uploading firepower TS files to cisco faster with Customer eXperience Drive (CXD)

One of the big pains dealing with firepower is TAC will ask for TS files a lot. They take a long time to generate then you have to return to the FMC to download them, sometimes they can be 1gig or so and finally you need to upload them to the case. Cisco have made it a bit faster with cxd.

When you open you case with cisco, make note of the case number. Click the button to generate the token.

Log into the CLI of your FMC via ssh
expert
sudo su
curl -k https://cxd.cisco.com/public/ctfr/firepower.py | python - -c [CASE#] -t [TOKEN] --auto-upload &

Do the same on the active FTD as well.

You can move on with your day and the TS files with automatically generate and upload to the case.

You need to have DNS resolution working.

On sensor CLI 

Make sure the gateway and DNS servers are setup and working in the FTD CLI.

show networking

Configure the IP and GW

configure network ipv4 manual 192.168.100.50 255.255.255.0 192.168.100.254

nslookup cxd.cisco.com 192.168.100.53

Configure working DNS servers

configure network dns servers 192.168.100.53,192.168.100.53

The "ASA" parts DNS is handled from the GUI Devices -> platform settings -> DNS

Also look under system -> config -> Management interfaces

Enable DNS

Add a group 

Assign to interfaces (inside,outside)

cattools not backing up

I had an issue with cattools not backing up

I found the issue was in the banner the config had used ^C for the banner marker and it seemed to be causing an issue.

Removed it and all was good.

checking for packet loss

ping your gateway
ping 8.8.8.8
ISP's often have a direct connection to google from their network so its best to try ping an IP that will traverse the internet like ping a server in the UK or Australia

ping the gateway

pathping -n -4 x.x.x.x

private ip ranges in differnt formats

Private IP ranges in different formats for use in ACLs

192.168.0.0 - 192.168.255.255 (65,536 IP addresses)
172.16.0.0 - 172.31.255.255 (1,048,576 IP addresses)
10.0.0.0 - 10.255.255.255 (16,777,216 IP addresses)

CIDR
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Netmask
10.0.0.0 255.0.0.0
172.16.0.0 255.240.0.0
192.168.0.0 255.255.0.0

Wildcard
10.0.0.0 0.0.0.255
172.16.0.0 0.0.240.255
192.168.0.0 0.0.255.255

wildcard cert on firepower FTD

Logins:

• Customer login for cert vendor
• Login to server/device where we want to install the cert

We need 3 files:

• Wildcard cert (download from cert vendor site digicert/godaddy etc)
• Private key (get from customer or find on windows servers or make one with openssl cmd)
• cert chain bundle (download from cert vendor site)

We need the private key password (you can set if when making one):

• Password for the private key. 

This password and pkey should be stored secure and safe somewhere by the customer for later use.

Command to generate private key if needed:

This command "openssl genrsa -out private.key 2048"

Once we have all files bundle them into one pfx file with openssl:

openssl pkcs12 -export -in wildcard-cert.crt -inkey private.key -certfile sf_bundle-g2-g1.crt -out cert-chain-pkey-bundle.pfx

What is the private key already exists
In this case the wildcard was already installed on a windows server (exchange)

I opened mmc on the exchange server
added the certs snap in
Found the wildcard cert
Exported it with the private key (set a password)
Exported PFX

In firepower went to objects -> PKI -> cert enroll
Selected import from PCKS12 files

Now go to devices certificates -> add

Now go to devices -> VPN -> Remote access

Edit the AnyConnect profile
Access interfaces tab
Change the two entries SSL and IKEv2 and select the new cert

Save + Deploy

setup netflow on cisco 9300 stack

Setup netflow

x.x.x.x = your netflow collector eg solarwinds etc.

flow exporter NETFLOW-EXP-TO-ORION
 destination x.x.x.x
 source vlan1
 transport udp 2055


Setup what you want to record

flow record NETFLOW-RECORD-IN
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 match flow direction
 collect interface output
 collect counter bytes long
 collect counter packets long

flow record NETFLOW-RECORD-OUT
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface output
 match flow direction
 collect interface input
 collect counter bytes long
 collect counter packets long

Setup the monitors


flow monitor NETFLOW-MON-OUT
 exporter NETFLOW-EXP-TO-ORION
 cache timeout inactive 10
 cache timeout active 60
 record NETFLOW-RECORD-OUT

flow monitor NETFLOW-MON-IN
 exporter NETFLOW-EXP-TO-ORION
 cache timeout inactive 10
 cache timeout active 60
 record NETFLOW-RECORD-IN

Enable the monitors on the interfaces
Enable under the  interfaces you want to collect netflow data from usually these will be uplinks, links to other sites etc





interface GigabitEthernet2/0/36
 ip flow monitor NETFLOW-MON-IN input
 ip flow monitor NETFLOW-MON-OUT output



Don't forget to write your config.
You might need to check firewall rules between the two hosts.
Allow a few minutes for the data to populate in the collector.

creating a script to import multiple IP's into palo alto firewall

Get your list of IP's into sublime text or notepad++ so its easy to work with
You can use excel to generate the objectname[x]

Create the address objects
set address [address-name] ip-netmask [ip-address]

eg

set address malware-ip1 ip-netmask x.x.x.x
set address malware-ip2 ip-netmask y.y.y.y

Assign the objects to a group

set address-group [address-group-name] static [address-name]

eg

set address-group malware-ips static malware-ip1
set address-group malware-ips static malware-ip2

Once I have my script
Connect to the CLI of the palo and paste it in
I have found it only allows you to paste 80 lines or so
Sometimes I need to split up my pastes but it works for me haven't had time to look into it

Once you've got it all in there don't for get to commit

Now you can go back to the web interface / GUI and create a rule with the new address group which should contain all your IP's