How Remote Management Works
To allow the management center to manage the threat defense over the internet, use the outside interface for
management center manager access instead of the Management interface. Because most remote branch offices
only have a single internet connection, outside manager access makes centralized management possible.
The management connection is a secure, TLS-1.3-encrypted communication channel between itself and the
device. You do not need to run this traffic over an additional encrypted tunnel such as Site-to-Site VPN for
security purposes. If the VPN goes down, for example, you will lose your management connection, so we
recommend a simple management path.
Note
Registration Methods
Use one of the following methods to provision your threat defense:
Low-Touch Provisioning (Management Center 7.4 and later, Threat Defense 7.2 and later)
• Send the threat defense to the remote branch office. Do not configure anything on the device, because
low-touch provisioning may not work with pre-configured devices.
You can preregister the threat defense on the management center using the threat
defense serial number before sending the device to the branch office. The
management center integrates with the Cisco Security Cloud and CDO for this
functionality.
Note
• At the branch office, cable and power on the threat defense.
• Finish registering the threat defense using the CDO.
Manual Provisioning
• Pre-configure the threat defense at the CLI or using the device manager, and then send the threat defense
to the remote branch office.
• At the branch office, cable and power on the threat defense.
• Finish registering the threat defense using the management center.
Threat Defense Manager Access Interface
This guide covers outside interface access because it is the most likely scenario for remote branch offices.
Although manager access occurs on the outside interface, the dedicated Management interface is still relevant.
The Management interface is a special interface configured separately from the threat defense data interfaces,
and it has its own network settings.
• The Management interface network settings are still used even though you are enabling manager access
on a data interface.
• All management traffic continues to be sourced from or destined to the Management interface.
Cisco Firepower 2100 Getting Started Guide
46
Threat Defense Deployment with a Remote Management Center
How Remote Management Works
To Next Page
Loading...
Need help?
General