Firepower Management Center Command Line Reference

1 FirepowerManagementCenterCommandLineRefe renceThis referenceexplainsthe commandline interface(CLI) for the Classicdevices(7000 and 8000 Series, ASA Firepower , NGIPSv), see FirepowerThreat Defense, see the Cisco FirepowerThreat About the FirepowerManagementCenterCLI, on page 1 FirepowerManagementCenterCLI ManagementCommands, on page 3 FirepowerManagementCenterCLI Show Commands, on page 4 FirepowerManagementCenterCLI ConfigurationCommands, on page 4 FirepowerManagementCenterCLI SystemCommands, on page 5 Historyfor the FirepowerManagementCenterCLI, on page 7 Aboutthe FirepowerManagementCenterCLIThe FirepowerManagementCenterCLI is availableonly when a user with theadminuser role has enabledit.

2 By defaultthe CLI is not enabled,and users who log into the FirepowerManagementCenterusingCLI/shella ccountshave direct access to the Linux shell. When the CLI is enabled,users who log in the FirepowerManagementCenterusing shell/CLIaccountshave access to the CLI and must use theexpertcommandto access the Linux stronglyrecommendthat you do not access the Linux shell unless directedby Cisco TAC or explicitinstructionsin the Firepoweruser , ,we stronglyrecommend: If you establishexternalauthentication,make sure that you restrictthe list of users with Linux shellaccess appropriately. Do not establishLinux shell users in additionto the the CLI is enabled,you can use the commandsdescribedin this appendixto view and troubleshootyour FirepowerManagementCenter, as well as ModesThe CLI encompassesfour defaultmode, CLI Management ,includescommandsfor navigatingwithin the CLI itself.

3 The remainingmodes containcommandsaddressingthree different areas of FirepowerManagementCenterfunctionality;t he commandswithin these modes begin with the mode name:system,show, you enter a mode, the CLI promptchangesto reflect the currentmode. For example,to displayversioninformationabout systemcomponents,you can enter the full commandat the standardCLI prompt:> show versionIfyouhavepreviouslyenteredshowmod e,youcanenterthecommandwithouttheshowkey wordattheshowmode CLI prompt:show> versionEnablingthe FirepowerManagementCenterCLIA ccessSupportedDomainsSupportedDevicesCla ssicLicenseSmartLicenseadminAnyFMCAnyN/A Once the FirepowerManagementCenterCLI is enabled,the initial access to the appliancefor users loggingin to the managementinterfacewill be via the CLI.

4 The Linux shell will be accessibleonly via the administratorhas disabledaccess to the device shell with thesystemlockdowncommand,theEnableCLIA ccesscheckboxis checkedand > ModesStep3To enable or disablethe FirepowerManagementCenterCLI check or ManagementCommandsThe CLI managementcommandsprovidethe ability to interactwith the CLI. These commandsdo not affectthe operationof the CLI contextup to the next highestCLI commandfrom the defaultmodelogs the user out of the currentCLI >exit>expertInvokesthe Linux > expert? (questionmark)Displayscontext-sensitiveh elp for CLI commandsand the questionmark (?) commandasfollows: To displayhelp for the commandsthat are availablewithin the currentCLI context,enter a questionmark (?)

5 At the ManagementCommands Todisplayalistoftheavailablecommandsthat startwithaparticularcharacterset,enterth eabbreviatedcommandimmediatelyfollowedby a questionmark (?). To displayhelp for a Command s legal arguments,enter a questionmark (?) in place of an argumentatthe that the questionmark (?) is not echoedback to the [arguments]?Example> ?FirepowerManagementCenterCLI ShowCommandsShow commandsprovideinformationabout the state of the commandsdo not changetheoperationalmode of the applianceand runningthem has minimalimpacton productversionand > showversionFirepowerManagementCenterCLI ConfigurationCommandsThe configurationcommandsenable the user to configureand managethe currentCLI/shell user to changetheir ShowCommandsFor systemsecurityreasons,we stronglyrecommendthat you do not establishLinux shell users in additionto the pre-definedadminon any issuingthe Command ,the CLI promptsthe user for their current(or old)

6 Password,then promptstheuser to enter the new > configurepasswordChangingpasswordfor admin.(current)UNIX password:New UNIX password:Retypenew UNIX password:passwd:passwordupdatedsuccessfu llyFirepowerManagementCenterCLI SystemCommandsThe systemcommandsenable the user to managesystem-widefiles and access for analysisby one or more of the following,space-separated: ALL: Run all of the followingoptions. SNT: Snort Performanceand Configuration PER: HardwarePerformanceand Logs SYS: SystemConfiguration,Policy, and Logs DES: DetectionConfiguration,Policy, and Logs NET: Interfaceand NetworkRelatedData VDB: Discover, Awareness,VDB Data, and Logs UPG: UpgradeData and Logs DBO: All DatabaseDataFirepowerManagementCenterCom mandLineReference5 FirepowerManagementCenterCommandLineRefe renceFirepowerManagementCenterCLI SystemCommands LOG: All Log Data NMP.

7 NetworkMap InformationExample> systemgenerate-troubleshootVDB NMPstarting/usr/local/sf/ ,be troubleshootoptionscodesspecifiedare VDB, [usr/local/sf/etc/db_updates/index]Getti ngfilenamesfrom[usr/local/sf/etc/db_ ]Troubleshootinginformationsuccessfullyc reatedat/var/common/results-06-14-2018 access to the Linux shell on the commandis irreversiblewithouta hotfix from with > systemlockdownrebootRebootsthe > systemrebootrestartRestartsthe > systemrestartshutdownShuts down the > systemshutdownHistoryfor the FirepowerManagementCenterCLID etailsVersionFeatureNew/Modifiedscreens: New check box availableto administratorsin FMC web interface:EnableCLIA ccesson theSystem>Configuration>ConsoleConfigura tionpage.

8 Checked:Logginginto the FMC using SSH accessesthe CLI. enable followingcommands: exit expert ? showversion configurepassword systemgenerate-troubleshoot systemlockdown systemreboot systemrestart CLIF irepowerManagementCenterCommandLineRefer ence8 FirepowerManagementCenterCommandLineRefe renceFirepowerManagementCenterCommandLin eReferenc