Modify the Firewall Threat Defense Data Interface Used for Management at the CLI

If the management connection between the Firewall Threat Defense and the Firewall Management Center was disrupted, and you want to specify a new data interface to replace the old interface, use the Firewall Threat Defense CLI to configure the new interface.

If the management connection is active, then you should make any changes to an existing data interface using the Firewall Management Center (see Modify the Firewall Threat Defense Data Interface Used for Management in the GUI). For initial setup of the data management interface, see the configure network management-data-interface command.

For high-availability pairs, perform all CLI steps on both units. Within the Firewall Management Center, perform steps only on the active unit. Once the configuration changes are deployed, the standby unit synchronizes configuration and other state information from the active unit.

Note	This topic applies to the data interface that you configured for Management, not the dedicated Management interface. If you want to change network settings for the Management interface, see Modify Firewall Threat Defense Management Interfaces at the CLI.

For information about the Firewall Threat Defense CLI, see the Cisco Secure Firewall Threat Defense Command Reference.

Procedure

Step 1

If you are changing the data management interface to a new interface, move the current interface cable to the new interface.

Step 2

Connect to the device CLI.

You should use the console port when using these commands. If you are performing initial setup, then you may be disconnected from the Management interface. If you are editing the configuration due to a disrupted management connection, and you have SSH access to the dedicated Management interface, then you can use that SSH connection.

Step 3

Step 4

Disable the interface so you can reconfigure its settings.

configure network management-data-interface disable

Note	If you only want to set a new IPv4 address on the same interface and not make any other changes, you can skip this step. Other changes require you to disable the interface first.

Example:


> configure network management-data-interface disable

 Configuration updated successfully..!!


Configuration disable was successful, please update the default route to point to a gateway on management interface using the command 'configure network'

Step 5

Configure the new data interface for manager access.

configure network management-data-interface

You are then prompted to configure basic network settings for the data interface.

If you change the data management interface to a new interface on the same network, use the same settings as for the previous interface except the interface ID. In addition, for the Do you wish to clear all the device configuration before applying ? (y/n) [n]: option, choose y. This choice will clear the old data management interface configuration, so that you can successfully reuse the IP address and interface name on the new interface.


> configure network management-data-interface
Data interface to use for management: ethernet1/4
Specify a name for the interface [outside]: internet
IP address (manual / dhcp) [dhcp]: manual
IPv4/IPv6 address: 10.10.6.7
Netmask/IPv6 Prefix: 255.255.255.0
Default Gateway: 10.10.6.1
Comma-separated list of DNS servers [none]: 208.67.222.222,208.67.220.220
DDNS server update URL [none]:
Do you wish to clear all the device configuration before applying ? (y/n) [n]: y

Configuration done with option to allow manager access from any network, if you wish to change the manager access network
use the 'client' option in the command 'configure network management-data-interface'.

Setting IPv4 network configuration.
Network settings changed.

>

Step 6

(Optional) Limit data interface access to the Firewall Management Center on a specific network.

configure network management-data-interface client ip_address netmask

By default, all networks are allowed.

Step 7

Update the Hostname or IP Address in the Firewall Management Center.

The connection may be reestablished automatically, but disabling and reenabling the connection in the Firewall Management Center will help the connection reestablish faster. Or you may need to update the device IP address in the Firewall Management Center according to the linked procedure.

Step 8

Check that the management connection was reestablished.

sftunnel-status-brief

See the following sample output for a connection that is up, with peer channel and heartbeat information shown:


> sftunnel-status-brief
PEER:10.10.17.202
Peer channel Channel-A is valid type (CONTROL), using 'eth0', connected to '10.10.17.202' via '10.10.17.222'
Peer channel Channel-B is valid type (EVENT), using 'eth0', connected to '10.10.17.202' via '10.10.17.222'
Registration: Completed.
IPv4 Connection to peer '10.10.17.202' Start Time: Wed Jun 10 14:27:12 2020 UTC
Heartbeat Send Time: Mon Jun 15 09:02:08 2020 UTC
Heartbeat Received Time: Mon Jun 15 09:02:16 2020 UTC

Step 9

In the Firewall Management Center, choose Devices > Device Management, and click Edit ( edit icon ). In the Device > Management area, click Refresh next to Manager Access - Configuration Details.

The Firewall Management Center detects the interface and default route configuration changes and blocks deployment to the device. When you change the data interface settings locally on the device, you must reconcile those changes in the Firewall Management Center manually. You can view the discrepancies between the Firewall Management Center and the device on the Configuration tab.

Step 10

Choose Interfaces, and make the following changes.

Remove the IP address and name from the old data management interface and disable manager access for this interface.
Configure the new data management interface with the new settings (the ones you used at the CLI) and enable manager access for it.

Step 11

Choose Routing > Static Route and change the default route from the old data management interface to the new one.

Step 12

Return to the Manager Access - Configuration Details dialog box, and click Acknowledge to remove the deployment block.

The next time you deploy, the Firewall Management Center configuration will overwrite any remaining conflicting settings on the Firewall Threat Defense. It is your responsibility to manually fix the configuration in the Firewall Management Center before you re-deploy.

You will see expected messages of "Config was cleared” and “Manager access changed and acknowledged.”