Configure additional settings for SDCs and Security Cloud Control Connectors installed on a VM you created

This configuration ensures that events can reach the SEC when you have installed your Security Cloud Control Connector on your own CentOS 7 virtual machine.

This is the second of three steps you need to complete in order to install and configure your SEC. If you have not already, complete Install a Security Cloud Control Connector to Support an SEC Using Your VM Image before making these configuration changes.

After you complete one of the additional configuration changes described here, complete Install the Secure Event Connector

Before you begin

You must have installed your Security Cloud Control Connector on your own CentOS 7 virtual machine.

Follow these steps to configure additional settings for your SDC and Security Cloud Control Connector:

Procedure

Step 1

Choose one of the following configuration procedures:

  • Disable the firewalld service on the CentOS 7 VM (matches the configuration of the Cisco-provided SDC VM)

  • Allow the firewalld service to run and add firewall rules to allow event traffic to reach the SEC (more granular approach)

Step 2

If you chose to disable the firewalld service, log into the CLI of the SDC VM as the "Security Cloud Control" user.

Step 3

Stop the firewalld service and ensure that it will remain disabled upon subsequent reboots of the VM.

If you are prompted, enter the password for the Security Cloud Control user.

Example:

[Security Cloud Control@SDC-VM ~]$ sudo systemctl stop firewalld
Security Cloud Control@SDC-VM ~]$ sudo systemctl disable firewalld

Step 4

Restart the Docker service to re-insert Docker-specific entries into the local firewall.

Example:

[Security Cloud Control@SDC-VM ~]$ sudo systemctl restart docker

Step 5

If you chose to allow the firewalld service to run, log into the CLI of the SDC VM as the "Security Cloud Control" user.

Step 6

Add local firewall rules to allow incoming traffic to the SEC from the TCP, UDP, or NSEL ports you configured.

See Finding Your Device's TCP, UDP, and NSEL Port Used for Cisco Security Analytics and Logging for the ports used by your SEC. If prompted, enter the password for the Security Cloud Control user. You may need to specify different port values.

Example:

[Security Cloud Control@SDC-VM ~]$ sudo firewall-cmd --zone=public --permanent --add-port=10125/tcp 
Security Cloud Control@SDC-VM ~]$ sudo firewall-cmd --zone=public --permanent --add-port=10025/udp
[Security Cloud Control@SDC-VM ~]$ sudo firewall-cmd --zone=public --permanent --add-port=10425/udp

Step 7

Restart the firewalld service to make the new local firewall rules both active and persistent.

Example:

[Security Cloud Control@SDC-VM ~]$ sudo systemctl restart firewalld

You have successfully configured the firewall settings on your CentOS 7 virtual machine to allow events to reach the SEC.

What to do next

Continue to Install the Secure Event Connector.