[rancid] FXOS on FirePower 4140
cgauthier at comscore.com
Mon Feb 11 15:14:28 UTC 2019
We have a FirePower 2110 and it is architected differently than the 4100's. This Cisco blog post explains it well: https://blogs.cisco.com/perspectives/firepower-2100-the-architectural-need-to-know. We are using the ASA mode on the 2110. For SSH purposes, the IPs are different between FX-OS CLI and ASA CLI, so you do not have to use the "connect asa" CLI commands. I don't know what the best method is, separate or not. On the 2110, the FX-OS configuration is primarily setting up the ethernet interfaces (enable/disable, LACP). Also, there is no "connect fxos" that I really saw, though we are also still just deploying this platform.
Chris Gauthier Senior Network Engineer | Comscore
t +1 (503) 331-2704 |
cgauthier at comscore.com
This e-mail (including any attachments) may contain information that is private, confidential, or protected by attorney-client or other privilege. If you received this e-mail in error, please delete it from your system and notify sender.
From: Rancid-discuss <rancid-discuss-bounces at shrubbery.net> on behalf of Chris Stromsoe <cbs at noc.ucla.edu>
Date: Friday, February 8, 2019 at 1:35 PM
To: Erik Muller <erikm at buh.org>
Cc: rancid list <rancid-discuss at shrubbery.net>
Subject: Re: [rancid] FXOS on FirePower 4140
On Fri, 8 Feb 2019, Erik Muller wrote:
> The current fxos module assumes FTD on a 2100 platform (and I'm
> currently testing support for ASA on 2100). My understanding is that
> the 4100 and 9300 have a bit of a different architecture from the 2100,
> but I've not touched those to be able to say how exactly they differ.
> It looks like the initial login layer on the 4100 must be different.
> Is there any other "connect" option from either the initial login layer
> or the fxos layer, where the actual firewall functions are exposed?
It looks like logging in to the 4100 drops you straight into fxos.
Options for connect are
adapter Mezzanine Adapter
cimc Cisco Integrated Management Controller
fxos Connect to FXOS CLI
local-mgmt Connect to Local Management CLI
module Security Module Console
The connect command is not available after running "connect fxos". You
have to "exit" to return to the initial layer.
> On a 2100 the first layer you connect to is the FTD application (similar to
> legacy ASA platform), with a simple ">" prompt and a config syntax like:
>> show running-config
> : Serial Number: J..........
> : Hardware: FPR-2130, 14854 MB RAM, CPU MIPS 1200 MHz, 1 CPU (12 cores)
> NGFW Version 220.127.116.11
> hostname firepower
> interface Ethernet1/1
> nameif border1
> After that in the fxos layer, the config is more like the the UCS FI:
> > connect fxos
> Cisco Firepower Extensible Operating System (FX-OS) Software
> xxx-fw01# sho configuration
> scope org
> enter bios-policy SRIOV
> set acpi10-support-config acpi10-support platform-default
The login layers on the 4100 seems to be reversed when compared to the
2100 with ftd.
The initial login layer on the 4100 resembles the 2100 after having run
"connect fxos", and has a limited command list.
Running "connect fxos" on the 4100 resembles the initial login layer on
the 2100, and has an extensive command list.
I've copied all of the fxos definitions in rancid.types.base to fxos-ftd
and updated router.db for my 2100/FTD devices. I removed the fxos entries
that don't run on the 4100 and re-ordered the commands. I have a working
configuration for the 4140, though none of the output from "show
running-config" is getting picked up. Maybe using WriteTermFTD isn't
right for that.
fxos;command;fxos::RunCommand;term len 0
fxos;command;fxos::RunCommand;connect fxos; prompt changes
fxos;command;fxos::RunCommand;exit; prompt changes
fxos;command;fxos::ShowFirmware;show system firmware detail
fxos;command;fxos::ShowChassis;show chassis detail
fxos;command;fxos::ShowChassis;show chassis inventory detail
fxos;command;fxos::ShowChassis;show chassis environment expand detail
Rancid-discuss mailing list
Rancid-discuss at shrubbery.net
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Rancid-discuss