Cisco FPR1010-ASA-K9 Getting Started Manual page 141

Threat Defense Deployment with CDO
'configure manager add [hostname | ip address ] [registration key ]'
However, if the sensor and the Firepower Management Center are separated by a
NAT device, you must enter a unique NAT ID, along with the unique registration
key.
'configure manager add DONTRESOLVE [registration key ] [ NAT ID ]'
Later, using the web interface on the Firepower Management Center, you must
use the same registration key and, if necessary, the same NAT ID when you add
this sensor to the Firepower Management Center.
>
Step 5
Configure the outside interface for manager access.
configure network management-data-interface
You are then prompted to configure basic network settings for the outside interface. See the following details
for using this command:
• The Management interface cannot use DHCP if you want to use a data interface for management. If you
did not set the IP address manually during initial setup, you can set it now using the configure network
{ipv4 | ipv6} manual command. If you did not already set the Management interface gateway to
data-interfaces, this command will set it now.
• When you add the threat defense to CDO, CDO discovers and maintains the interface configuration,
including the following settings: interface name and IP address, static route to the gateway, DNS servers,
and DDNS server. For more information about the DNS server configuration, see below. In CDO, you
can later make changes to the manager access interface configuration, but make sure you don't make
changes that can prevent the threat defense or CDO from re-establishing the management connection. If
the management connection is disrupted, the threat defense includes the configure policy rollback
command to restore the previous deployment.
• If you configure a DDNS server update URL, the threat defense automatically adds certificates for all
of the major CAs from the Cisco Trusted Root CA bundle so that the threat defense can validate the
DDNS server certificate for the HTTPS connection. The threat defense supports any DDNS server that
uses the DynDNS Remote API specification
• This command sets the data interface DNS server. The Management DNS server that you set with the
setup script (or using the configure network dns servers command) is used for management traffic.
The data DNS server is used for DDNS (if configured) or for security policies applied to this interface.
On CDO, the data interface DNS servers are configured in the Platform Settings policy that you assign
to this threat defense. When you add the threat defense to CDO, the local setting is maintained, and the
DNS servers are not added to a Platform Settings policy. However, if you later assign a Platform Settings
policy to the threat defense that includes a DNS configuration, then that configuration will overwrite the
local setting. We suggest that you actively configure the DNS Platform Settings to match this setting to
bring CDO and the threat defense into sync.
Also, local DNS servers are only retained by CDO if the DNS servers were discovered at initial registration.
For example, if you registered the device using the Management interface, but then later configure a data
interface using the configure network management-data-interface command, then you must manually
configure all of these settings in CDO, including the DNS servers, to match the threat defense
configuration.
• You can change the management interface after you register the threat defense to CDO, to either the
Management interface or another data interface.
• The FQDN that you set in the setup wizard will be used for this interface.
Perform Initial Configuration Using the CLI
(https://help.dyn.com/remote-access-api/).
Cisco Firepower 1010 Getting Started Guide
139