Change the Manager Access Interface from Data to Management in a High Availability Pair

You can manage the FTD from either the dedicated Management interface, or from a data interface. If you want to change the Cisco Defense Orchestrator access interface after you added the device to CDO, follow these steps to migrate from a Data interface to the Management interface. To migrate the other direction, see Change the Manager Access Interface from Management to Data in a High Availability Pair.

Initiating the CDO access migration from data to Management causes the CDO to apply a block on deployment to the FTD. You must disable CDO access on the data interface to remove the block.

Note

Unless stated otherwise, perform all steps mentioned in this section only on the active unit. Once the configuration changes are deployed, the standby unit synchronizes configuration and other state information from the active unit.

See the following steps to disable CDO access on a data interface, and also configure other required settings.

Procedure

Step 1

Initiate the interface migration.

  1. In the navigation bar, click Inventory.

  2. Click the FTD tab.

  3. Select the active device and in the Management pane on the right, click Device Summary.

  4. Under the Management area, click the link for Manager Access Interface.

    The Manager Access Interface field shows the current management interface as data. When you click the link, choose the new interface type, Management Interface, in the Manage device by drop-down list.

    Note

    The link is unavailable for the standby unit as the access interface can be changed on the active unit.

  5. Click Save.

    You must now complete the remaining steps in this procedure to enable CDO access on the data interface. The Management area now shows the Manager Access Interface: Management Interface, and Manager Access Details: Configuration.

    Manager Access

    If you click Configuration, the Manager Access - Configuration Details dialog box opens. The Manager Access Mode shows a Deploy pending state.

Step 2

Disable CDO access on a data interface on the Devices > Device Management > Interfaces > Edit Physical Interface > FMC Access page.

See Configure Routed Mode Interfaces. This step removes the block on deployment.

Step 3

If you have not already done so, configure DNS settings for the data interface in a Platform Setting policy, and apply it to this device at Devices > Platform Settings > DNS.

See DNS. The CDO deployment that disables CDO access on the data interface will remove any local DNS configuration. If that DNS server is used in any security policy, such as an FQDN in an Access Rule, then you must re-apply the DNS configuration using CDO.

Step 4

Deploy configuration changes.

The CDO will deploy the configuration changes over the current data interface.

Step 5

When the deployment completes around 90 percent, the new management interface takes effect. At this stage, you must re-cable the FTD so that the CDO reaches FTD on the Management interface and completes the deployment successfully.

After you re-cable, the deployment may fail if it timed out before re-establishing the management connection to the new interface. In that case, you must reinitiate the deployment after re-cabling for a successful deployment.

Note

Repeat this step on the standby unit.

Step 6

At the FTD CLI, configure the Management interface IP address and gateway using a static IP address or DHCP.

When you originally configured the data interface for CDO access, the Management gateway was set to data-interfaces, which forwarded management traffic over the backplane so it could be routed through the CDO access data interface. You now need to set an IP address for the gateway on the management network.

Static IP address:

configure network {ipv4 | ipv6} manual ip_address netmask gateway_ip

DHCP:

configure network{ipv4 | ipv6} dhcp

Note

Repeat this step on the standby unit.

Step 7

Ensure the management connection is reestablished.

In CDO, check the management connection status on the Devices > Device Management > Device > Management > Status field or view notifications in CDO.

At the FTD CLI, enter the sftunnel-status-brief command to view the management connection status.

If it takes more than 10 minutes to reestablish the connection, you should troubleshoot the connection. See Troubleshoot Management Connectivity on a Data Interface.