Acquiring a Firewall Manually

Under certain conditions you may opt to acquire a firewall manually rather than using Zero Touch.

If two-factor authentication (2FA) is enabled on the firewall, you cannot acquire the firewall manually. Disable 2FA on the firewall (Device > Settings > Administration > Administrator Name & Password > One-time Password Method > Disabled), or use zero-touch acquisition.

To acquire a firewall manually

1. Navigate to Manager View | Home > Firewalls > Inventory page.

2. Click the Ellipsis icon in the Action column and select Edit Settings.

   

3. Enter the FQDN/IP Address with Port for your device, for example, acme.in:443 or 1.1.1.1:443.

4. Enter your Username and Password of your Unified Management user account.

   

5. Make sure that Verify SSL Certificate is turned on (turned on by default). If the firewall uses a self-signed certificate:

   You must re-verify the certificate:

   • When you acquire the firewall for the first time. Otherwise, the firewall cannot connect to Firewall Management.
   • When the certificate is changed on the firewall. The firewall goes offline until you re-verify the certificate. After you trust the certificate, the firewall synchronizes and comes online. To re-verify, select Edit Settings for the firewall, and then complete steps a to d of step 5.
   1. Click Re-verify certificate. The Untrusted certificate dialog displays the Common name, Issuer, Valid dates, and Certificate SHA-256 fingerprint of the certificate.
   2. Compare the Certificate SHA-256 fingerprint with the fingerprint of the certificate on the firewall. Use the Certificate row in the certificate viewer of the firewall, not the Public Key row.
   3. Select I have verified this fingerprint against the firewall.
   4. Click Trust and pin certificate. The firewall connects to Firewall Management.

   If you turn off Verify SSL Certificate, a security warning is displayed. Without SSL verification, the connection between Firewall Management/NSM and the firewall is vulnerable to man-in-the-middle attacks. Install a valid Web Management SSL Certificate on the firewall and turn verification back on. Turn off verification only in trusted, isolated lab environments, never in production.

6. Click Save and Acquire Again.

As part of the device acquisition process, Firewall Management establishes connection to the device, configures the firewall to send out syslog heartbeats so its health can be monitored, and then pulls the status and configuration of the firewall.

• Make sure that syslog Port is set to 514 on the firewall in the Firewall View | Device > Log > Syslog > Syslog Servers tab.
• Make sure that port 514 is not blocked by the firewall or any security policies.

The status of the device acquisition is displayed in DEVICE ACQUISITION STATUS section; If the acquisition is successful, you will see a green icon next to Acquired. The firewall is now managed by Firewall Management, and the CONFIGURATION is displayed as Managed in the Firewall Inventory page.