Add Cisco devices

Relevant for: AFA Administrators

This topic describes how to add Cisco devices to AFA and perform related configurations.

In this topic:

• Add a CSM-managed Cisco device
• Cisco IOS routers in AFA
• Cisco Nexus routers in AFA
• Cisco ASA firewalls in AFA
• Cisco Application Centric Infrastructure (ACI) devices in AFA
• Cisco Firepower devices in AFA
• Configure one-armed mode manually

Add a CSM-managed Cisco device

This procedure describes how to add a Cisco device managed by a Cisco CSM. You must add each Cisco device or security context that is managed by a Cisco CSM separately, even if they are managed by the same CSM.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, select Cisco > Point > Firewall via CSM (CSM 4.3 or above).

3. Complete the fields as needed, and then click Finish.

   Access Information

   Firewall Host Name	Type the host name of the Cisco device to be analyzed, as it appears in the CSM UI.
   CSM Server	Type the host name or IP address of the Cisco CSM server.
   CSM User Name	Type the user name to use for SSH access to the Cisco CSM.
   CSM Password	Type the password to use for SSH access to the Cisco CSM.

   Close ⌃
   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Close ⌃
   Baseline Configuration Compliance

   Select the baseline compliance profile to use, in order to enable generation of Baseline Compliance Reports for this device.

   The drop-down list includes all baseline compliance profiles in the system. For more information on baseline compliance profiles and instructions for adding new baseline compliance profiles, see Customize baseline configuration profiles

   Select None to disable Baseline Compliance Report generation for this device.

   Close ⌃
   Route Collection

   Specify how AFA should acquire the device's routing information:

   • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
   • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For more information, see Specify routing data manually.

   Close ⌃
   Rules view

   Specify how rules should be displayed in device reports:

   • ASDM: Display rules in the Cisco Adaptive Security Device Manager (ASDM) graphical interface.
   • CLI: Display rules in command line format.

   The default value is ADSM.

   Note: Intelligent Policy Tuner and the "Unused objects within rules" list are available only with ADSM.

   Close ⌃
   Log Collection and Monitoring

   Log collection method	Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following: Hit-counters: Only use hit-counter data. The Change History report page will be based on "last modified" timestamps, and Intelligent Policy Tuner is disabled. Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page. Intelligent Policy Tuner is disabled. Extensive: Combine data from both hit-counters and Syslog. Intelligent Policy Tuner is enabled. The default value is Extensive. Note: The Extensive method is only available when the ADSM is selected in the Rules view area.
   Syslog-ng server	If you selected Standard or Extensive in the Log collection method field, you must specify the syslog-ng server. For details, see Specify a Syslog-ng server.
   Additional firewall identifiers	Type any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a ':'. For example: "1.1.1.1:2.2.2.2:ServerName". This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed. Note: This field is only relevant for the parent device. In order to specify additional identifiers for sub-systems (Juniper VSYS/LSYS, Fortinet VDOM, Cisco security context, etc.), see Add additional device identifiers for sub-systems.
   Log collection frequency (minutes)	Type the interval of time in minutes, at which AFA should collect logs for the device.

   Close ⌃
   Options

   Real-time change monitoring	Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.

   Close ⌃

   The new device is added to the device tree.

4. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added.

Back to top

Cisco IOS routers in AFA

The following sections describe how Cisco IOS routers are added to AFA:

• Network connectivity
• Device permissions
• Add a Cisco IOS router

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco IOS router.

Device permissions

ASMS requires the following for the user used to access your Cisco IOS routers:

Add a Cisco IOS router

This procedure describes how to add a Cisco IOS router to AFA.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
2. In the vendor and device selection page, select Cisco > IOS Router.

3. Complete the fields as needed.

   Access Information

   Enter details for accessing your device.

   Host	Enter the device's host name or IP address.
   User Name	Enter the username to use for device access via SSH.
   Password	Enter the password to use for device access via SSH. Note: For Cisco IOS devices enabled for CyberArk, the Password and Enable User Password must be the same.
   Enable User Name	Enter the enable user name to use. If you do not want AFA to enter the enable mode, enter noenable. Note: This field is required.
   Enable User Password	Do one of the following: Enter the enable user password to use. To specify an empty enable password, enter AlgoSec_no_passwd. Note: For Cisco IOS devices enabled for CyberArk, the Password and Enable User Password must be the same. Note: This field is required.
   Retrieve credentials from CyberArk vault	Select this check box to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AFA server. When selected, also enter the following CyberArk details for the device being authenticated via CyberArk: Platform (Policy ID) Safe Folder Object Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate AFA and CyberArk.

   Close ⌃
   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Close ⌃
   Baseline Configuration Compliance

   To enable generation of Baseline Compliance Reports for this device, select the baseline compliance profile to use.

   The drop-down list includes all baseline compliance profiles in the system. For more details, see Customize baseline configuration profiles.

   To disable Baseline Compliance Report generation for this device, select None.

   Note: If this router is divided into VRF modules, Baseline Compliance Reports will only be generated for the root/default VRF.

   Close ⌃
   Advanced

   Select the following options as needed:

   Include risk analysis and policy optimization

   Select this option to include risk analysis and policy optimization analysis in the device's reports. When this is not selected, AFA produces condensed router reports which run as if there is no license for risks, optimization or regulatory compliance. Reports still include policy changes and baseline compliance. This option is disabled by default. Note: Selecting this option will increase the analysis time for this router significantly and might result in performance degradation.

   Automatically add/remove VRF instances upon detection (Applies for all Cisco Routers)

   Select this option to enable automatic updating of VRF instances for all Cisco routers defined in AFA. The updates will be reflected in the device tree and graphic network map, and the updates will affect the device license usage.

   Close ⌃
   Remote Management Capabilities

   Select a data transmission method:

   • SSH (more secure)
   • Telnet

   Define the following as needed:

   Custom Port

   To specify a custom port, select this option and type the port. This option is only relevant when SSH is selected.

   Number of allowed encryption keys

   Enter the permitted number of different RSA keys received from this device's IP address. Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc. For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

   Close ⌃
   Route Collection

   Specify how AFA should acquire the device's routing information:

   • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.

   • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For details, see Specify routing data manually.

   Close ⌃
   ActiveChange

   Select this option to enable FireFlow to generate CLI recommendations and push them to the device.

   Checking this box will enable ActiveChange for all the supported Cisco firewalls, Cisco IOS routers, and Juniper SRX firewalls (not only for this device).

   For more details, see Implement changes with ActiveChange.

   Close ⌃
   Options

   Select the following as needed:

   Real-time change monitoring	Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.

   Close ⌃

4. If you enabled ActiveChange, the ActiveChange License Agreement dialog box appears.

   Select I Agree, and click OK.

5. Click Finish. The new device is added to the device tree.

6. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added. The new device appears in the device tree, including any VRF devices as unique nodes.

Back to top

Cisco Nexus routers in AFA

The following sections describe how ASMS connects to Cisco Nexus routers:

• Network connection
• Device permissions
• Add a Cisco Nexus router to AFA

Network connection

The following diagram shows the connection between an ASMS Central Manager or Remote Agent and a Cisco Nexus router over SSH.

Device permissions

To analyze Cisco Nexus router devices, ASMS requires the ability to run the following commands on the Nexus device:

• show version
• show interface
• show ip interface
• show ip access-list
• show running-config
• show vdc membership (For Nexus 7000 and above)
• show vrf interface | xml
• show vrf all interface
• show ip route
• show ip route vrf all
• show vrf all
• show bgp vpn4 unicast labels

Add a Cisco Nexus router to AFA

This procedure describes how to add a Cisco Nexus router to AFA.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, select Cisco > Nexus Router.

3. Complete the fields as needed.

   Access Information

   Enter the following details for accessing your device from AFA:

   Host	Enter the host name or IP address of the device.
   User Name	Enter the user name to use for SSH access to the device.
   Password	Enter the password to use for SSH access to the device.
   Retrieve credentials from CyberArk vault	Select this check box to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AFA server. When selected, also define the following: Platform (Policy ID) Safe Folder Object Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate AFA and CyberArk.

   Close ⌃
   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Close ⌃
   Baseline Configuration Compliance

   To enable generation of Baseline Compliance Reports for this device, select the baseline compliance profile to use.

   The drop-down list includes all baseline compliance profiles in the system. For more details, see Customize baseline configuration profiles.

   Note: To disable Baseline Compliance Report generation for this device, select None.

   Close ⌃
   Additional Information

   Select the following as needed:

   Include risk analysis and policy optimization

   Select this option to include risk analysis and policy optimization analysis in the device's reports. When this is not selected, AFA produces condensed router reports which run as if there is no license for risks, optimization or regulatory compliance. Reports still include policy changes and baseline compliance. This option is disabled by default. Note: Selecting this option will increase the analysis time for this router significantly and might result in performance degradation.

   Automatically add/remove VRF instances upon detection (Applies for all Cisco Routers)

   Select this option to enable automatic updating of VRF instances for all Cisco routers defined in AFA. The updates will be reflected in the device tree and graphic network map, and the updates will affect the device license usage.

   Close ⌃
   Route Collection

   Specify how AFA should acquire the device's routing information:

   • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.

   • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For more details, see Specify routing data manually.

   Close ⌃
   Remote Management Capabilities

   Select a data transmission method:

   • Telnet
   • SSH (more secure)

   Then define:

   Custom Port

   To specify a custom port, select this option and type the port. This option is only relevant when SSH is selected.

   Number of allowed encryption keys

   Enter the permitted number of different RSA keys received from this device's IP address. Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc. For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

   Close ⌃
   Options

   Select the following as needed:

   Real-time change monitoring	Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.

   Close ⌃
4. Click Finish. The new device is added to the device tree.

5. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added.

Back to top

Cisco ASA firewalls in AFA

The following sections describe how ASMS connects to Cisco ASA firewalls:

• Network connection
• Device permissions
• Add a Cisco ASA firewall

Network connection

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco ASA device:

Device permissions

ASMS requires the following permissions to connect to your Cisco ASA devices:

Add a Cisco ASA firewall

This procedure describes how to add a Cisco ASA firewall to AFA.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
2. In the vendor and device selection page, select Cisco > ASA.

3. Complete the fields as needed.

   Access Information

   Enter details to access your device from AFA:

   Host	Enter the device's host name or IP address.
   User Name	Enter the user name to use for SSH access to the device. Note: AFA partially supports user awareness for Cisco ASA devices. The network user appears as a field for each rule in the Policy tab, but is not used in traffic simulation queries.
   Password	Enter the password to use for SSH access to the device. Note: For Cisco ASA devices enabled for CyberArk, the Password and Enable User Password must be the same.
   Enable User Password	Enter the enable user password to use: noenable. Skip running the enable command. Algosec_no_passwd. The enable password is empty. Leave the field empty. AFA will issue a login command instead of the enable command, using the same password provided for the SSH connection. Note: For Cisco ASA devices enabled for CyberArk, the Password and Enable User Password must be the same.
   Retrieve credentials from CyberArk vault	Select to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AlgoSec server. When selected, also enter the following CyberArk details for the device being authenticated: Platform (Policy ID) Safe Folder Object Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate AFA and CyberArk.

   Close ⌃
   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   Note: This field is only relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Close ⌃
   Baseline Configuration Compliance

   To enable generation of Baseline Compliance Reports for this device, select the baseline compliance profile to use.

   The drop-down list includes all baseline compliance profiles in the system.

   To disable Baseline Compliance Report generation for this device, select None.

   For more details, see Customize baseline configuration profiles.

   Close ⌃
   Remote Management Capabilities

   Select one of the following methods to collect data:

   • SSH (recommended)
   • Telnet

   Then define:

   Custom Port

   To specify a custom port, select this option and type the port. This option is only relevant when SSH is selected.

   Number of allowed encryption keys

   Enter the permitted number of different RSA keys received from this device's IP address. Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc. For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

   Close ⌃
   Route Collection

   Specify how AFA should acquire the device's routing information:

   • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.

   • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For more details, see Specify routing data manually.

   Close ⌃
   Rules View

   Specify how rules should be displayed in device reports:

   • ASDM: Display rules in the Cisco Adaptive Security Device Manager (ASDM) graphical interface.
   • CLI (Default): Display rules in command line format.

   Note: Intelligent Policy Tuner and the Unused objects within rules list are available only with ADSM. For more details, see Intelligent Policy Tuner.

   Close ⌃
   Log Collection and Monitoring

   Define the following as needed:

   Log collection method	Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following: Hit-counters: Only use hit-counter data. The Change History report page will be based on last modified timestamps. Intelligent Policy Tuner is disabled. Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page. Intelligent Policy Tuner is disabled. Extensive (Default): Combine data from both hit-counters and Syslog. Intelligent Policy Tuner is enabled. Note: This method is available only when ADSM is selected in the Rules view area. For details, see Rules View.
   Syslog-ng server	If you selected Standard or Extensive in the Log collection method field, you must specify the syslog-ng server. For details, see Specify a Syslog-ng server.
   Additional firewall identifiers	Enter any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a colon (:). For example: 1.1.1.1:2.2.2.2:ServerName. This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed. Note: This field is only relevant for the parent device, and not for sub-systems. For more details, see Add additional device identifiers for sub-systems
   Log collection frequency (minutes)	Enter the interval of time in minutes, at which AFA should collect logs for the device.

   Close ⌃
   ActiveChange

   Select this option to enable FireFlow to generate CLI recommendations and push them to the device.

   Checking this box will enable ActiveChange for all the supported Cisco firewalls, Cisco IOS routers, and Juniper SRX firewalls (not only for this device).

   For more details, see Implement changes with ActiveChange.

   Close ⌃
   Options

   Select the following as needed:

   Real-time change monitoring	Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.

   Close ⌃

4. If you enabled ActiveChange, the ActiveChange License Agreement dialog box appears.

   Select I Agree, and click OK.

5. Click Finish. The new device is added to the device tree.

6. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added. Any configured contexts on the ASA device are also imported.

Back to top

Cisco Application Centric Infrastructure (ACI) devices in AFA

The following sections describe how ASMS connects to Cisco ACI devices:

• Network connectivity
• Device permissions
• Add a Cisco (ACI) to AFA

Network connectivity

The following image shows an ASMS Central Manager or Remote Agent connecting to a Cisco ACI APIC and fabric.

Device permissions

ASMS requires the following permissions to access Cisco ACI devices:

Add a Cisco (ACI) to AFA

This procedure describes how to connect Cisco ACI devices to AFA. AFA always connects to Cisco ACI devices via REST.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, select Cisco > Application Centric Infrastructure (ACI).

3. Populate the fields as follows:

   Access Information

   Enter details to access your device from AFA:

   Host	Enter the device's host name or IP address. Tip: Typically, your APIC cluster has three nodes. Specify the host name or IP address of only one of the APIC nodes. If the node you added goes down, you'll need to switch your AFA device configuration to another node. Edit the device configuration in AFA and enter the host name or IP address of that second node.
   User Name	Enter the user name to use to access the device.
   Password	Enter the password to use to access the device.

   Close ⌃
   Geographic Distribution

   Select a remote agent to perform data collection for the device, if relevant.

   To configure the device to be managed locally, select Central Manager.

   For more details, see Configure a distributed architecture.

   Close ⌃
   Route Collection

   Determine how AFA acquires the device's routing information. Select one of the following:

   • Automatic. AFA automatically generates the device's routing upon analysis or monitoring.
   • Static Routing Table (URT). AFA takes the device's routing information from a static file you provide. For details, see Specify routing data manually.

   Close ⌃
   ActiveChange

   Select this option to enable FireFlow to generate CLI recommendations and push them to the device.

   Checking this box will enable ActiveChange for all the supported Cisco firewalls, Cisco IOS routers, and Juniper SRX firewalls (not only for this device).

   For more details, see Implement changes with ActiveChange.

   Close ⌃
   Options

   Select either of the following options:

   • Real-time change monitoring. Enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
   • Set user permissions. Set user permissions for this device.

   Close ⌃

4. If you enabled ActiveChange, the ActiveChange License Agreement dialog box appears.

   Select I Agree, and click OK.

5. Click Finish. The new device is added to the device tree.

   • ACI devices appear in the device tree in a two-tier hierarchy, including both APICs and tenants.
   • EPGs are shown with the following syntax: <application_profile>/<EPG_name>. For more details, see EPG identification and supported contract scopes.
   • Any VRFs on the map are shown with the following syntax: <Tenant_name>/<VRF_name>
   • vzAny objects are shown with the following syntax: <VRF_name>/vzAny. AFA updates the contents of these objects upon change monitoring and analysis.

6. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added. The ACI and each ACI tenant is displayed in the device tree.

Back to top

Cisco Firepower devices in AFA

The following sections describe how ASMS connects to Cisco Firepower devices:

• Network connectivity
• Device permissions
• Add a Cisco Firepower

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco Firepower device:

Device permissions

ASMS requires the following device permissions to connect to Cisco Firepower devices:

Add a Cisco Firepower

This procedure describes how to add a Cisco Firepower device to AFA.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, select Cisco > Firepower.

3. Complete the following fields as needed.

   Access Information

   Enter details to access the device from AFA:

   Host	Enter the hostname or IP address of the FMC.
   User Name	Enter the username to use for SSH access to the FMC device. Note: AFA does not support user or network application awareness for Cisco Firepower. The network application appears as a field for each rule in the Policy tab, but is not used in traffic simulation queries.
   Password	Enter the password to use for SSH access to the FMC device.

   Close ⌃
   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Close ⌃
   ActiveChange

   Select this option to allow FireFlow to automatically implement changes on the device.

   For more details, see Implement changes with ActiveChange.

   Close ⌃

4. Click Next to continue on to the FirePower - Step 2/2 page. This page lists the FTDs that are managed by the Firepower FMC.

   For example:

   

5. To exclude an FTD, clear its check box in the table.

6. Click to configure details for the selected FTDs.

   In the Direct Access Configuration, define the Host, User Name, and Password, and Baseline Profile for each FTD.

   Tip: To disable Baseline Compliance Report generation for this device, select None.

   For more details, see Customize baseline configuration profiles.

   For example:

   

   Click Test Connectivity to test the connections to the FTDs defined, and then click OK.

   Note: You must specify the credentials for each FTD in order for AFA to collect routing data it needs to accurately analyze the device.

7. Select the following as needed:

   Real-time change monitoring	Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.

8. If you enabled ActiveChange, the ActiveChange License Agreement dialog box appears.

   Select I Agree, and click OK.

9. Click Finish.

   The new device is added to the device tree.

10. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    To select multiple users, press the CTRL button while selecting.

    Click OK to close the dialog.

A success message appears to confirm that the device is added.

Back to top

Configure one-armed mode manually

AFA automatically identifies Cisco Firepower devices in one-armed mode, when the device has a single interface. If your device has multiple interfaces and one-armed mode is not identified automatically, configure this for your device manually.

Do the following:

1. On the AFA machine, access your device configuration meta file as follows:

   /home/afa/.fa/firewalls/<device_name>/fwa.meta

   where <device_name> is the name of the device listed. If you device is listed multiple times, enter the longer name.

2. On a new line, enter:

   is_steering_device=yes

3. Run an analysis on the device to update the device data in AFA.

Back to top