About Interfaces
The Firepower 4100/9300 chassis supports physical interfaces and EtherChannel (port-channel) interfaces. EtherChannel interfaces can include up to 16 member interfaces of the same type.
Chassis Management Interface
The chassis management interface is used for management of the FXOS Chassis by SSH or Firepower Chassis Manager. This interface appears at the top of the Interfaces tab as MGMT, and you can only enable or disable this interface on the Interfaces tab. This interface is separate from the mgmt-type interface that you assign to the logical devices for application management.
To configure parameters for this interface, you must configure them from the CLI. To view information about this interface in the FXOS CLI, connect to local management and show the management port:
Firepower # connect local-mgmt
Firepower(local-mgmt) # show mgmt-port
Note that the chassis management interface remains up even if the physical cable or SFP module are unplugged, or if the mgmt-port shut command is performed.
Note |
The chassis management interface does not support jumbo frames. |
Interface Types
Physical interfaces and EtherChannel (port-channel) interfaces can be one of the following types:
-
Data—Use for regular data. Data interfaces cannot be shared between logical devices, and logical devices cannot communicate over the backplane to other logical devices. For traffic on Data interfaces, all traffic must exit the chassis on one interface and return on another interface to reach another logical device.
-
Data-sharing—Use for regular data. Only supported with container instances, these data interfaces can be shared by one or more logical devices/container instances (Firepower Threat Defense-using-FMC only).
-
Mgmt—Use to manage application instances. These interfaces can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface. You can only assign one management interface per logical device. Depending on your application and manager, you can later enable management from a data interface; but you must assign a Management interface to the logical device even if you don't intend to use it after you enable data management. For information about the separate chassis management interface, see Chassis Management Interface.
Note
Mgmt interface change will cause reboot of the logical device, for example one change mgmt from e1/1 to e1/2 will cause the logical device to reboot to apply the new management.
-
Eventing—Use as a secondary management interface for Firepower Threat Defense-using-FMC devices.
Note
A virtual Ethernet interface is allocated when each application instance is installed. If the application does not use an eventing interface, then the virtual interface will be in an admin down state.
Firepower # show interface Vethernet775 Firepower # Vethernet775 is down (Administratively down) Bound Interface is Ethernet1/10 Port description is server 1/1, VNIC ext-mgmt-nic5
-
Cluster—Use as the cluster control link for a clustered logical device. By default, the cluster control link is automatically created on Port-channel 48. The Cluster type is only supported on EtherChannel interfaces.
See the following table for interface type support for the FTD and ASA applications in standalone and cluster deployments.
Application |
Data |
Data: Subinterface |
Data-Sharing |
Data-Sharing: Subinterface |
Mgmt |
Eventing |
Cluster (EtherChannel only) |
Cluster: Subinterface |
|
---|---|---|---|---|---|---|---|---|---|
FTD |
Standalone Native Instance |
Yes |
— |
— |
— |
Yes |
Yes |
— |
— |
Standalone Container Instance |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
— |
— |
|
Cluster Native Instance |
Yes (EtherChannel only for inter-chassis cluster) |
— |
— |
— |
Yes |
Yes |
Yes |
— |
|
Cluster Container Instance |
Yes (EtherChannel only for inter-chassis cluster) |
— |
— |
— |
Yes |
Yes |
Yes |
Yes |
|
ASA |
Standalone Native Instance |
Yes |
— |
— |
— |
Yes |
— |
Yes |
— |
Cluster Native Instance |
Yes (EtherChannel only for inter-chassis cluster) |
— |
— |
— |
Yes |
— |
Yes |
— |
FXOS Interfaces vs. Application Interfaces
The Firepower 4100/9300 manages the basic Ethernet settings of physical interfaces and EtherChannel (port-channel) interfaces. Within the application, you configure higher level settings. For example, you can only create EtherChannels in FXOS; but you can assign an IP address to the EtherChannel within the application.
The following sections describe the interaction between FXOS and the application for interfaces.
VLAN Subinterfaces
For all logical devices, you can create VLAN subinterfaces within the application.
Independent Interface States in the Chassis and in the Application
You can administratively enable and disable interfaces in both the chassis and in the application. For an interface to be operational, the interface must be enabled in both operating systems. Because the interface state is controlled independently, you may have a mismatch between the chassis and application.