Firepower Threat Defense (FTD)

Initial Configuration

When an FTD device is first brought up, several actions must be completed before it can be managed via the REST API:

  • Accept the EULA
  • Change the default password
  • Skip easy setup
  • Choose SmartLicense

The easy setup and smartlicense actions can be handled either in the UI or the REST API. The following instructions are for using the Initial Provision REST API to complete all of the initial configuration actions.

Note: When a 4100/9300 device is installed, the EULA is accepted and the password is set in FXOS, and there is no easy setup configuration. On these devices, only the SmartLicense action needs to be performed.

To Perform Initial Provisioning:

Step 1

  • If this a 4100 series or 9300 device, skip ahead to Step 4.
  • Otherwise, proceed to the next step.

Step 2

Send a GET request to obtain the Provision list.

Request
Copycurl -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.example/api/fdm/latest/devices/default/action/provision

 

Response
Copy{
  "items" : [ {
    "version" : null,
    "acceptEULA" : null,
    "eulaText" : "End User License Agreement (very long text omitted in this example)",
    "currentPassword" : null,
    "newPassword" : null,
    "id" : "default",
    "type" : "initialprovision",
    "links" : {
      "self" : "https://ftd.example/api/fdm/latest/devices/default/action/provision/default"
    }
  } ],
  "paging" : {
    "prev" : [ ],
    "next" : [ ],
    "limit" : 10,
    "offset" : 0,
    "count" : 1,
    "pages" : 0
  }
}

Step 3

Send a POST request to accept the Provision list. Use the provision object returned in the previous step, updating the acceptEULA, currentPassword, and newPassword properties. The password properties should be passed as strings, in the clear. All other fields should be left alone, except for version and links, which can be omitted. Successfully posting this request will also cause easy setup to be skipped, and will select the evaluation option for the SmartLicense.

Request
Copycurl -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN"  -H "Content-Type: application/json" -d @json.txt  https://ftd.example/api/fdm/latest/devices/default/action/provision

 

JSON_Text
Copy{
    "acceptEULA" : true,
    "eulaText" : "End User License Agreement (very long text omitted in this example)",
    "currentPassword" : "example-current-password",
    "newPassword" : "example-new-password",
    "id" : "default",
    "type" : "initialprovision"
}

 

Response
Copy{
    "version" : null,
    "acceptEULA" : true,
    "eulaText" : "End User License Agreement (very long text omitted in this example)",
    "currentPassword" : null,
    "newPassword" : null,
    "id" : "default",
    "type" : "initialprovision",
    "links" : {
      "self" : "https://ftd.example/api/fdm/latest/devices/default/action/provision/default"
    }
}

If you send this POST request more than once, an error response is returned, and any changes to EULA acceptance or password will not take effect:

Subsequent_Responses
Copy{
  "error" : {
    "severity" : "ERROR",
    "key" : "Validation",
    "messages" : [ {
      "description" : "The initial device setup is complete. You can now manage the device and change the configuration.",
      "code" : "DeviceSetupAlreadyDone",
      "location" : ""
    } ]
  }
}

STOP HERE, INITIAL CONFIGURATION IS COMPLETE

Step 4

Send a smart agent connection GET request.

Request
Copycurl -H "Accept: application/json" -H "Authorization: Bearer ACCESS_TOKEN"  https://ftd.example/api/fdm/latest/license/smartagentconnections

 

Response_no_smart_license
Copy{
  "items" : [],
  "paging" : {
    "prev" : [ ],
    "next" : [ ],
    "limit" : 10,
    "offset" : 0,
    "count" : 0,
    "pages" : 0
  }
}

 

Response_smart_license_found
Copy{
  "items" : [ {
    "version" : "bzmkvc7itrxj",
    "connectionType" : "EVALUATION",
    "token" : null,
    "id" : "648be902-be2c-11e9-8f1a-c315d5dca59b",
    "type" : "smartagentconnection",
    "links" : {
      "self" : "https://ftd.example/api/fdm/latest/license/smartagentconnections/648be902-be2c-11e9-8f1a-c315d5dca59b"
    }
  } ],
  "paging" : {
    "prev" : [ ],
    "next" : [ ],
    "limit" : 10,
    "offset" : 0,
    "count" : 1,
    "pages" : 0
  }
}

Step 5

  • If the response includes a "smartagentconnection" item, stop here, initialization is complete.
  • Otherwise, proceed to the next step.

Step 6

Send a smart agent connection POST request to set the Smart License to Evaluation mode.

Request
Copycurl -H "Accept: application/json" -H "Content-Type: application/json" -H "Authorization: Bearer ACCESS_TOKEN" -H "Content-Type: application/json" -d json.txt https://ftd.example/api/fdm/latest/license/smartagentconnections

 

JSON_request_content_data
Copy{
    "type":"smartagentconnection",
    "connectionType":"EVALUATION"
}

 

Response
Copy{
  "version" : "bzmkvc7itrxj",
  "connectionType" : "EVALUATION",
  "token" : null,
  "id" : "648be902-be2c-11e9-8f1a-c315d5dca59b",
  "type" : "smartagentconnection",
  "links" : {
    "self" : "https://ftd.example/api/fdm/latest/license/smartagentconnections/648be902-be2c-11e9-8f1a-c315d5dca59b"
  }
}
Next