Change the Manager Access Interface from Management to Data in a High Availability Pair

You can manage the FTD from either the dedicated Management interface, or from a data interface. If you want to change the Cisco Defense Orchestrator access interface after you added the device to CDO, follow these steps to migrate from the Management interface to a data interface. To migrate the other direction, see Change the Manager Access Interface from Data to Management in a High Availability Pair.

Initiating the CDO access migration from Management to data causes the CDO to apply a block on deployment to the FTD. To remove the block, enable CDO access on the data interface.

Note	Unless stated otherwise, perform all steps mentioned in this section only on the active unit. Once the configuration changes are deployed, the standby unit synchronizes configuration and other state information from the active unit.

See the following steps to enable CDO access on a data interface, and also configure other required settings.

Before you begin

Model Support—Threat Defense

Procedure

Step 1

Initiate the interface migration.

In the navigation bar, click Inventory.
Click the FTD tab.
Select the active device and in the Management pane on the right, click Device Summary.
Under the Management area, click the link for Manager Access Interface.

The Manager Access Interface field shows the current management interface. When you click the link, choose the new interface type, Data Interface, in the Manage device by drop-down list.

Note

The link is unavailable for the standby unit as the access interface can be changed on the active unit.
Click Save.

You must now complete the remaining steps in this procedure to enable CDO access on the data interface. The Management area now shows Manager Access Interface: Data Interface, and Manager Access Details: Configuration.
Manager Access

If you click Configuration, the Manager Access - Configuration Details dialog box opens. The Manager Access Mode shows a Deploy pending state.

Step 2

Enable CDO access on a data interface on the Devices > Device Management > Interfaces > Edit Physical Interface > Manager Access page.

See Configure Routed Mode Interfaces.You can enable CDO access on one routed data interface. Make sure this interface is fully configured with a name and IP address and that it is enabled.

Step 3

Make sure the FTD can route to the CDO through the data interface; add a static route if necessary on Devices > Device Management > Routing > Static Route.

See Add a Static Route.

Step 4

(Optional) Configure DNS in a Platform Settings policy, and apply it to this device at Devices > Platform Settings > DNS.

DNS. DNS is required if you use DDNS. You may also use DNS for FQDNs in your security policies.

Step 5

(Optional) Enable SSH for the data interface in a Platform Settings policy, and apply it to this device at Devices > Platform Settings > Secure Shell.

See SSH Access. SSH is not enabled by default on the data interfaces, so if you want to manage the FTD using SSH, you need to explicitly allow it.

Step 6

Deploy configuration changes.

The CDO will deploy the configuration changes over the current Management interface. After the deployment, the data interface is now ready for use, but the original management connection to Management is still active.

Step 7

At the FTD CLI (preferably from the console port), set the Management interface to use a static IP address and set the gateway to use the data interfaces.

configure network {ipv4 | ipv6} manual ip_address netmask data-interfaces

ip_address netmask —Although you do not plan to use the Management interface, you must set a static IP address, for example, a private address so that you can set the gateway to data-interfaces (see the next bullet).
data-interfaces —This setting forwards management traffic over the backplane so it can be routed through the CDO access data interface.

We recommend that you use the console port instead of an SSH connection because when you change the Management interface network settings, your SSH session will be disconnected.

Note	Repeat this step on the standby unit.

Step 8

When the deployment completes around 90 percent, the new management interface takes effect. At this stage, you must re-cable the FTD so that the CDO reaches FTD on the data interface and completes the deployment successfully.

After you re-cable, the deployment may fail if it timed out before re-establishing the management connection to the new interface. In that case, you must reinitiate the deployment after re-cabling for a successful deployment.

Note	Repeat this step on the standby unit.

Step 9

Ensure the management connection is reestablished.

In CDO, check the management connection status on the Devices > Device Management > Device > Management > Manager Access - Configuration Details > Connection Status page.

At the FTD CLI, enter the sftunnel-status-brief command to view the management connection status.

The following status shows a successful connection for a data interface, showing the internal "tap_nlp" interface.

If it takes more than 10 minutes to reestablish the connection, you should troubleshoot the connection. See Troubleshoot Management Connectivity on a Data Interface.