Changing FTD SSH access-list

[mrjelly]

Hello,

Is there a way to see an FTDs ssh-access-list through the FMC and even see what's on it?

It appears that to setup an FTDs SSH access list is to use SSH access (or from the console too?)

Using the Threat Detection CLI in the FMC and selecting 'Show' then ssh-access-list give back an error saying command didn't work.

[balaji.bandi]

Not sure what is the case here to see what in ACL using CLI or ssh.

Unlike ASA there are many changes in FTD probably we may not understand  as expected - until you like to spend more time and co-related to it.

check command reference :

https://www.cisco.com/c/en/us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense/using_the_FTD_CLI.html

[Rob Ingram]

@mrjelly to restrict SSH access to Data interfaces you configure a Platform Settings Policy from the FMC and deploy to the FTDs. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/interfaces-settings-platform.html#task_42B3A06C70E8415E8C024AE76FE79774

If using the Management interface, you configure an SSH access list using the command configure ssh-access-list from the CLI of the FTDs.

[mrjelly]

Thank you, what I am stuck on is how to access the configure ssh-access-list command. If it's CLI but SSH is not setup what are the default settings for the ssh-access-list and is there any other way to access and configure this other than SSH.

I'm assuming console works but can is also be done via FMC?

[balaji.bandi]

FMC is prefer method always my view.

if you like to do from cli (i would not suggest) but i have given reference document how you can do (do you get chance to read ?)

[Rob Ingram]

@mrjelly what interfaces are you referring to? data or management?

You can only configure the SSH list for the management interface via the CLI, it's open to everyone that can route to it as default.

If you are referring to the data interface for SSH you have to control this using the Platform Settings policy.

[mrjelly]

Yes this is the management interface I want to configure

[Rob Ingram]

@mrjelly like I said - For the Management interface, to configure an SSH access list from the CLI of the FTD use the configure ssh-access-list command, reference Cisco Secure Firewall Threat Defense Command Reference

[Marius Gunnerud]

The FMC platform settings will only show the access-list for SSH access using data interface.  For the management interface you would need to login to the CLIto see it and configure it.

show ssh-access-list

configure ssh-access-list <values>

[MHM Cisco World]

I will try that in my Lab and inform you the steps 
""after I return home""

thanks 

MHM

[MHM Cisco World]

FTD Management Access Restriction does not work for Management interface - Cisco Community

this link help you

MHM

[mrjelly]

Hello, thanks all for your responses, so the ssh-access-list is accept tcp -- anywhere anywhere state NEW tcp dpt:ssh

so I can't see any issue with that.

I can see traffic from my management box to the management interface IP on ssh being allowed, yet I am getting a timeout.

Any thoughts?

[Marius Gunnerud]

To exclude any issues with the mgmt interface or FTD itself, place a PC on the same subnet as the mgmt interface and then try to SSH to it.  If the SSH session is successful then we know there is an issue somewhere between the FTD and the original PC.

[mrjelly · Accepted solution]

Ok this is solved, the Management interface IP address was not the right one. Tracing the traffic coming out of the management interface, I could see two other IP addresses which were the firepower management IP addresses.
I was obviously reading the FMC settings incorrectly.

I looked at the device interfaces then the management interface settings and got the IP address from there. It was one bit higher than that.

Thank you all for your help and apologies.