usernames. In this case, an administrator might be able to see this information when working with the
configuration or when using SNMP.
• How Remote Management Works, on page 124
• Before You Start, on page 125
• End-to-End Procedure, on page 126
• Central Administrator Pre-Configuration Using the CLI, on page 127
• Branch Office Installation, on page 132
• Central Administrator Post-Configuration, on page 134
How Remote Management Works
To allow the FMC to manage the FTD over the internet, you use the outside interface for FMC management
instead of the Management interface. Because most remote branch offices only have a single internet connection,
outside FMC access makes centralized management possible.
You can use any data interface for FMC access, for example, the inside interface if you have an inside FMC.
However, this guide primarily covers outside interface access, because it is the most likely scenario for remote
branch offices.
Note
The Management interface is a special interface configured separately from FTD data interfaces, and it has
its own network settings. The Management interface network settings are still used even though you are
enabling FMC access on a data interface. All management traffic continues to be sourced from or destined to
the Management interface. When you enable FMC access on a data interface, the FTD forwards incoming
management traffic over the backplane to the Management interface. For outgoing management traffic, the
Management interface forwards the traffic over the backplane to the data interface.
FMC access from a data interface has the following limitations:
• You can only enable FMC access on one physical, data interface. You cannot use a subinterface or
EtherChannel.
• This interface cannot be management-only.
• Routed firewall mode only, using a routed interface.
• High Availability is not supported. You must use the Management interface in this case.
• PPPoE is not supported. If your ISP requires PPPoE, you will have to put a router with PPPoE support
between the FTD and the WAN modem.
• The interface must be in the global VRF only.
• You cannot use separate management and event-only interfaces.
• SSH is not enabled by default for data interfaces, so you will have to enable SSH later using FMC.
Because the Management interface gateway will be changed to be the data interfaces, you also cannot
Cisco Firepower 1010 Getting Started Guide
124
Firepower Threat Defense Deployment with a Remote FMC
How Remote Management Works
To Next Page
Loading...
Need help?
General