<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /></head><body><div>We have a FirePower 2110 and it is architected differently than the 4100's. This Cisco blog post explains it well: https://blogs.cisco.com/perspectives/firepower-2100-the-architectural-need-to-know. We are using the ASA mode on the 2110. For SSH purposes, the IPs are different between FX-OS CLI and ASA CLI, so you do not have to use the "connect asa" CLI commands. I don't know what the best method is, separate or not. On the 2110, the FX-OS configuration is primarily setting up the ethernet interfaces (enable/disable, LACP). Also, there is no "connect fxos" that I really saw, though we are also still just deploying this platform.<br /><br />--Chris<br /><br /><br /><div style="mso-line-height-rule:exactly;-webkit-text-size-adjust:100%;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:10px 0;vertical-align:middle;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#E43D30;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Arial;font-weight:700;">Chris<span style="font-family:remialcxesans;font-size:1px;color:#FFFFFF;"></span> </td><td align="left" style="vertical-align:top;font-family:Arial;font-weight:700;">Gauthier</td><td align="left" style="vertical-align:top;color:#444444;font-family:Arial;"> Senior Network Engineer</td><td align="left" style="vertical-align:top;font-family:Arial;"> | </td><td align="left" style="vertical-align:top;color:#444444;font-family:Arial;">Comscore<br /></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:3px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#444444;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Arial;">t +1 <a href="tel:(503)%20331-2704" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#444444;"><strong style="font-weight:400;">(503) 331-2704</strong></a></td><td align="left" style="vertical-align:top;color:#E43D30;font-family:Arial;"> | <br /></td><td align="left" style="vertical-align:top;font-family:Arial;"><a href="mailto:cgauthier@comscore.com" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#444444;"><strong style="font-weight:400;">cgauthier@comscore.com</strong></a></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:2px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#444444;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Arial;"><a href="http://www.comscore.com/" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#0563C1;"><strong style="font-weight:400;">comscore.com</strong></a></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:10px 0 2px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="white-space:normal;color:#444444;font-size:10.67px;font-family:Arial;font-weight:400;font-style:normal;text-align:justify;width:500px;"><tr style="font-size:10.67px;"><td style="font-family:Arial;">This e-mail (including any attachments) may contain information that is private, confidential, or protected by attorney-client or other privilege. If you received this e-mail in error, please delete it from your system and notify sender.</td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></div>-----Original Message-----<br />From: Rancid-discuss <rancid-discuss-bounces@shrubbery.net> on behalf of Chris Stromsoe <cbs@noc.ucla.edu><br />Date: Friday, February 8, 2019 at 1:35 PM<br />To: Erik Muller <erikm@buh.org><br />Cc: rancid list <rancid-discuss@shrubbery.net><br />Subject: Re: [rancid] FXOS on FirePower 4140<br /><br />On Fri, 8 Feb 2019, Erik Muller wrote:<br /><br />> The current fxos module assumes FTD on a 2100 platform (and I'm <br />> currently testing support for ASA on 2100). My understanding is that <br />> the 4100 and 9300 have a bit of a different architecture from the 2100, <br />> but I've not touched those to be able to say how exactly they differ.<br />><br />> It looks like the initial login layer on the 4100 must be different. <br />> Is there any other "connect" option from either the initial login layer <br />> or the fxos layer, where the actual firewall functions are exposed?<br /><br />It looks like logging in to the 4100 drops you straight into fxos.<br /><br />Options for connect are<br /><br />fw# connect<br /> adapter Mezzanine Adapter<br /> cimc Cisco Integrated Management Controller<br /> fxos Connect to FXOS CLI<br /> local-mgmt Connect to Local Management CLI<br /> module Security Module Console<br /><br /><br />The connect command is not available after running "connect fxos". You <br />have to "exit" to return to the initial layer.<br /><br /><br /><br />> On a 2100 the first layer you connect to is the FTD application (similar to <br />> legacy ASA platform), with a simple ">" prompt and a config syntax like:<br />>> show running-config<br />> : Serial Number: J..........<br />> : Hardware: FPR-2130, 14854 MB RAM, CPU MIPS 1200 MHz, 1 CPU (12 cores)<br />> :<br />> NGFW Version 6.2.3.4<br />> !<br />> hostname firepower<br />> ...<br />> !<br />> interface Ethernet1/1<br />> nameif border1<br />> ...<br />><br />> After that in the fxos layer, the config is more like the the UCS FI:<br />> > connect fxos<br />> Cisco Firepower Extensible Operating System (FX-OS) Software<br />> xxx-fw01# sho configuration<br />> scope org<br />> enter bios-policy SRIOV<br />> set acpi10-support-config acpi10-support platform-default<br />> ...<br /><br /><br />The login layers on the 4100 seems to be reversed when compared to the <br />2100 with ftd.<br /><br />The initial login layer on the 4100 resembles the 2100 after having run <br />"connect fxos", and has a limited command list.<br /><br />Running "connect fxos" on the 4100 resembles the initial login layer on <br />the 2100, and has an extensive command list.<br /><br />I've copied all of the fxos definitions in rancid.types.base to fxos-ftd <br />and updated router.db for my 2100/FTD devices. I removed the fxos entries <br />that don't run on the 4100 and re-ordered the commands. I have a working <br />configuration for the 4140, though none of the output from "show <br />running-config" is getting picked up. Maybe using WriteTermFTD isn't <br />right for that.<br /><br />fxos;command;fxos::RunCommand;term len 0<br />fxos;command;fxos::RunCommand;connect fxos; prompt changes<br />fxos;command;fxos::ShowInventory;show inventory<br />fxos;command;fxos::WriteTermFTD;show running-config<br />fxos;command;fxos::RunCommand;exit; prompt changes<br />fxos;command;fxos::ShowFirmware;show system firmware detail<br />fxos;command;fxos::ShowChassis;show chassis detail<br />fxos;command;fxos::ShowChassis;show chassis inventory detail<br />fxos;command;fxos::ShowChassis;show chassis environment expand detail<br />fxos;command;fxos::WriteTerm;show configuration<br /><br /><br /><br /><br />-Chris<br /><br />_______________________________________________<br />Rancid-discuss mailing list<br />Rancid-discuss@shrubbery.net<br />https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.shrubbery.net%2fmailman%2flistinfo%2francid-discuss&c=E,1,Agg4564IheFG90UwbAiAvZo1BLU69Z103Kv4VMySZ9xUTsjcwcvBBjtDdFnki_6XviMgM65aIammA_v80clw10SrZ9ffw-PSCud_gVcZhZE,&typo=1<br /><br /></div></body></html>