Configuring Cisco Firewall Management Center (FMC) Connectors

This connector allows you to Block an IP using an API call to the Cisco FMC (formerly Firepower Management Center) firewall you configure below.

Connector Overview: Cisco FMC

Adding a Cisco FMC Connector

To add a Cisco FMC connector:

1. Configure Cisco FMC and obtain credentials
2. Add the connector in Stellar Cyber
3. Test the connector

Configuring Cisco FMC and Obtaining Credentials

1. Follow guidance on the FMC website to enable API functionality for the firewall.

2. Make note of the host IP address for your Cisco FMC instance. This is used as the Device IP Address during configuration.

   

3. Create a user for use with the API:

   1. Log into the Cisco FMC console as an administrative user.

      Do not use an administrator user for your connector configuration.

   2. Display the Settings menu and select the option for Users.

      

   3. From the Users screen, click Create User.

   4. In the dialog that displays, configure a user for use with Stellar Cyber that has at least the Network Admin role.

      Do not create the user with administrative privileges.

      

   5. Make note of the User Name and Password that you create.

      The password should not include non-ASCII special characters.

   6. Click Save.

4. Create a Source IP Network Group for use with Stellar Cyber.

   1. Navigate to the Objects tab on the Network page. Click Add Network and select Add Group from the dropdown.

      

   2. In the dialog that displays, enter a name for the group, to be associated with Stellar Cyber.

      

   3. Select Allow Overrides.

      It is not necessary to add networks to the group.

   4. Click Save.

      

   5. Click Yes.

5. Repeat the previous steps to create a Destination IP Network Group.

6. Configure a policy to block the IP address.

   1. Navigate to Policies | Access Control.

      

   2. Click New Policy.

   3. In the dialog that displays, enter a name for the policy. Make sure Block all traffic is selected.

      

   4. For the Targeted Devices, select a device from the Available Devices and click Add to policy.

   5. Click Save.

7. Add a rule to block the source IP group.

   1. Enter a rule name and select Enabled.

      

   2. Select Block from the Action dropdown.

   3. For the Source Networks, select the Source IP Network Group for use with Stellar Cyber from the Available Networks and click Add to Source Networks.

   4. For the Destination Networks, select any from the Available Networks and click Add to Destination.

   5. Click Save.

8. Add a rule to block the destination IP group.

   1. Enter a rule name and select Enabled.

      

   2. Select Block from the Action dropdown.

   3. For the Source Networks, select any from the Available Networks and click Add to Source Networks.

   4. For the Destination Networks, select the Destination IP Network Group for use with Stellar Cyber from the Available Networks and click Add to Destination.

   5. Click Save.

   6. You can view the policy and the rules as follows:

      

9. You should have the following information ready to configure your connector:

   • User Name and Password

   • Device IP Address

   • Source IP Group

   • Destination IP Group

   • Cisco FMC must be enabled for API access

Adding the Connector in Stellar Cyber

With the access information handy, you can add a Cisco FMC  connector in Stellar Cyber:

1. Log in to Stellar Cyber.

2. Click System | Connectors (under Integrations). The Connector Overview appears.

   

3. Click Create. The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.

   

   The asterisk (*) indicates a required field.

4. Choose Firewall from the Category drop-down.

5. Choose Cisco FMC from the Type drop-down.

6. For this connector, the supported Function is Respond, which is enabled already.

7. Enter a Name.

   Notes:

   • This field does not accept multibyte characters.
   • It is recommended that you follow a naming convention such as tenantname-connectortype.

8. Choose a Tenant Name. This identifies which tenant is allowed to use the connector.

9. Choose the device on which to run the connector.

   • Certain connectors can be run on either a Sensor or a Data Processor. The available devices are displayed in the Run On menu. If you want to associate your collector with a sensor, you must have configured that sensor prior to configuring the connector or you will not be able to select it during initial configuration. If you select Data Processor, you will need to associate the connector with a Data Analyzer profile as a separate step. That step is not required for a sensor, which is configured with only one possible profile.

   • If the device you're connecting to is on premises, we recommend you run on the local sensor. If you're connecting to a cloud service, we recommend you run on the DP.

10. Click Next. The Configuration tab appears.

    

    The asterisk (*) indicates a required field.

11. Using the data you collected in the previous section, complete the following fields:

    • User Name

    • Password

    • Device IP Address

    • Source IP Group

    • Destination IP Group

12. Click Next. The final confirmation tab appears.

    

13. Click Submit.

The new connector is immediately active.

Testing the Connector

When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates authentication and connectivity).

1. Click System | Connectors (under Integrations). The Connector Overview appears.

   

2. Locate the connector by name that you added, or modified, or that you want to test.

3. Click Test at the right side of that row. The test runs immediately.

   Note that you may run only one test at a time.