Change the Manager Access Interface from Data to Management

You can manage the threat defense from either the dedicated Management interface, or from a data interface. If you want to change the manager access interface after you added the device to the management center, follow these steps to migrate from a data interface to the Management interface. To migrate the other direction, see Change the Manager Access Interface from Management to Data.

Initiating the manager access migration from data to Management causes the management center to apply a block on deployment to the threat defense. You must disable manager access on the data interface to remove the block.

See the following steps to disable manager access on a data interface, and also configure other required settings.

Procedure

Step 1

Initiate the interface migration.

  1. On the Devices > Device Management page, click Edit (edit icon) for the device.

  2. Go to the Device > Management section, and click the link for FMC Access Interface.

    The FMC Access Interface field shows the current management interface as data. When you click the link, choose the new interface type, Management Interface, in the Manage device by drop-down list.

  3. Click Save.

    You must now complete the remaining steps in this procedure to enable manager access on the Management interface. The Management area now shows the FMC Access Interface: Management Interface, and FMC Access Details: Configuration.

    FMC Access
    FMC Access

    If you click Configuration, the FMC Access - Configuration Details dialog box opens. The FMC Access Mode shows a Deploy pending state.

    FMC Access Mode
    FMC Access Mode

Step 2

Disable manager access on the data interface on the Devices > Device Management > Interfaces > Edit Physical Interface > FMC Access page.

This step removes the block on deployment.

Step 3

If you have not already done so, configure DNS settings for the data interface in a Platform Setting policy, and apply it to this device at Devices > Platform Settings > DNS.

The management center deployment that disables manager access on the data interface will remove any local DNS configuration. If that DNS server is used in any security policy, such as an FQDN in an Access Rule, then you must re-apply the DNS configuration using the management center.

Step 4

The management center will deploy the configuration changes over the current data interface.

Step 5

If necessary, re-cable the threat defense so it can reach the management center on the Management interface.

Step 6

At the threat defense CLI, configure the Management interface IP address and gateway using a static IP address or DHCP.

When you originally configured the data interface for manager access, the Management gateway was set to data-interfaces, which forwarded management traffic over the backplane so it could be routed through the manager access data interface. You now need to set an IP address for the gateway on the management network.

Static IP address:

configure network {ipv4 | ipv6} manual ip_address netmask gateway_ip

DHCP:

configure network{ipv4 | ipv6} dhcp

Step 7

In the management center, disable the management connection, update the Host IP address for the threat defense in the Devices > Device Management > Device > Management section, and reenable the connection.

See Update the Hostname or IP Address in the Management Center. If you used the threat defense hostname or just the NAT ID when you added the threat defense to the management center, you do not need to update the value; however, you need to disable and re-enable the management connection to restart the connection.

Step 8

Ensure the management connection is reestablished.

In the management center, check the management connection status on the Devices > Device Management > Device > Management > Status field or view notifications in the management center.

At the threat defense CLI, enter the sftunnel-status-brief command to view the management connection status.

If it takes more than 10 minutes to reestablish the connection, you should troubleshoot the connection. See Troubleshoot Management Connectivity on a Data Interface.