Step 1

Choose System > Configuration.

Step 2

Use the navigation panel to choose configurations to change; see Table 1 for more information.

Step 1

Choose System > Configuration.

Step 2

Click HTTPS Certificate.

Step 1

Choose System > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Click Generate New CSR.

The following figure shows an example.

Step 4

Enter a country code in the Country Name (two-letter code) field.

Step 5

Enter a state or province postal abbreviation in the State or Province field.

Step 6

Enter a Locality or City.

Step 7

Enter an Organization name.

Step 8

Enter an Organizational Unit (Department) name.

Step 9

Enter the fully qualified domain name of the server for which you want to request a certificate in the Common Name field.

Step 10

To request a certificate that secures multiple domain names or IP addresses, enter the folowing information in the Subject Alternative Name section:

1. Domain Names: Enter the fully qualified domains and subdomains (if any) secured by the Subject Alternative Name.

2. IP Addresses: Enter the IP addresses secured by the Subject Alternative Name.

Step 11

Click Generate.

Step 12

Open a text editor.

Step 13

Copy the entire block of text in the certificate request, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines, and paste it into a blank text file.

Step 14

Save the file as servername.csr, where servername is the name of the server where you plan to use the certificate.

Step 15

Click Close.

Step 1

Choose System > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Click Import HTTPS Server Certificate.

Step 4

Open the server certificate in a text editor, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Paste this text into the Server Certificate field.

Step 5

Whether you must supply a Private Key depends on how you generated the Certificate Signing Request:

• If you generated the Certificate Signing Request using the Firepower Management Center web interface (as described in Generating an HTTPS Server Certificate Signing Request), the system already has the private key and you need not enter one here.
• If you generated the Certificate Signing Request using some other means, you must supply the private key here. Open the private key file and copy the entire block of text, include the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines. Paste this text into the Private Key field.

Step 6

Open any required intermediate certificates, copy the entire block of text for each, and paste it into the Certificate Chain field. If you received a root certificate, paste it here. If you received an intermediate certificate, paste it below the root certificate. In both cases, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

Step 7

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Choose Enable Client Certificates. If prompted, select the appropriate certificate from the drop-down list.

Step 4

You have three options:

• To verify client certificates using one or more CRLS, select Enable Fetching of CRL and continue with Step 5.
• To verify client certificates using OCSP, select Enable OCSP and skip to Step 7.
• To accept client certificates without checking for revocation, skip to Step 8.

Step 5

Enter a valid URL to an existing CRL file and click Add CRL. Repeat to add up to 25 CRLs.

Step 6

Click Refresh CRL to load the current CRL or CRLs from the specified URL or URLs.

Step 7

Verify that the client certificate is signed by the certificate authority loaded onto the appliance and the server certificate is signed by a certificate authority loaded in the browser certificate store. (These should be the same certificate authority.)

Step 8

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Click Renew HTTPS Certificate. (This option appears on the display below the certificate information only if your system is configured to used the default HTTPS server certificate.)

Step 4

(Optional) In the Renew HTTPS Certificate dialog box, select Generate New Key to generate a new key for the certificate.

Step 5

In the Renew HTTPS Certificate dialog box, click Save.

Step 1

Choose System > Configuration.

Step 2

Click External Database Access.

Step 3

Select the Allow External Database Access check box.

Step 4

Enter an appropriate value in the Server Hostname field. Depending on your third-party application requirements, this value can be either the fully qualified domain name (FQDN), IPv4 address, or IPv6 address of the Firepower Management Center.

Step 5

Next to Client JDBC Driver, click Download and follow your browser’s prompts to download the client.zip package.

Step 6

To add database access for one or more IP addresses, click Add Hosts. An IP Address field appears in the Access List field.

Step 7

In the IP Address field, enter an IP address or address range, or any.

Step 8

Click Add.

Step 9

Click Save.

Step 1

Choose System > Configuration.

Step 2

Choose Database.

Step 3

For each of the databases, enter the number of records you want to store.

Step 4

Optionally, in the Data Pruning Notification Address field, enter the email address where you want to receive pruning notifications.

Step 5

Click Save.

Step 1

Choose System > Configuration, and then choose Management Interfaces.

Step 2

In the Interfaces area, click Edit next to the interface that you want to configure.

Step 3

In the Routes area, edit a static route by clicking Edit (), or add a route by clicking Add ().

Step 4

In the Shared Settings area, set network parameters shared by all interfaces.

Step 5

In the ICMPv6 area, configure ICMPv6 settings.

Step 6

In the Proxy area, configure HTTP proxy settings.

1. Check the Enabled check box.

2. In the HTTP Proxy field, enter the IP address or fully-qualified domain name of your proxy server.

   See requirements in the prerequisites to this topic.

3. In the Port field, enter a port number.

4. Supply authentication credentials by choosing Use Proxy Authentication, and then provide a User Name and Password.

Step 7

Click Save.

Step 8

If you change the FMC IP address, then see If you change the FMC IP address, then see Edit the FMC IP Address or Hostname on the Device.

Step 1

Choose System > Configuration.

Step 2

Choose Process.

Step 3

Do one of the following:

Step 1

Choose System > Configuration.

Step 2

Choose Remote Storage Device.

Step 3

Choose Local (No Remote Storage) from the Storage Type drop-down list.

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose NFS from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required command line options; see Remote Storage Management Advanced Options.

Step 6

Under System Usage:

Step 7

To test the settings, click Test.

Step 8

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose SMB from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required command line options; see Remote Storage Management Advanced Options.

Step 6

Under System Usage:

• Choose Use for Backups to store backups on the designated host.
• Choose Use for Reports to store reports on the designated host.

Step 7

To test the settings, click Test.

Step 8

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Remote Storage Device.

Step 3

Choose SSH from the Storage Type drop-down list.

Step 4

Add the connection information:

Step 5

Optionally, check the Use Advanced Options check box and enter any required command line options; see Remote Storage Management Advanced Options.

Step 6

Under System Usage:

• Choose Use for Backups to store backups on the designated host.
• Choose Use for Reports to store reports on the designated host.

Step 7

If you want to test the settings, you must click Test.

Step 8

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Change Reconciliation.

Step 3

Check the Enable check box.

Step 4

Choose the time of day you want the system to send out the change reconciliation report from the Time to Run drop-down lists.

Step 5

Enter email addresses in the Email to field.

Step 6

If you want to include policy changes, check the Include Policy Configuration check box.

Step 7

If you want to include all changes over the past 24 hours, check the Show Full Change History check box.

Step 8

Click Save.

Step 1

Choose System > Configuration.

Step 2

Configure the policy comment preferences for any of the following:

• Click Access Control Preferences for comment preferences for access control policies.
• Click Intrusion Policy Preferences for comment preferences for intrusion policies.
• Click Network Analysis Policy Preferences for comment preferences for network analysis policies.

Step 3

You have the following choices for each policy type:

• Disabled—Disables change comments.
• Optional—Gives users the option to describe their changes in a comment.
• Required—Requires users to describe their changes in a comment before saving.

Step 4

Optionally for intrusion or network analysis policy comments:

• Check Write changes in Intrusion Policy to audit log to write all intrusion policy changes to the audit log.
• Check Write changes in Network Analysis Policy to audit log to write all network analysis policy changes to the audit log.

Step 5

Click Save.

Step 1

Choose System > Configuration.

Step 2

(Optional) Click SNMP to configure SNMP if you want to add SNMP rules to the access list. By default, SNMP is disabled; see Configure SNMP Polling.

Step 3

Click Access List.

Step 4

To add access for one or more IP addresses, click Add Rules.

Step 5

In the IP Address field, enter an IP address or address range, or any.

Step 6

Choose SSH, HTTPS, SNMP, or a combination of these options to specify which ports you want to enable for these IP addresses.

Step 7

Click Add.

Step 8

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Audit Log.

Step 3

Choose Enabled from the Send Audit Log to Syslog drop-down menu.

Step 4

The following fields are applicable only for audit logs sent to syslog:

Step 5

(Optional) To test whether the IP address of the syslog servers are valid, click Test Syslog Server.

Step 6

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Audit Log.

Step 3

Optionally, in the Tag field, enter the tag name that you want to appear with the message. For example, if you want all audit log records to be preceded with FROMMC, enter FROMMC in the field.

Step 4

Choose Enabled from the Send Audit Log to HTTP Server drop-down list.

Step 5

In the URL to Post Audit field, designate the URL where you want to send the audit information. Enter a URL that corresponds to a Listener program that expects the HTTP POST variables as listed:

Step 6

Click Save.

Step 1

Obtain and install a signed client certificate on the FMC:

1. Obtain a Signed Audit Log Client Certificate for the FMC:

   Generate a Certificate Signing Request (CSR) from the FMC based on your system information and the identification information you supply.

   Submit the CSR to a recognized, trusted certificate authority (CA) to request a signed client certificate.

   If you will require mutual authentication between the FMC and the audit log server, the client certificate must be signed by the same CA that signed the server certificate to be used for the connection.

2. After you receive the signed certificate from the certificate authority, import it into the FMC. See Import an Audit Log Client Certificate into the FMC.

Step 2

Configure the communication channel with the server to use Transport Layer Security (TLS) and enable mutual authentication.

Step 3

Configure audit log streaming if you have not yet done so.

Step 1

Choose System > Configuration.

Step 2

Click Audit Log Certificate.

Step 3

Click Generate New CSR.

Step 4

Enter a country code in the Country Name (two-letter code) field.

Step 5

Enter a state or province postal abbreviation in the State or Province field.

Step 6

Enter a Locality or City.

Step 7

Enter an Organization name.

Step 8

Enter an Organizational Unit (Department) name.

Step 9

Enter the fully qualified domain name of the server for which you want to request a certificate in the Common Name field.

Step 10

Click Generate.

Step 11

Open a new blank file with a text editor.

Step 12

Copy the entire block of text in the certificate request, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines, and paste it into a blank text file.

Step 13

Save the file as clientname.csr, where clientname is the name of the appliance where you plan to use the certificate.

Step 14

Click Close.

Step 1

On the FMC, choose System > Configuration.

Step 2

Click Audit Log Certificate.

Step 3

Click Import Audit Client Certificate.

Step 4

Open the client certificate in a text editor, copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Paste this text into the Client Certificate field.

Step 5

To upload a private key, open the private key file and copy the entire block of text, including the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines. Paste this text into the Private Key field.

Step 6

Open any required intermediate certificates, copy the entire block of text for each, and paste it into the Certificate Chain field.

Step 7

Click Save.

Step 1

On the FMC, choose System > Configuration.

Step 2

Click Audit Log Certificate.

Step 3

To use Transport Layer Security to securely stream the audit log to an external server, choose Enable TLS.

Step 4

If you want to accept server certificates without verification (not recommended):

1. Deselect Enable Mutual Authentication.

2. Click Save and skip the remainder of this procedure.

Step 5

To verify the certificate of the audit log server, choose Enable Mutual Authentication.

Step 6

(If you enabled mutual authentication) To automatically recognize certificates that are no longer valid:

1. Select Enable Fetching of CRL.

   Note	Enabling fetching of the CRL creates a scheduled task to regularly update the CRL or CRLs.

2. Enter a valid URL to an existing CRL file and click Add CRL.

   Repeat to add up to 25 CRLs.

3. Click Refresh CRL to load the current CRL or CRLs from the specified URL or URLs.

Step 7

Verify that you have a valid server certificate generated by the same certificate authority that created the client certificate.

Step 8

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Audit Log Certificate.

Step 1

Choose System > Configuration.

Step 2

Click Dashboard.

Step 3

Check the Enable Custom Analysis Widgets check box to allow users to add Custom Analysis widgets to dashboards.

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Choose DNS Cache.

Step 3

From the DNS Resolution Caching drop-down list, choose one of the following:

• Enabled—Enable caching.
• Disabled—Disable caching.

Step 4

In the DNS Cache Timeout (in minutes) field, enter the number of minutes a DNS entry remains cached in memory before it is removed for inactivity.

Step 5

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Email Notification.

Step 3

In the Mail Relay Host field, enter the hostname or IP address of the mail server you want to use. The mail host you enter must allow access from the appliance.

Step 4

In the Port Number field, enter the port number to use on the email server.

Step 5

Choose an Encryption Method:

• TLS—Encrypt communications using Transport Layer Security.
• SSLv3—Encrypt communications using Secure Socket Layers.
• None—Allow unencrypted communication.

Step 6

In the From Address field, enter the valid email address you want to use as the source email address for messages sent by the appliance.

Step 7

Optionally, to supply a user name and password when connecting to the mail server, choose Use Authentication. Enter a user name in the Username field. Enter a password in the Password field.

Step 8

To send a test email using the configured mail server, click Test Mail Server Settings.

Step 9

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Language.

Step 3

Choose the language you want to use.

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Choose Login Banner.

Step 3

In the Custom Login Banner field, enter the login banner text you want to use.

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click SNMP.

Step 3

From the SNMP Version drop-down list, choose the SNMP version you want to use:

• Version 1 or Version 2: Enter a read-only SNMP community name in the Community String field, then skip to the end of the procedure.

  Note	Do not include special characters (< > / % # & ? ', etc.) in the SNMP community string name.

• Version 3: Click Add User to display the user definition page. SNMPv3 only supports read-only users and encryption with AES128.

Step 4

Enter a Username.

Step 5

Choose the protocol you want to use for authentication from the Authentication Protocol drop-down list.

Step 6

Enter the password required for authentication with the SNMP server in the Authentication Password field.

Step 7

Re-enter the authentication password in the Verify Password field.

Step 8

Choose the privacy protocol you want to use from the Privacy Protocol list, or choose None to not use a privacy protocol.

Step 9

Enter the SNMP privacy key required by the SNMP server in the Privacy Password field.

Step 10

Re-enter the privacy password in the Verify Password field.

Step 11

Click Add.

Step 12

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Time Synchronization.

Step 3

If Serve Time via NTP is Enabled, choose Disabled to disable the FMC as an NTP server.

Step 4

For the Set My Clock option, choose Via NTP.

Step 5

Click Add.

Step 6

In the Add NTP Server dialog box, enter the host name or IPv4 or IPv6 address of an NTP server.

Step 7

(Optional) To secure communication between your FMC and the NTP server:

1. Select MD5 or SHA-1 from the Key Type drop-down list.

2. Enter the corresponding MD5 or SHA-1 Key Number and Key Value from the specified NTP server.

Step 8

Click Add.

Step 9

To add more NTP servers, repeat Steps 5 through 8.

Step 10

(Optional) To force the FMC to use only an NTP server that successfully authenticates, check the Use the authenticated NTP server only check box.

Step 11

Click Save.

Step 1

Manually set the system time on the FMC:

1. Choose System > Configuration.

2. Click Time Synchronization.

3. If Serve Time via NTP is Enabled, choose Disabled.

4. Click Save.

5. For Set My Clock, choose Manually in Local Configuration.

6. Click Save.

7. In the navigation panel at the left side of the screen, click Time.

8. Use the Set Time drop-down lists to set the time.

9. If the time zone displayed is not UTC, click it and set the time zone to UTC.

10. Click Save.

11. Click Done.

12. Click Apply.

Step 2

Set the FMC to serve as an NTP server:

1. In the navigation panel at the left side of the screen, click Time Synchronization.

2. For Serve Time via NTP, choose Enabled.

3. Click Save.

Step 3

Set managed devices to synchronize with the FMC NTP server:

1. In the Time Synchronization settings for the platform settings policy assigned to your managed devices, set the clock to synchronize Via NTP from Management Center.

2. Deploy the change to managed devices.

Step 1

Choose System > Configuration.

Step 2

Click Time.

Step 1

Choose System > Configuration.

Step 2

Click User Configuration.

Step 3

Set the Password Reuse Limit to the number of passwords you want to maintain in the history (maximum 256).

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click User Configuration.

Step 3

Set Track Successful Login Days to the number of days to track successful logins (maximum 365).

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click User Configuration.

Step 3

Set the Max Number of Login Failures to the maximum number of consecutive failed login attempts before the user is temporarily locked out.

Step 4

Set the Time in Minutes to Temporarily Lockout Users to the number of minutes to lock out users who have triggered a temporary lockout.

Step 5

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click User Configuration.

Step 3

For each type of session (Read Only and Read/Write), set the Max Concurrent Sessions Allowed to the maximum number of sessions of that type that can be open at the same time.

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click CLI Timeout.

Step 3

Configure session timeouts:

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Choose Vulnerability Mapping.

Step 3

You have the following choices:

• To prevent vulnerabilities for a server from being mapped to hosts that receive application protocol traffic without vendor or version information, clear the check box for that server.
• To cause vulnerabilities for a server to be mapped to hosts that receive application protocol traffic without vendor or version information, check the check box for that server.

Step 4

Click Save.

Step 1

Choose System > Configuration.

Step 2

Click Console Configuration.

Step 3

Choose a remote console access option:

Step 4

To configure LOM via SOL:

Step 5

Click Save.

Step 6

The system displays the following warning: "You will have to reboot your system for these changes to take effect." Click OK to reboot now or Cancel to reboot later.

Step 1

Choose the Cog () in the upper right corner to open the system menu.

Step 2

Click REST API Preferences.

Step 3

To enable or disable REST API access to the FMC, check or uncheck the Enable REST API check box.

Step 4

Click Save.

Step 5

Access the REST API Explorer at: https://<management_center_IP_or_name>:<https_port>/api/api-explorer

Step 1

Choose System > Configuration.

Step 2

Click VMware Tools.

Step 3

Click Enable VMware Tools.

Step 4

Click Save.