Cisco FMC

Cisco FMC#

Note

Cisco FireSIGHT was rebranded to Cisco Firewall Management Center (FMC). This page (formerly “Cisco FireSIGHT”) covers the same integration under its current name.

Scrutinizer can be configured to receive flows from a Cisco FMC system via its Event Streamer (eStreamer) service.

After this integration is enabled, the following reports become available in Scrutinizer:

  • App Internet HTTP Host

  • Application E-Zone & Sub Type

  • Application I-Zone & Sub Type

  • Firewall List

  • Ingress and Egress Zones

  • User App HTTP Host

  • User App HTTP URL

  • User Application

  • Web App & CoS

  • Web App Event & Rule Details

  • Web App and Source IP

Important

The minimum supported eStreamer version is 5.4.

Registering Scrutinizer with Cisco FMC#

Before setting up the integration in Scrutinizer, the server/collector must be registered under the FMC Defense Center:

  1. Log into the FMC Defense Center.

    For Firepower v5.4: Navigate to System > Local > Registration

    For Firepower v6.x: Navigate to System > Integration > eStreamer

  2. Enable all eStreamer Events, and then click Save.

  3. Click the Create Client (+) button, and then enter the IP address of the Scrutinizer collector.

  4. [OPTIONAL] Enter a password.

  5. Locate the Scrutinizer client in the list, and then click Download to download the client certificate.

  6. Upload the client certificate to the /home/plixer/scrutinizer/files/ directory on the Scrutinizer appliance.

Configuring Scrutinizer as an eStreamer client#

After the Scrutinizer collector has been registered, it will need to be configured to start receiving FMC flows:

  1. Start an SSH session with the Scrutinizer collector.

  2. Edit the /etc/fireseer.ini file to reflect your Scrutinizer collector and FMC configuration:

    • CollectorIp - Scrutinizer collector IP address

    • CollectorPort - Scrutinizer receiving port for FMC flows

    • fdi_templates - Path where export templates are defined (default: /home/plixer/scrutinizer/files/fdi_templates/fireseer.fdit)

    • host - FMC server address

    • port - FMC server outbound port

    • pkcs12_file - Location of the FMC eStreamer client certificate (default: /home/plixer/scrutinizer/files/<Plixer_Scrutinizer_IP>.pkcs12)

    • pkcs12_password - Password entered during registration process; leave blank if no password was set

    • fs_bind_addr - eStreamer client address (collector IP address)

    • export_to - Collector name set at the beginning of the file

    Note

    • The Scrutinizer eStreamer client configuration will automatically be updated whenever fireseer.ini is modified.

    • Editing the provided fireseer.ini file is recommended, but a new file can also be created in the same directory. A sample file (fireseer.ini.sample) can be found in /home/plixer/scrutinizer/files.

    • Multiple collectors and FMC servers with unique names can be set up within the same fireseer.ini file. A collector can be configured to receive flows from more than one source and a FMC server can send flows to more than one destination.

  3. The eStreamer client will export flows to the collector at CollectorIP and CollectorPort.

  4. fdi_templates is the path where the export templates are defined. Use the location provided in the example.

  5. The eStreamer client will connect to the FMC at the FMC host and port.

  6. pkcs12_file is the location of the updated FMC eStreamer client certificate.

  7. pkcs12_password is the certificate password, or blank if a password wasn’t specified.

  8. fs_bind_addr is the eStreamer client address registered with FMC (Scrutinizer collector IP address). It must be a bindable address that can route to the eStreamer service.

  9. export_to tells the eStreamer client which collector or collectors will receive exported flows.

  10. In the /home/plixer/scrutinizer/env/local_env file, change the value for export PLIXER_NO_FIRESEER=1 to 0.

  11. Restart the collector using the command: service plixer_flow_collector restart

After the restart, Scrutinizer should start receiving FMC flows within 1 minute. For assistance with the configuration process or troubleshooting help, contact Plixer Technical Support.