Modify Firewall Threat Defense management interface settings at the CLI

Many management interface settings are set during device initial setup; this task allows you to update them, add event-only interfaces (if supported), or configure static routes, DNS domains, and other advanced settings. Use the CLI when you need direct device access or troubleshooting. If you wish to configure network settings for a data interface used for management, use the device management center interface instead.

Note

This topic applies to the dedicated management interface. You can alternatively configure a data interface for management. If you want to change network settings for that interface, you should do so within Cloud-Delivered Firewall Management Center and not at the CLI. If you need to troubleshoot a disrupted management connection, and need to make changes directly on the Firewall Threat Defense , see Modify the Firewall Threat Defense data interface used for management at the CLI .

For information about the Firewall Threat Defense CLI, see the Cisco Secure Firewall Threat Defense Command Reference .

Before you begin

You can create user accounts that can log into the CLI using the configure user add command ; see Add an internal user at the CLI . You can also configure AAA users according to Configure external authentication .
Be cautious when making changes to the management interface using SSH. If you cannot re-connect because of a configuration error, access the device console port.
In high-availability configurations, when you modify the management IP address of a registered device from the device CLI or from the Cloud-Delivered Firewall Management Center , the standby Cloud-Delivered Firewall Management Center does not reflect the changes even after a high-availability synchronization. To ensure that the standby Cloud-Delivered Firewall Management Center is also updated, switch roles between the two Cloud-Delivered Firewall Management Center s, making the secondary Cloud-Delivered Firewall Management Center as the active unit. Modify the management IP address of the registered device on the Device Management page of the standby Cloud-Delivered Firewall Management Center .

Procedure

Step 1

Connect to the device CLI, either from the console port or using SSH.

Step 2

Step 3

(Firepower 4100/9300 /Secure Firewall 4200 /6100 only) Enable the second management interface as an event-only interface.

configure network management-interface enable management1

configure network management-interface disable-management-channel management1

You always need a management interface for management traffic. If your device has a second management interface, you can enable it for event-only traffic.

(Optional) Disable events for the main management interface using the configure network management-interface disable-events-channel command. In either case, the device will try to send events on the event-only interface, and if that interface is down, it will send events on the management interface even if you disable the event channel.

You cannot disable both event and management channels on an interface.

To use a separate event interface, you must enable an event-only interface on the Cloud-Delivered Firewall Management Center that is dedicated exclusively to event traffic. See the Cisco Secure Firewall Management Center Administration Guide .

Example:

> configure network management-interface enable management1
Configuration updated successfully
> configure network management-interface disable-management-channel management1
Configuration updated successfully
>

Step 4

Configure the IP address of the management interface and/or event interface:

If you do not specify the management_interface argument, then you change the network settings for the default management interface. When configuring an event interface, be sure to specify the management_interface argument. The event interface can be on a separate network from the management interface, or on the same network. If you are connected to the interface you are configuring, you will be disconnected. You can re-connect to the new IP address.

Configure the IPv4 address:
- Manual configuration:
  
  configure network ipv4 manual ip_address netmask gateway_ip [ management_interface ]
  
  Note that the gateway_ip in this command is used to create the default route for the device. If you configure an event-only interface, then you must enter the gateway_ip as part of the command; however, this entry just configures the default route to the value you specify and does not create a separate static route for the eventing interface. If you are using an event-only interface on a different network from the management interface, we recommend that you set the gateway_ip for use with the management interface, and then create a static route separately for the event-only interface using the configure network static-routes command.
  
  Example:
```
> configure network ipv4 manual 10.10.10.45 255.255.255.0 10.10.10.1 management1
Setting IPv4 network configuration.
Network settings changed.
>
```
- DHCP (supported on the default management interface only):
  
  configure network ipv4 dhcp
Configure the IPv6 address:
- Stateless autoconfiguration:
  
  configure network ipv6 router [ management_interface ]
  
  Example:
```
> configure network ipv6 router management0
Setting IPv6 network configuration.
Network settings changed.
>
```
- Manual configuration:
  
  configure network ipv6 manual ip6_address ip6_prefix_length [ ip6_gateway_ip ] [ management_interface ]
  
  Note that the ipv6_gateway_ip in this command is used to create the default route for the device. If you configure an event-only interface, then you must enter the ipv6_gateway_ip as part of the command; however, this entry just configures the default route to the value you specify and does not create a separate static route for the eventing interface. If you are using an event-only interface on a different network from the management interface, we recommend that you set the ipv6_gateway_ip for use with the management interface, and then create a static route separately for the event-only interface using the configure network static-routes command.
  
  Example:
```
> configure network ipv6 manual 2001:0DB8:BA98::3210 64 management1
Setting IPv6 network configuration.
Network settings changed.
>
```
- DHCPv6 (supported on the default management interface only):
  
  configure network ipv6 dhcp
For IPv6, enable or disable ICMPv6 Echo Replies and Destination Unreachable messages. These messages are enabled by default.

configure network ipv6 destination-unreachable { enable | disable }

configure network ipv6 echo-reply { enable | disable }

You might want to disable these packets to guard against potential denial of service attacks. Disabling Echo Reply packets means you cannot use IPv6 ping to the device management interfaces for testing purposes.
Example:
```
> configure network ipv6 destination-unreachable disable
> configure network ipv6 echo-reply disable
```

Step 5

Enable a DHCP server on the default management interface to provide IP addresses to connected hosts:

configure network ipv4 dhcp-server-enable start_ip_address end_ip_address

Example:

> configure network ipv4 dhcp-server-enable 10.10.10.200 10.10.10.254
DHCP Server Enabled
>

You can only configure a DHCP server when you set the management interface IP address manually. This command is not supported on the Firewall Management Center Virtual . To display the status of the DHCP server, enter show network-dhcp-server :

> show network-dhcp-server
DHCP Server Enabled
10.10.10.200-10.10.10.254

Step 6

Add a static route for the event-only interface if the Cloud-Delivered Firewall Management Center is on a remote network. Otherwise, all traffic will match the default route through the management interface.

configure network static-routes { ipv4 | ipv6 } add management_interface destination_ip netmask_or_prefix gateway_ip

For the default route, do not use this command; you can only change the default route gateway IP address when you use the configure network ipv4 or ipv6 commands (see Step 4 ).

Example:

> configure network static-routes ipv4 add management1 192.168.6.0 255.255.255.0 10.10.10.1
Configuration updated successfully
> configure network static-routes ipv6 add management1 2001:0DB8:AA89::5110 64 2001:0DB8:BA98::3211
Configuration updated successfully
>

To display static routes, enter show network-static-routes (the default route is not shown):

> show network-static-routes
---------------[ IPv4 Static Routes ]---------------
Interface                 : management1
Destination               : 192.168.6.0
Gateway                   : 10.10.10.1
Netmask                   : 255.255.255.0
[…]

Step 7

Do these settings:

Set the hostname:

configure network hostname name
Example:
```
> configure network hostname farscape1.cisco.com
```
Syslog messages do not reflect a new hostname until after a reboot.
Set the search domains:

configure network dns searchdomains domain_list
Example:
```
> configure network dns searchdomains example.com,cisco.com
```
Set the search domain(s) for the device, separated by commas. These domains are added to hostnames when you do not specify a fully-qualified domain name in a command, for example, ping system . The domains are used only on the management interface, or for commands that go through the management interface.
Set up to 3 DNS servers, separated by commas:

configure network dns servers dns_ip_list
Example:
```
> configure network dns servers 10.10.6.5,10.20.89.2,10.80.54.3
```

Set the remote management port for communication with the Cloud-Delivered Firewall Management Center :

configure network management-interface tcpport number

Example:

> configure network management-interface tcpport 8555

The Cloud-Delivered Firewall Management Center and managed devices communicate using a two-way, TLS-1.3-encrypted communication channel, which by default is on port 8305. Do not change the management port when using multi-instance mode; only port 8305 is supported.

Note

We recommend that you keep the default settings for the remote management port, but if the management port conflicts with other communications on your network, you can choose a different port. If you change the management port, you must change it for all devices in your deployment that need to communicate with each other.

( Firewall Threat Defense only) Set the management or eventing interface MTU. The MTU is 1500 bytes by default.
configure network mtu [ bytes ] [ interface_id ]
- bytes —Sets the MTU in bytes. For the management interface, the value can be between 64 and 1500 if you enable IPv4, and 1280 to 1500 if you enable IPv6. For the eventing interface, the value can be between 64 and 9000 if you enable IPv4, and 1280 to 9000 if you enable IPv6. If you enable both IPv4 and IPv6, then the minimum is 1280. If you do not enter the bytes , you are prompted for a value.
- interface_id —Specifies the interface ID on which to set the MTU. Use the show network command to see available interface IDs, for example management0, management1, br1, and eth0, depending on the platform. If you do not specify an interface, then the management interface is used.
Example:
```
> configure network mtu 8192 management1
MTU set successfully to 1500 from 8192 for management1
Refreshing Network Config...
NetworkSettings::refreshNetworkConfig MTU value at start 8192
Interface management1 speed is set to '10000baseT/Full'
NetworkSettings::refreshNetworkConfig MTU value at end 8192
>
```
Configure an HTTP proxy. The device is configured to directly connect to the internet on ports TCP/443 (HTTPS) and TCP/80 (HTTP). You can use a proxy server, to which you can authenticate via HTTP Digest. After issuing the command, you are prompted for the HTTP proxy address and port, whether proxy authentication is required, and if it is required, the proxy username, proxy password, and confirmation of the proxy password.

Note
For proxy password on Firewall Threat Defense , you can use A-Z, a-z, and 0-9 characters only.

configure network http-proxy
Example:
```
> configure network http-proxy
Manual proxy configuration
Enter HTTP Proxy address: 10.100.10.10
Enter HTTP Proxy Port: 80
Use Proxy Authentication? (y/n) [n]: Y
Enter Proxy Username: proxyuser
Enter Proxy Password: proxypassword
Confirm Proxy Password: proxypassword
```

Step 8

If you change the device management IP address, then see the following tasks for Cloud-Delivered Firewall Management Center connectivity. Perform these tasks depending on how you identified the Cloud-Delivered Firewall Management Center during initial device setup using the configure manager add command :

IP address — No action. If you identified the Cloud-Delivered Firewall Management Center using a reachable IP address, then the management connection will be reestablished automatically after several minutes. We recommend that you also change the device IP address shown in Cloud-Delivered Firewall Management Center to keep the information in sync; see Update the Hostname or IP Address in the Cloud-Delivered Firewall Management Center. This action can help reestablish the connection faster. If you specified an unreachable Cloud-Delivered Firewall Management Center IP address, then you must manually reestablish the connection using Update the Hostname or IP Address in the Cloud-Delivered Firewall Management Center
NAT ID only — Manually reestablish the connection. If you identified the Cloud-Delivered Firewall Management Center using only the NAT ID, then the connection does not automatically reestablish. In this case, change the device management IP address in Cloud-Delivered Firewall Management Center according to Update the Hostname or IP Address in the Cloud-Delivered Firewall Management Center .