The Cisco Secure Dynamic Attributes Connector has the following memory requirements:

The preceding limits apply to both virtual machines and physical machines.

The system prevents you from exceeding the preceding limits because deployment issues could result.

A connector is an interface with a cloud service. The connector retrieves network information from the cloud service so the network information can be used in access control policies on the Secure Firewall Management Center.

We support the following:

See one of the following sections for more information.

• Amazon Web Services (AWS)

  For more information, see a resource like Tagging AWS resources on the Amazon documentation site.

  See Amazon Web Services Connector—About User Permissions and Imported Data.

• Amazon Web Services security groups.

  For more information, see a resource like Work with security groups.

  See Amazon Web Services Security Groups Connector—About User Permissions and Imported Data.

• Amazon Web Services service tags.

  For more information, see a resource like What are tags?.

  See Create an AWS Service Tags Connector.

• Microsoft Azure

  For more information, see this page on the Azure documentation site.

  See Azure Connector—About User Permissions and Imported Data.

• Microsoft Azure service tags

  For more information, see a resource like Virtual network service tags on Microsoft TechNet.

  See Create an Azure Service Tags Connector

• Cisco Cyber Vision

  See Create a Cisco Cyber Vision Connector.

• Generic text list of IP addresses you specify.

  For more information, see Create a Generic Text Connector.

• GitHub

  For more information, see Create a GitHub Connector.

• Google Cloud

  For more information, see Setting Up Your Environment in the Google Cloud documentation.

  See Google Cloud Connector—About User Permissions and Imported Data.

• Office 365 IP addresses

  For more information, see Office 365 URLs and IP address ranges on docs.microsoft.com.

• VMware categories and tags managed by vCenter and NSX-T

  For more information, see a resource like vSphere Tags and Attributes in the VMware documentation site.

• Webex IP addresses

  For more information, see Create a Webex Connector.

• Zoom IP addresses

  For more information, see Create a Zoom Connector.

In the event you cannot automatically fetch the certificate authority chain, use one of the following browser-specific procedures to get a certificate chain used to connect securely to vCenter or Management Center.

The certificate chain is the root certificate and all subordinate certificates.

You can optionally use one of these procedures to connect to the following:

• vCenter or NSX

• Management Center

Get a Certificate Chain—Mac (Chrome and Firefox)

Use this procedure to get a certificate chain using the Chrome and Firefox browsers on Mac OS.

1. Open a Terminal window.

2. Enter the following command.

   security verify-cert -P url[:port]

   where url is the URL (including scheme) to vCenter or Management Center. For example:

   security verify-cert -P https://myvcenter.example.com

   If you access vCenter or Management Center using NAT or PAT, you can add a port as follows:

   security verify-cert -P https://myvcenter.example.com:12345

3. Save the entire certificate chain to a plaintext file.

   • Include all -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- delimiters.

   • Exclude any extraneous text (for example, the name of the certificate and any text contained in angle brackets (< and >) as well as the angle brackets themselves.

4. Repeat these tasks for vCenter or Management Center.

Get a Certificate Chain—Windows Chrome

Use this procedure to get a certificate chain using the Chrome browser on Windows.

1. Log in to vCenter or Management Center using Chrome.

2. In the browser address bar, click the lock to the left of the host name.

3. Click Certificate.

4. Click the Certification Path tab.

5. Click the top (that is, first) certificate in the chain.

6. Click View Certificate.

7. Click the Details tab.

8. Click Copy to File.

9. Follow the prompts to create a CER-formatted certificate file that includes the entire certificate chain.

   When you're prompted to choose an export file format, click Base 64-Encoded X.509 (.CER) as the following figure shows.

   

10. Follow the prompts to complete the export.

11. Open the certificate in a text editor.

12. Repeat the process for all certificates in the chain.

    You must paste each certificate in the text editor in order, first to last.

13. Repeat these tasks for vCenter or Management Center.

Get a Certificate Chain—Windows Firefox

Use the following procedure to get a certificate chain for the Firefox browser on either Windows or Mac OS.

1. Log in to vCenter or Management Center using Firefox.

2. Click the lock to the left of the host name.

3. Click the right arrow (Show connection details). The following figure shows an example.

   

4. Click More Information.

5. Click View Certificate.

6. If the resulting dialog box has tab pages, click the tab page corresponding to the top-level CA.

7. Scroll to the Miscellaneous section.

8. Click PEM (chain) in the Download row. The following figure shows an example.

   

9. Save the file.

10. Repeat these tasks for vCenter or Management Center.

To assist you with advanced troubleshooting and working with Cisco TAC, we provide the following troubleshooting tools. To use these tools, log in as any user to the Ubuntu host on which the dynamic attributes connector is running.

Check container status

To check the status of the dynamic attributes connector Docker containers, enter the following commands:

cd /usr/local/sf/csdac
sudo ./muster-cli status

Sample output follows:

=============================================== CORE SERVICES ===============================================
          Name                        Command               State                   Ports                
---------------------------------------------------------------------------------------------------------
muster-bee                 /bin/sh -c /app/bee              Up      127.0.0.1:15050->50050/tcp, 50443/tcp
muster-envoy               /docker-entrypoint.sh runs ...   Up      127.0.0.1:6443->8443/tcp             
muster-local-fmc-adapter   ./docker-entrypoint.sh run ...   Up                                           
muster-ui-backend          ./docker-entrypoint.sh run ...   Up      50031/tcp                            
muster-user-analysis       ./docker-entrypoint.sh run ...   Up      50070/tcp                            
=========================== CONNECTORS AND ADAPTERS ===========================
             Name                           Command               State     Ports  
-----------------------------------------------------------------------------------
muster-connector-o365.1.muster   ./docker-entrypoint.sh run ...   Up      50070/tcp

Stop, start, or restart the Cisco Secure Dynamic Attributes Connector Docker containers

If the ./muster-cli status indicates containers are down or to restart containers in the event of issues, you can enter the following commands:

Stop and restart:

cd ~/csdac/app
sudo ./muster-cli stop
sudo ./muster-cli start

Start only:

cd ~/csdac/app
sudo ./muster-cli start

Enable application debug logging and generate troubleshoot files

If advised to do so by Cisco TAC, enable debug logging and generate troubleshoot files as follows:

cd ~/csdac/app
sudo ./muster-cli debug-on
sudo ./muster-cli ts-gen

The troubleshoot file name is ts-bundle-timestamp.tar and is created in the same directory.

The following table shows the location of troubleshoot files and logs in the troubleshoot file.

Enable debugging for a container

You can optionally enable debugging for individual containers if you first get the name of the container as follows:

cd /usr/local/sf/csdac
sudo ./muster-cli versions

Sample output follows:

CSDAC version: 1.0.0
CONTAINERS VERSIONS
CONTAINER                      | APP VERSION          | COMMIT                        
===============================================================================
muster-bee                     | fmc7.4-13            | 944d50c6c384567693d6ecc5a31420de57f6ce2f
muster-envoy                   | fmc7.4-25            | 5e5f6d83164a4acbef5b106aa39e2e3f68fa738f
muster-local-fmc-adapter       | fmc7.4-17            | c5902f818baa8e27d7c0b8027490dcacc28c0168
muster-ui-backend              | fmc7.4-64            | 165a1f5f0d763aa75829a30b5ffbddf0012682b6
muster-user-analysis           | fmc7.4-43            | 63cd64e29a92599908c3eb684d91e9f685d8c740
muster-connector-o365.1.muster | fmc7.4-8             | 28f075d315c8867f667b828970c9fbad35fa89cc

To enable debugging for the Office 365 connector, for example, enter the following command.

sudo ./muster-cli container-debug-on muster-connector-o365.1.muster

To disable debugging for that connector, enter the following command.

sudo ./muster-cli container-debug-off muster-connector-o365.1.muster

Verify dynamic objects on the Secure Firewall Management Center

To verify your connectors are creating objects on the Secure Firewall Management Center , you can use the following command on the Secure Firewall Management Center as an administrator:

sudo tail f /var/opt/CSCOpx/MDC/log/operation/usmsharedsvcs.log

Example: Successful object creation

26-Aug-2021 12:41:35.912,[INFO],(DefenseCenterServiceImpl.java:1442)
com.cisco.nm.vms.api.dc.DefenseCenterServiceImpl, ajp-nio-127.0.0.1-9009-exec-10
** REST Request [ CSM ]
** ID : 18b25356-fd6b-4cc4-8d27-bbccb52a6275
** URL: POST /audit
{
  "version": "7.1.0",
  "requestId": "18b25356-fd6b-4cc4-8d27-bbccb52a6275",
  "data": {
    "userName": "csdac-centos7",
    "subsystem": "API",
    "message": "POST https://myfmc.example.com/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f
/object/dynamicobjects Created (201) - The request has been fulfilled and resulted in a new resource being created",
    "sourceIP": "192.0.2.103",
    "domainUuid": "e276abec-e0f2-11e3-8169-6d9ed49b625f",
    "time": "1629981695431"
  },
  "deleteList": []
}

In the event you cannot automatically fetch the certificate authority chain, use one of the following browser-specific procedures to get a certificate chain used to connect securely to vCenter or Management Center.

The certificate chain is the root certificate and all subordinate certificates.

You can optionally use one of these procedures to connect to the following:

• vCenter or NSX

• Management Center

Get a Certificate Chain—Mac (Chrome and Firefox)

Use this procedure to get a certificate chain using the Chrome and Firefox browsers on Mac OS.

1. Open a Terminal window.

2. Enter the following command.

   security verify-cert -P url[:port]

   where url is the URL (including scheme) to vCenter or Management Center. For example:

   security verify-cert -P https://myvcenter.example.com

   If you access vCenter or Management Center using NAT or PAT, you can add a port as follows:

   security verify-cert -P https://myvcenter.example.com:12345

3. Save the entire certificate chain to a plaintext file.

   • Include all -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- delimiters.

   • Exclude any extraneous text (for example, the name of the certificate and any text contained in angle brackets (< and >) as well as the angle brackets themselves.

4. Repeat these tasks for vCenter or Management Center.

Get a Certificate Chain—Windows Chrome

Use this procedure to get a certificate chain using the Chrome browser on Windows.

1. Log in to vCenter or Management Center using Chrome.

2. In the browser address bar, click the lock to the left of the host name.

3. Click Certificate.

4. Click the Certification Path tab.

5. Click the top (that is, first) certificate in the chain.

6. Click View Certificate.

7. Click the Details tab.

8. Click Copy to File.

9. Follow the prompts to create a CER-formatted certificate file that includes the entire certificate chain.

   When you're prompted to choose an export file format, click Base 64-Encoded X.509 (.CER) as the following figure shows.

   

10. Follow the prompts to complete the export.

11. Open the certificate in a text editor.

12. Repeat the process for all certificates in the chain.

    You must paste each certificate in the text editor in order, first to last.

13. Repeat these tasks for vCenter or Management Center.

Get a Certificate Chain—Windows Firefox

Use the following procedure to get a certificate chain for the Firefox browser on either Windows or Mac OS.

1. Log in to vCenter or Management Center using Firefox.

2. Click the lock to the left of the host name.

3. Click the right arrow (Show connection details). The following figure shows an example.

   

4. Click More Information.

5. Click View Certificate.

6. If the resulting dialog box has tab pages, click the tab page corresponding to the top-level CA.

7. Scroll to the Miscellaneous section.

8. Click PEM (chain) in the Download row. The following figure shows an example.

   

9. Save the file.

10. Repeat these tasks for vCenter or Management Center.