Manual export

Export a Cisco FTD by hand

One CLISH transcript of the device. FMC and cdFMC come through the Relay.

On this page

Run the commands
Save the transcript
What the upload is read for
Through the Relay
Upload
Operational CLI commands

Run the commands

FTD CLISH

show version
show managers
show running-config
show access-control-config
show failover
show failover state
show user
show ntp
show ssh-access-list
show license all
show network

Save the transcript

Save the whole session as one .txt file and keep the > prompt lines. Each output is read under the command on the prompt line above it.
Run each command without an | include filter. The output is filed under the command before the |, so a filtered output reads as if it were complete.

What the upload is read for

Output	Read for
`show version`	Model, serial, release, and LSP, SRU and VDB versions
`show managers`	Whether FMC, cdFMC or FDM manages it, and the registration
`show running-config`	Interfaces, objects, access rules, NAT, static routes, VPN, failover and management settings
`show access-control-config`	Rule names and the Snort-side settings: intrusion and file policy, logging
`show failover`	Both units' serials, which identify the HA pair
`show failover state`	This unit's and the peer's state
`show user`	Local CLI users
`show ntp`	NTP servers
`show ssh-access-list`	Who may open SSH
`show license all`	Smart Licensing registration and authorization
`show network`	Management address

Over SSH ConfigProof cannot see application, URL and user conditions, intrusion policy content, inheritance, pending deployment, the platform settings policy or policy assignment. The analysis lists them as gaps.

Through the Relay

Reading	Command or source
Routing table	`show route`, `show ipv6 route`
LLDP neighbors	`show lldp neighbors`
FMC, cdFMC or FDM configuration	The manager's API. No manual upload.

Upload

Open New analysis
Choose File upload and select the file, or choose Paste, paste the output and select Upload and parse.
It is sent at once
One file per upload. ConfigProof reads the vendor and export type from the content, not the file name, then asks the client, project and name. If your role is limited to certain clients, choose the client first.
Answer the picker if asked
A file that holds several VDOMs, contexts, virtual systems or gateways opens a picker. Each one you choose is its own analysis.

Operational CLI commands

At the FTD prompt, run system support diagnostic-cli, then enable.

NAT, access lists and VPN, diagnostic CLI

show nat detail
show xlate count
show xlate
show access-list
show vpn-sessiondb summary
show crypto ikev2 sa
show crypto ipsec sa

At the FTD prompt, run system support diagnostic-cli, then enable.

Routes and routing neighbors, diagnostic CLI

show route
show ipv6 route
show bgp summary
show ospf neighbor
show eigrp neighbors

At the FTD prompt, run system support diagnostic-cli, then enable.

Interfaces and high availability, diagnostic CLI

show interface ip brief
show arp
show failover
show cluster info

Report evidence and rule hit counts

FTD. Available sources across collection methods

access: Relay, API: First hit, Last hit, Counting window unavailable.; Relay, SSH: Counting window unavailable.; Relay: First hit, Last hit, Counting window unavailable.; Supported file export: First hit, Last hit, Counting window unavailable.
nat: Relay, SSH: Counting window unavailable.; Relay: Counting window unavailable.

Hit counters without a supported source: prefilter, decryption, identity, lina access list.

Without a counting window, zero hits cannot prove a rule is unused.

Supported checks: Active routes, Route decisions, HA state, VPN and NAT, Remote access, Lifecycle dates, Configuration history, Reachability, Rule dependencies
Checks not yet supported: CDP / LLDP, Tunnel, BGP and interface state, Recommended release, Change attribution, Pending changes

FMC

FMC. Available sources across collection methods

access: Relay, API: First hit, Last hit, Counting window unavailable.; Relay: First hit, Last hit, Counting window unavailable.; Supported file export: First hit, Last hit, Counting window unavailable.
prefilter: Relay, API: First hit, Last hit, Counting window unavailable.; Relay: First hit, Last hit, Counting window unavailable.; Supported file export: First hit, Last hit, Counting window unavailable.

Hit counters without a supported source: nat, decryption, identity.

Without a counting window, zero hits cannot prove a rule is unused.

Supported checks: VPN and NAT, Configuration history, Rule dependencies
Checks not yet supported: HA state, Lifecycle dates, Recommended release, Change attribution, Pending changes
Outside this device’s role: Active routes, Route decisions, CDP / LLDP, Tunnel, BGP and interface state, Remote access, Reachability

cdFMC

cdFMC. Available sources across collection methods

access: Relay, API: First hit, Last hit, Counting window unavailable.; Relay: First hit, Last hit, Counting window unavailable.; Supported file export: First hit, Last hit, Counting window unavailable.
prefilter: Relay, API: First hit, Last hit, Counting window unavailable.; Relay: First hit, Last hit, Counting window unavailable.; Supported file export: First hit, Last hit, Counting window unavailable.

Hit counters without a supported source: nat, decryption, identity.

Without a counting window, zero hits cannot prove a rule is unused.

Supported checks: VPN and NAT, Configuration history, Rule dependencies
Checks not yet supported: HA state, Change attribution, Pending changes
Outside this device’s role: Active routes, Route decisions, CDP / LLDP, Tunnel, BGP and interface state, Remote access, Lifecycle dates, Recommended release, Reachability

Run the commands

Save the transcript

What the upload is read for

Through the Relay

Upload

Open New analysis

It is sent at once

Answer the picker if asked

Operational CLI commands

Related guides