Cisco Secure Firewall: CLI (FMC REST API)¶

Apply the same fix as the GUI (FMC) guide without the web interface, using curl against the FMC REST API. For the symptoms this addresses and the endpoint details, see the Cisco Secure Firewall overview.

Note

An FMC-managed FTD has no supported command line for policy changes: the FTD CLI is diagnostic only, and configuration always comes from FMC. The FMC REST API is the supported non-GUI path, so that is what this page uses.

Before you start

You need FMC 6.5 or later (prefilter rule creation over the API), the REST API enabled (it is by default; check System > Configuration > REST API Preferences), and an FMC user account for the API. Avoid using that same account in the web UI at the same time; FMC invalidates its sessions. The examples use -k for FMC's typical self-signed certificate; drop it if your FMC presents a certificate your host trusts.

1. Authenticate and capture IDs¶

Request a token with your FMC credentials. The response headers carry the session token and the domain UUID that every later call needs.

curl -sk -i -X POST \
  -u '<USERNAME>:<PASSWORD>' \
  https://<FMC_HOST>/api/fmc_platform/v1/auth/generatetoken

From the response headers, record:

X-auth-access-token: the session token (valid for 30 minutes), sent as the X-auth-access-token header on every call below
DOMAIN_UUID: the domain UUID used in every URL below

2. Create the FQDN network object¶

FQDN objects work in Access Control Policy rules (Option B) but not in Prefilter Policy rules (Option A uses IP literals instead).

curl -sk -X POST \
  -H 'X-auth-access-token: <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "rta-connect-endpoint",
    "type": "FQDN",
    "value": "connect.remotetesting.secureworks.com",
    "dnsResolution": "IPV4_ONLY"
  }' \
  https://<FMC_HOST>/api/fmc_config/v1/domain/<DOMAIN_UUID>/object/fqdns

Record the id field from the JSON response; Option B references it as <OBJECT_UUID>.

3. Allow the flow¶

Same two options as the GUI guide.

Option A: Prefilter Fastpath (recommended)¶

A Fastpath rule bypasses Snort and all L7 inspection, and it also bypasses the decryption engine, so no separate Do-Not-Decrypt exemption is needed for this flow. Prefilter rules match by IP and port only, so the rule uses the two static headend IPs for connect.remotetesting.secureworks.com.

First find the UUID of the prefilter policy applied to the relevant device:

curl -sk \
  -H 'X-auth-access-token: <TOKEN>' \
  https://<FMC_HOST>/api/fmc_config/v1/domain/<DOMAIN_UUID>/policy/prefilterpolicies

Warning

The built-in Default Prefilter Policy cannot hold custom rules. If the listing shows only the default policy, create a custom prefilter policy and associate it with the Access Control Policy first (or use Option B).

Then create the Fastpath rule. The ?insertBefore=1 parameter places it at the top of the policy, above any block rules for the same port range:

curl -sk -X POST \
  -H 'X-auth-access-token: <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "rta-fastpath",
    "type": "PrefilterRule",
    "ruleType": "PREFILTER",
    "enabled": true,
    "action": "FASTPATH",
    "destinationNetworks": {
      "literals": [
        {"type": "Host", "value": "3.33.194.251"},
        {"type": "Host", "value": "15.197.255.2"}
      ]
    },
    "destinationPorts": {
      "literals": [
        {"type": "PortLiteral", "protocol": "6", "port": "443"}
      ]
    }
  }' \
  "https://<FMC_HOST>/api/fmc_config/v1/domain/<DOMAIN_UUID>/policy/prefilterpolicies/<PREFILTER_POLICY_UUID>/prefilterrules?insertBefore=1"

Option B: Access Control Policy allow rule¶

If you cannot use a Prefilter Fastpath, add an allow rule to the Access Control Policy instead. Find the policy UUID:

curl -sk \
  -H 'X-auth-access-token: <TOKEN>' \
  https://<FMC_HOST>/api/fmc_config/v1/domain/<DOMAIN_UUID>/policy/accesspolicies

Then create the rule, referencing the FQDN object from step 2. No ipsPolicy is set, which leaves the rule's intrusion policy at None so Snort does not evaluate and drop the flow. ?insertBefore=1 orders it above any application-based block rules that match OpenVPN or unclassified-on-443 traffic:

curl -sk -X POST \
  -H 'X-auth-access-token: <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "rta-allow",
    "type": "AccessRule",
    "action": "ALLOW",
    "enabled": true,
    "destinationNetworks": {
      "objects": [
        {"type": "FQDN", "id": "<OBJECT_UUID>", "name": "rta-connect-endpoint"}
      ]
    },
    "destinationPorts": {
      "literals": [
        {"type": "PortLiteral", "protocol": "6", "port": "443"}
      ]
    }
  }' \
  "https://<FMC_HOST>/api/fmc_config/v1/domain/<DOMAIN_UUID>/policy/accesspolicies/<ACCESS_POLICY_UUID>/accessrules?insertBefore=1"

Warning

Option B does not bypass decryption. If an SSL/Decryption Policy decrypts outbound 443 traffic, also add the Do-Not-Decrypt rule described in the GUI guide, section 2; the decryption-policy REST endpoints vary by FMC release, so the web interface is the dependable way to add that exemption.

4. Deploy and verify¶

Deploy¶

Policy changes are staged until pushed to the device. List the devices with pending changes and note each device's device.id (the <DEVICE_UUID>) and version:

curl -sk \
  -H 'X-auth-access-token: <TOKEN>' \
  "https://<FMC_HOST>/api/fmc_config/v1/domain/<DOMAIN_UUID>/deployment/deployabledevices?expanded=true"

Then deploy, using the version value returned for the target device:

curl -sk -X POST \
  -H 'X-auth-access-token: <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "DeploymentRequest",
    "version": "<VERSION>",
    "forceDeploy": false,
    "ignoreWarning": true,
    "deviceList": ["<DEVICE_UUID>"]
  }' \
  https://<FMC_HOST>/api/fmc_config/v1/domain/<DOMAIN_UUID>/deployment/deploymentrequests

Wait for the deployment task to finish before testing.

Verify connectivity¶

From a host on the same network segment as the RTA:

nc -vz connect.remotetesting.secureworks.com 443

A successful response looks like:

Connection to connect.remotetesting.secureworks.com port 443 [tcp/https] succeeded!

Then confirm the RTA establishes and holds its OpenVPN tunnel (the connection should remain stable, not reset within a few seconds).

Check connection events¶

In FMC, go to Analysis > Connections > Events and filter on:

Destination IP / Hostname: connect.remotetesting.secureworks.com
Destination Port: 443

Confirm the action is Allow (or Fastpath if the Prefilter rule fired) and that no subsequent blocks appear for the same flow.