Configuring and activating an accessible DTI server address

The Central Management System appliance can act as the DTI source for its managed appliances to download software updates (such as security content, guest images, and system images). In a dual-port configuration, management traffic goes through the SSH port, and DTI traffic goes through the HTTPS port. When the Central Management System appliance is behind a NAT gateway, it has an internal IP address that the managed appliances cannot reach.

In this environment, you must configure and activate an accessible address that the managed appliances will use as the DTI source for software updates. This address is the virtual NAT IP address and port that are mapped to the Central Management System internal IP address and port 443. For details, see Switching to single-port or dual-port Communication in a NAT deployment.

The accessible DTI server address must be configured and activated on each managed appliance. In addition, on managed appliances running a supported release (see note below), a "no override" flag needs to be set to prevent the default Central Management System address from overriding the accessible address.

Important

Any managed appliances behind the same NAT gateway as the Central Management System appliance will use the default Central Management System appliance as their DTI source and require no additional configuration.

An accessible DTI server address is required only in a dual-port configuration. If you change from dual-port to single-port communication, you must remove the "no override" flag and instead set an "override" flag to allow the Central Management System appliance to push the single-port settings to the managed appliance. For details, see Switching to single-port or dual-port communication in a NAT deployment.

Configuring and activating an accessible DTI server address using the CLI

Use the CLI commands in this section to configure a custom DTI address, and activate it as an accessible DTI server address for managed Network Security appliances using the dual-port address type.

Important

Do not use this procedure for any reason other than the scenario described in Changing the address type for DTI network service requests .

You must enter the commands in the order shown.

Note

This configuration must be performed on each managed appliance. You can repeat the procedure on each appliance, or use appliance group functionality to configure the accessible address on multiple appliances at the same time.

Only one custom DTI address can be configured.

Deleting the custom DTI source

You can delete the custom DTI source, which removes it from the list of available options.

Note

You cannot delete the custom DTI source if it is an active DTI source for managed appliances.

Example

The following example configures a custom address named "CUSTOM" and prevents the Central Management System appliance from overriding it with the Central Management System local address.

appl-hostname (config) # no fenet dti source override enable
appl-hostname (config) # fenet dti source type CUSTOM address 10.3.3.5 port 2000
appl-hostname (config) # fenet dti source type CUSTOM username user8 password 123ABCXYZ
appl-hostname (config) # fenet dti source default CUSTOM
appl-hostname (config) # no fenet dti upload destination override enable
appl-hostname (config) # fenet dti upload destination type CUSTOM address 3.3.3.5 port 2000
appl-hostname (config) # fenet dti upload destination type CUSTOM username user8 password 123ABCXYZ
appl-hostname (config) # fenet dti upload destination default CUSTOM
...

appl-hostname (config) # show fenet
DTI CLIENT CONFIGURATION:
  Download source    :  CUSTOM (user8@10.3.3.5)
  Upload destination :  CUSTOM (user8@10.3.3.5) 
  Update channel     :  CUSTOM (user8@10.3.3.5)  
  Http proxy         :  None
  Connect timeout    :  30 (max tries: 3)
  Speed Time         :  60
  Max Time           :  14400
  Rate Limit         :  None
  Lockdown enabled   :  No
  SSL minimum version:  tls1
  SSL cipher list    :  compatible

Switching to single-port or dual-port communication in a NAT deployment

Managed Network Security appliances can communicate with the Central Management System appliance over a single port or using two ports. (For details, see About changing the address type for DTI network service requests .)

In the dual-port configuration, if the Central Management System appliance is in an internal network behind a NAT gateway, a custom DTI source address must be configured. The custom address allows the managed appliance to access the HTTPS port on the Central Management System appliance to request software updates from the DTI network. (For details, see Configuring and activating an accessible DTI server address .)

To configure the custom address, you must set a flag to prevent the Central Management System appliance from overriding the custom address settings. If you switch from dual-port to single-port communication, you must remove this flag so the Central Management System appliance can push the single-port settings to the Network Security appliance.

Example

The following example allows the Central Management System appliance to push the single-port settings to the Network Security appliance, after the address type was changed from dual-port to single-port.

appl-hostname (config) # fenet dti source override enable
appl-hostname (config) # fenet dti upload destination override enable
appl-hostname (config) # fenet dti mil service override enable
appl-hostname (config) # fenet dti avsuite service override enable
appl-hostname (config) # write memory
appl-hostname (config) # show fenet dti configuration


DTI CLIENT CONFIGURATION:
  Download source    :  CMS (DTIUser@10.2.0.0 : singleport) - Managed by CMS
  Upload destination :  CMS (DTIUser@10.2.0.0 : singleport) - Managed by CMS
  Mil service        :  CMS (DTIUser@10.2.0.0 : singleport) - Managed by CMS
  
  
...

AVSuite service    : CMS (DTIUser@10.2.0.0 : singleport)  - Managed by CMS