track DNS requests

 

Login to DC

Open DNS

Right click DNS server

1. Click the Debug Logging tab and check the Log packets for debugging checkbox
2. To minimize the amount of data being logged, uncheck the following checkboxes:
   • Packet direction - Outgoing
   • Transport protocol - TCP
   • Packet contents - Updates
   • Packet type - Response
3. In the Log file section, type a path and file name for the log. Alter the Maximum size (bytes) value if necessary.
4. Click OK.

From:

https://superuser.com/questions/1229515/windows-dns-server-how-to-find-out-who-made-a-query

Now you can search the log with something like this in powershell

get-content dns.log -wait | select-string 'domain1','domain2'

tracking DHCP

C\windows\system32\dhcp\DhcpSrvLog-Mon.log

get-content DhcpSrvLog-Mon.log - wait | select-string 'dell'

backup on FMC

link below explaining the backup for FMC and FTD,

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Backup_and_Restore.html

http://www.network-node.com/blog/2019/3/27/150-copying-backing-up-and-restoring-ftd-device-configuration

High unmanaged disk usage on /ngfw cisco FMC/FTD error

After upgrade to 6.7 I got this error in the FMC health section:

High unmanaged disk usage on /ngfw cisco 

Going into the CLI is appeared there was space.
It looks like a bug CSCvc03899. 
Some old install files left behind. 

You need to remove them but you won't be able to roll back to that version. My system was stable and I had taken a backup of the FMC and managed device on 6.7 and no intention to roll back to any previous version anyway.

From CLISH (>) run cleanup-revert
> upgrade cleanup-revert
It is not possible to revert back to the previous version once the revert version is deleted.
Are you sure you want to proceed (yes/no)? yes

Go into expert mode and then (sudo su -)

Find old version files
FTD#cd /ngfw/Volume
# du -hs * | sort -rh
7.3G 6.4.0 ---> old version
6.9G root1
4.1G lib
116K home
0 root

Delete old version files Delete 6.4.0 file as below:

/ngfw/Volume# rm -rf 6.4.0
# du -hs * | sort -rh
6.9G root1
4.1G lib
116K home
0 root

FQDN on palo alto firewall

Show all the fqdn's that are resolved

show dns-proxy fqdn all

DNS servers are configured under

Cisco meraki outbound ports for firewall

Allow you meraki outbound on the following UDP ports

51625

38107

9351

9350

7351

We found in some configurations we had to give the HQ meraki its own static public IP. When it was sharing the firewall IP it was not working. I believe this is because it wants to use port 51625 exclusively.

Cisco updated some ranges

Port: UDP 9350–9381

Non-China cloud (meraki.com / gov-meraki.com):

• 209.206.48.0/20
• 158.115.128.0/19
• 216.157.128.0/20

China cloud (meraki.cn):

• 43.192.139.128/25
• 43.196.13.128/25

cisco firepower FTD 2110 initial config

 First steps

• Laptop / console cable, network cables, racking bolts and tools
  
• Have mgmt IP assigned for it. Will also needs IP's for inside/outside other interfaces etc.
  
• Unbox and put ears on
• Record serial numbers (there is a tab at the front interfaces)
• Mount in racks and boot up
• Plug into console port with usb to serial cable going to laptop
• Mgmt interface should be plugged into VLAN where it can reach the FMC.

Default username and password

username: admin

Password: Admin123

You'll want to change that 

connect ftd
show user 

configure user password admin 

 

Add another user

You may want to add another user as a back up

configure user add myusername

Configure  management IP

• configure network ipv4 manual 192.168.100.50 255.255.255.0 192.168.100.254
• 192.168.100.50 = MGMT IP of FT
•  192.168.100.254 = GW IP
• ping system 192.168.100.254
  

Configure route (if needed)

configure network static-routes ipv4 add eth0 192.168.10.0 255.255.255.0 192.168.1.1

Add FTD to FMC

Login into to FMC web interface

Devices -> Device management -> add

Fill in IP of FTD and a key like "cisco"

Now go back to FTD cli

show managers (should be none set)

configure manager add [IP-ofFMC] cisco

Wait for it to complete

Now go back to FMC. Give some time for the new device to settle (i think auto policy deploy happens). You can now upgrade the FTD to the same software as your other FTDs.

Overview -> Dashboard -> Status

Once upgraded your FTD is ready to be configured and policy deployed. You will need to patch any interfaces like inside/outside to the correct devices/VLANs. You should make sure you have access to SSH into the mgmt interface for troubleshooting. Most management and config is done from the FMC web interfaces from here on.

issues upgrading to firepower 6.7

First you need to upgrade RAM to at least 32GB

Next you need to move all VPN's to IKEv2

In version 6.7 cisco remove old ciphers and you can't upgrade until they are all removed.

You don't want to see group 2 or group 5 anywhere in your config.

Use group 14,19,20,21 instead.

This is true for the PFS group as well, select group 21.