Cisco Firepower 1010 Getting Started Manual page 129

Firepower Threat Defense Deployment with FMC
The device allows a maximum of 5 concurrent SSH connections.
Note On all appliances, after a user makes three consecutive failed attempts to log into the CLI via SSH, the system
terminates the SSH connection.
Before you begin
• You can configure SSH internal users at the CLI using the configure user add command. By default,
there is an admin user for which you configured the password during initial setup. You can also configure
external users on LDAP or RADIUS by configuring External Authentication in platform settings.
• You need network objects that define the hosts or networks you will allow to make SSH connections to
the device. You can add objects as part of the procedure, but if you want to use object groups to identify
a group of IP addresses, ensure that the groups needed in the rules already exist. Select Objects > Object
Management to configure objects.
Procedure
Step 1 Select Devices > Platform Settings and create or edit an FTD policy.
Step 2 Select Secure Shell.
Step 3
Identify the interfaces and IP addresses that allow SSH connections.
Use this table to limit which interfaces will accept SSH connections, and the IP addresses of the clients who
are allowed to make those connections. You can use network addresses rather than individual IP addresses.
a) Click Add to add a new rule, or click Edit to edit an existing rule.
b) Configure the rule properties:
c) Click OK.
Step 4
Click Save.
You can now go to Deploy > Deployment and deploy the policy to assigned devices. The changes are not
active until you deploy them.
Note You cannot use the system-provided any network object. Instead, use any-ipv4
or any-ipv6.
• IP Address—The network object that identifies the hosts or networks you are allowing to make SSH
connections. Choose an object from the drop-down menu, or add a new network object by clicking
+.
• Security Zones—Add the zones that contain the interfaces to which you will allow SSH connections.
For interfaces not in a zone, you can type the interface name into the field below the Selected Security
Zone list and click Add. These rules will be applied to a device only if the device includes the selected
interfaces or zones.
Configure SSH on the FMC Access Data Interface
Cisco Firepower 1010 Getting Started Guide
127