Sending a management request using the CLI for a connection that supports shifting appliance IP addresses

Prev Next

Follow these steps to request a management connection that supports appliance IP address changes and automatic reconnections to the Central Management System appliance.

This feature uses CMC rendezvous functionality to set up the client record in the CMC.

The Central Management Console (CMC) provides basic management and control capabilities for the rendezvous server (Central Management System appliance) and its clients (managed appliances).

Note

The rendezvous process requires configuration on both the Central Management System appliance and the requesting appliance. You use the cmc rendezvous server commands on the Central Management System appliance and cmc rendezvous client commands on the managed appliance.

Prerequisites
  • The Central Management System appliance has been enabled to support this feature. See "Preparing to Accept Requests for Management Connections that Support Shifting Appliance IP Addresses Using the CLI" in the Central Management System Administration Guide.

To request a management connection that supports shifting appliance IP addresses:
  1. Log in to the Network Security appliance CLI.

  2. Go to CLI configuration mode:

    hostname > enable
    hostname # configure terminal
  3. Specify the IP address of the Central Management System appliance you want to rendezvous with:

    hostname (config) # cmc rendezvous client server-addr 10.13.65.66
  4. Specify client-initiated rendezvous attempts with the Central Management System appliance:

    hostname (config) # cmc rendezvous client enable-client-init
  5. Enable automatic rendezvous attempts with the Central Management System appliance:

    hostname (config) # cmc rendezvous client auto

    Note

    After automatic rendezvous is enabled, when the requesting managed appliance is behind a NAT gateway, the local IP address of the appliance will be included in the request instead of the mapped address.

  6. (Optional) If the managed Network Security appliance is behind a NAT gateway, prevent the appliance from communicating its private IP address to the Central Management System appliance.

    hostname (config) # no cmc rendezvous client send-client-address

    Note

    To restore the default behavior so that the appliance includes its local IP address in rendezvous attempts with the Central Management System appliance, use the cmc rendezvous client send-client-address command.

  7. Display the CMC rendezvous configuration and state.

    hostname (config) # show cmc rendezvous
    CMC rendezvous service name: cmc
    
    CMC client:
       Server address: 10.13.65.66Automatic rendezvous: yes
       Initial retry delay (after boot or disconnect): 30 seconds
       Short retry interval (after unsuccessful announcement): 300 seconds
       Long retry interval (after successful announcement): 86400 seconds
    
       Include client address in rendezvous:yesUse client initiated connection's config for rendezvous: yes
       Under CMC management: yes
    
       How to authenticate to server for rendezvous:
       Authentication type: password
       Password for password auth: ********
  8. Specify the IP address of the Central Management System appliance you want to manage the appliance:

    hostname (config) # cmc client server address 10.13.65.66
  9. Specify password-based authentication to the Central Management System appliance:

    hostname (config) # cmc client server auth authtype password
    hostname (config) # cmc client server auth password username my_CMname
    hostname (config) # cmc client server auth password password ########
  10. Display the CMC client configuration and state.

    hostname (config) # show cmc client
  11. Save your changes.

    hostname (config) # write memory