {active| inactive}. of ASDM, you should either upgrade ASDM before you upgrade the bundle, or you should reconfigure the ASA to use the bundled (Optional) Set the Child SA lifetime in minutes (30-480): set keyring_name. minutes. New/Modified FXOS commands: enable ntp-authentication, set ntp-sha1-key-id, set ntp-sha1-key-string. ipv6-block New/Modified commands: set elliptic-curve , set keypair-type. SNMPv3 and privileges. If you We recommend that you perform these steps at the console; otherwise, you can be disconnected from your SSH session. set output to a specified text file using the selected transport protocol. superuser account and has full privileges. If you change the gateway from the default The AES privacy password can have a minimum of eight CLI. ip_address mask, no http 192.168.45.0 255.255.255.0 management, http port-channel-mode {active | on}. the Firepower 2100 uses the default key ring with a self-signed certificate. The level options are listed in order of decreasing urgency. log-level Provides authentication based on the HMAC-SHA algorithm. If you configure remote management (the larger-capacity interface. ASDM images that you upload manually do not appear in the FXOS image list; you must manage ASDM images from the ASA. Also, object command, which will give an error if an object already exists. By default, the server is enabled with Specify the state or province in which the company requesting the certificate is headquartered. object. a. Display the contents of the imported certificate, and verify that the Certificate Status value displays as Valid . https | snmp | ssh}. data interface nor will FXOS be able to initiate traffic on a data interface. set Depending on the model, you use FXOS for configuration and troubleshooting. set All users are assigned the read-only role by default, and this role cannot be removed. Must include at least one lowercase alphabetic character. filesize. In the show package output, copy the Package-Vers value for the security-pack version number. extended-type pattern. create command, and then view the key ID and value in the ntp.keys file. manually enable enforcement for those old connections. enable dhcp-server Specify the trusted point that you created earlier. local-address admin-duplex {fullduplex | halfduplex}. The following example sets the domain name to example.com: You need to specify a DNS server if the system requires resolution of hostnames to IP addresses. certchain [certchain]. If you use the no-prompt keyword, the chassis will shut down immediately after entering the command. Create an access list for the services to which you want to enable access. DHCP (see Change the FXOS Management IP Addresses or Gateway). cert. If you want to change the management IP address, you must disable same speed and duplex. An EtherChannel (also known as a port-channel) can include up to 8 member interfaces of the You must be a user with admin privileges to add or edit a local user account. no The SA enforcement check passes, and the connection is successful. prefix_length The certificate must be in Base64 encoded X.509 (CER) format. the SHA1 key on NTP server Version 4.2.8p8 or later with OpenSSL installed, enter the ntp-keygen (Optional) Assign the admin role to the user. An SNMP manager that receives an inform request acknowledges the message with an SNMP response protocol data unit (PDU). For information about supported MIBs, see the Cisco Firepower 2100 FXOS MIB Reference defining a certification path to the root certificate authority (CA). Copy and paste the entire text block at the FXOS CLI. You can reenable DHCP using new client IP addresses after you change the management IP address. The privilege level for FXOS management traffic. The system location name can be any alphanumeric string up to 512 characters. FXOS CLI. default level is Critical. ConfiguringtheRolePolicyforRemoteUsers 43 EnablingPasswordStrengthCheckforLocallyAuthenticatedUsers 44 SettheMaximumNumberofLoginAttempts 44 . manager and FXOS CLI access. ip-block community-name. keyring-passwd configuration file already exists, which you can choose to overwrite or not. You can now use EDCS keys for certificates. 5 Helpful Share Reply jimmycher The following example The first time a new client browser display an authentication warning. | character. show command [ > { ftp:| scp:| sftp:| tftp:| volatile: | workspace:} ] | [ >> { volatile: | workspace:} ], > { ftp:| scp:| sftp:| tftp:| volatile: | workspace:}. show command upon which security model is implemented. receiver decrypts the message using its own private key. The enable password is not set. port_num. year Sets the year as 4 digits, such as 2018. hour Sets the hour in 24-hour format, where 7 pm is entered as 19. noneDisables the limit. If you want to allow access from other networks, or to allow Multiple vulnerabilities in the CLI of Cisco FXOS Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute commands on the underlying operating system (OS) with root privileges. prefix_length {https | snmp | ssh}, enter Similarly, to keep the existing management IP address while changing the gateway, omit the ipv6 and ipv6-prefix keywords. The cipher_suite_string can contain up to 256 characters and must conform to the OpenSSL Cipher Suite specifications. set https port authorizes management operations only by configured users and encrypts SNMP messages. IP] [MASK] [Mgmt GW] Upload the certificate you obtained from the trust anchor or certificate authority. Traps are less reliable than informs because the SNMP You can also change the default gateway (Optional) If you set the cipher suite mode to custom , specify the custom cipher suite. Specify the message that FXOS displays to the user before they log into the chassis manager or the FXOS Paste in the certificate chain. and HTTPS sessions are closed without warning as soon as you save or commit the transaction. communication between SNMP managers and agents. You must configure DNS (see Configure DNS Servers) if you enable this feature. The BEGIN CERTIFICATE and END CERTIFICATE flags. The set https cipher-suite Specify the email address associated with the certificate request. You are prompted to enter the SNMP community name. days Set the number of days before expiration to warn the user about their password expiration at each login, between 0 and 9999. curve25519 is not supported in FIPS or Common Criteria mode. Only SHA1 is supported for NTP server authentication. value to use when computing the message digest. the chassis does not receive the PDU, it can send the inform request again. If If the password strength check is enabled, each user must have a strong You cannot upgrade ASA and FXOS separately from each other; they are always bundled together. We recommend a value of 2048. the CA's private key. The default is 3 days. netmask For example, the password must not be based on a standard dictionary word. Both SNMPv1 and SNMPv2c use a community-based form of security. (USM) refers to SNMP message-level security and offers the following services: Message integrityEnsures that messages have not been altered or destroyed in an unauthorized manner and that data sequences pass-change-num. keyring-name set An Unexpected Error has occurred. firepower-2110 /security/password-profile* # set password-reuse-interval 120, Password: a device's public key along with signed information about the device's identity. You can use the enter the The admin account is always active and does not expire. The username is used as the login ID for the Secure Firewall chassis Enable or disable the writing of syslog information to a syslog file. ip_address. If you connect to the ASA management IP address using SSH, enter connect fxos to access FXOS. Set the absolute session timeout for all forms of access including serial console, SSH, and HTTPS. Notifications can indicate improper user authentication, restarts, the closing of Configure an IPv6 management IP address and gateway. set change-interval clock. Ignore the message, "All existing configuration will be lost, and the default configuration applied." admin-speed {10mbps | 100mbps | 1gbps | 10gbps}. object, scope The larger the key modulus size you specify, the longer You can filter the output of When a user logs into the FXOS CLI, the terminal displays the banner text before it prompts for the password. To use an interface, it must set port Set the key type to RSA (the default) or ECDSA. configure network ipv4 manual [Mgmt. ntp-authentication, set While any commands are pending, an asterisk (*) appears before the set phone Connections that were previously not established are retried. The other commands allow you to trustpoint_name. ViewingCurrentSNMPSettings 73 ConfiguringHTTPS 74 Certificates,KeyRings,andTrustedPoints 74 CreatingaKeyRing 75 RegeneratingtheDefaultKeyRing 75 . Note that all security policy and other operations are configured in the ASA OS (using CLI or ASDM). Cisco FXOS Troubleshooting Guide for the Firepower 1000/2100 and Secure Firewall 3100 with Firepower Threat Defense Chapter Title FXOS CLI Troubleshooting Commands PDF - Complete Book (2.02 MB)PDF - This Chapter (1.08 MB) View with Adobe Reader on a variety of devices ePub - Complete Book month Sets the month as the first three letters of the month name, such as jan for January. grep Displays only those lines that match the as a client's browser and the Firepower 2100. retry_number. Clock set expiration Changes in user roles and privileges do not take effect until the next time the user logs in. If you connect at the console port, you access the FXOS CLI immediately. SettheMaximumNumberofLoginAttempts 44 ViewandClearUserLockoutStatus 45 ConfiguringtheMaximumNumberofPasswordChangesforaChangeInterval 46 . SettheMaximumNumberofLoginAttempts 44 ViewandClearUserLockoutStatus 45 ConfiguringtheMaximumNumberofPasswordChangesforaChangeInterval 46 . You can then reenable DHCP for the new network. set https keyring Enable or disable whether a locally-authenticated user can make password changes within a given number of hours. Specify the URL for the file being imported using one of the following: When the new package finishes downloading (Downloaded state), boot the package. is a persistent console connection, not like a Telnet or SSH connection. set history-count | after the Committing multiple commands all together is not a singular operation. Established connections remain untouched. a device can generate its own key pair and its own self-signed certificate. enter snmp-user individual interfaces. num_of_passwords Specify the number of unique passwords that a locally-authenticated user must create before that user can reuse a previously-used out-of-band static For copper interfaces, this duplex is only used if you disable autonegotiation. ipv6-config. set password-expiration {days | never} Set the expiration between 1 and 9999 days. device_name. The minutes value can be any integer between 60-1440, inclusive. of a ntp-sha1-key-string, enable (Optional) For copper ports, set the interface duplex mode for all members of the port-channel to override the properties set on the Set the scope for fabric-interconnect a, and then the IPv6 configuration. The SubjectName and at least one DNS SubjectAlternateName name is required. Only Ethernet 1/1 and Ethernet 1/2 are enabled by default in both FXOS and the ASA. setting, set the value to 0. Before generating the Certificate Signing Request, all hostnames are resolved using DNS. Note that in the following syntax description, set https cipher-suite-mode min_length. set auth Enables authentication but no encryption, noauth Does not enable authentication or encryption, priv Enables authentication and encryption. The security model combines with the selected security set volume scope SNMP, you must add or change the Access Lists. the initial vertical bar not be erased, and the default configuration is not applied. default-auth, set absolute-session-timeout The following example enables the DHCP server: Logs are useful both in routine troubleshooting and in incident handling. show command | { begin expression| count| cut expression| egrep expression| end expression| exclude expression| grep expression| head| include expression| last| less| no-more| sort expression| tr expression| uniq expression| wc}. You can use the FXOS CLI or the GUI chassis In a text file, paste the root certificate at the top, followed by each intermediate certificate in the chain, including all Operating System (FXOS) operates differently from the ASA CLI. yes If the IKE-negotiated key size is less then the ESP-negotiated key size, then the connection fails. password, between 0 and 15. (Optional) Specify the user phone number. output of (question mark), and = (equals sign). traps Sets the type to traps if you select v2c or v3 for the version. When you enter a configuration command in the CLI, the command is not applied until you save the configuration. New/Modified commands: set https access-protocols. When you upgrade the bundle, the ASDM image in the bundle replaces the previous ASDM bundle image because they have the same Member interfaces in EtherChannels do not appear in this list. You cannot create an all-numeric login ID. An attacker could exploit these vulnerabilities by including crafted arguments to specific CLI . The modulus value (in bits) is in multiples of 8 from 1024 to 2048. days Set the number of days a user has to change their password after expiration, between 0 and 9999. create and manage user-instantiated objects. ip of your device. dns {ipv4_addr | ipv6_addr}. delete The default address is 192.168.45.45. tunnel_or_transport, set System clock modifications take effect immediately. For ASA syslog messages, you must configure logging in the ASA configuration. remote-subnet The ASA, ASDM, and FXOS images are bundled together into a single package. set admin-state From the FXOS CLI, you can then connect to the ASA console, port-num. configuration command. For each block of IP addresses (v4 or v6), up to 25 different subnets can be configured for each service. The admin account is a default user account and cannot be modified or deleted. Firepower eXtensible Operating System (FXOS) CLI On Firepower 2100, 4100, and 9300 series devices, FXOS is the operating system that controls the overall chassis. After you create the user, the login ID cannot be changed. ip_address min-password-length On the management computer connected to Management 1/1, SSH to the management IP address (by default https://192.168.45.45, You are prompted to enter and confirm the privacy password. chassis Typically, the FXOS Management 1/1 IP address will be on the same network as the ASA Management 1/1 IP address, so this procedure a configuration command is pending and can be discarded. authority The default is 3600 seconds (60 minutes). If a user is logged in when time The following example You can configure FQDN enforcement so that the FDQN of the peer needs to match the DNS Name in the X.509 Certificate presented output to the appropriate text file, which must already exist. url. prefix [https | snmp | ssh]. minutes. ASDM image (asdm.bin) just before upgrading the ASA bundle. To return to the ASA CLI, enter exit or type Ctrl-Shift-6, x. The following example shows how the prompts change during the command entry process: You can save the and specify a syslog server by the unqualified name of jupiter, then the Firepower 2100 qualifies the name to jupiter.example.com., set domain-name regenerate yes. This method provides a shortcut to set these parameters, because these parameters must match for all interfaces in the port-channel. manager, chassis We suggest setting the connecting switch ports to Active need a third party serial-to-USB cable to make the connection. in multiple command modes and apply them together. interface_id. The set lacp-mode command was changed to set port-channel-mode to match the command usage in the Firepower 4100/9300. show command The following example regenerates the default key ring: The HTTPS service is enabled on port 443 by default. You must manually regenerate default key ring certificate if the certificate expires. SNMP agent. If you configure remote management, SSH to To configure SSH access to the chassis, do one of the following: set ssh-server encrypt-algorithm you must generate a certificate request through FXOS and submit the request to a trusted point. Enter security mode, and then banner mode. for a user and the role in which the user resides.