Modify the Threat Defense Data Interface Used for Management at the CLI
If the management connection between the threat defense and the management center was disrupted, and you want to specify a new data interface to replace the old interface, use the threat defense CLI to configure the new interface. This procedure assumes you want to replace the old interface with a new interface on the same network. If the management connection is active, then you should make any changes to an existing data interface using the management center. For initial setup of the data management interface, see the configure network management-data-interface command.
For high-availability pairs, perform all CLI steps on both units. Within the management center, perform steps only on the active unit. Once the configuration changes are deployed, the standby unit synchronizes configuration and other state information from the active unit.
Note | This topic applies to the data interface that you configured for Management, not the dedicated Management interface. If you want to change network settings for the Management interface, see Modify Threat Defense Management Interfaces at the CLI. |
For information about the threat defense CLI, see the Cisco Secure Firewall Threat Defense Command Reference.
Before you begin
You can create user accounts that can log into the CLI using the configure user add command. You can also configure AAA users according to External Authentication.
Procedure
Step 1 | If you are changing the data management interface to a new interface, move the current interface cable to the new interface. |
Step 2 | Connect to the device CLI. You should use the console port when using these commands. If you are performing initial setup, then you may be disconnected from the Management interface. If you are editing the configuration due to a disrupted management connection, and you have SSH access to the dedicated Management interface, then you can use that SSH connection. |
Step 3 | Log in with the Admin username and password. |
Step 4 | Disable the interface so you can reconfigure its settings. configure network management-data-interface disable Example: |
Step 5 | Configure the new data interface for manager access. configure network management-data-interface You are then prompted to configure basic network settings for the data interface. When you change the data management interface to a new interface on the same network, use the same settings as for the previous interface except the interface ID. In addition, for the Do you wish to clear all the device configuration before applying ? (y/n) [n]: option, choose y. This choice will clear the old data management interface configuration, so that you can successfully reuse the IP address and interface name on the new interface. |
Step 6 | (Optional) Limit data interface access to the management center on a specific network. configure network management-data-interface client ip_address netmask By default, all networks are allowed. |
Step 7 | The connection will be reestablished automatically, but disabling and reenabling the connection in the management center will help the connection reestablish faster. See Update the Hostname or IP Address in the Management Center. |
Step 8 | Check that the management connection was reestablished. sftunnel-status-brief See the following sample output for a connection that is up, with peer channel and heartbeat information shown: |
Step 9 | In the management center, choose , and click Refresh. The management center detects the interface and default route configuration changes, and blocks deployment to the threat defense. When you change the data interface settings locally on the device, you must reconcile those changes in the management center manually. You can view the discrepancies between the management center and the threat defense on the Configuration tab. |
Step 10 | Choose , and make the following changes.
|
Step 11 | Choose and change the default route from the old data management interface to the new one. |
Step 12 | Return to the Manager Access - Configuration Details dialog box, and click Acknowledge to remove the deployment block. The next time you deploy, the management center configuration will overwrite any remaining conflicting settings on the threat defense. It is your responsibility to manually fix the configuration in the management center before you re-deploy. You will see expected messages of "Config was cleared” and “Manager access changed and acknowledged.” |