6.5.14 Cisco Firepower

Understand FDM target selection and the effect of deploying pending changes

These templates support Firepower Threat Defense devices managed by the on-box Firepower Device Manager (FDM). They do not target devices managed by Firepower Management Center.

Requirements

  • The agent host must reach the FDM management interface over HTTPS.
  • Use an FDM administrator that can manage certificate objects, the target VPN or SAML object, and deployments.
  • The target Remote Access VPN connection profile or SAML server object must already exist.

The templates upload the certificate and key as a CertKit internal certificate, register intermediate certificates as trusted CA objects, update the target, remove superseded CertKit certificates, and run an FDM deployment.

Remote Access VPN template

Set RA VPN connection profile name to a profile under Device > Remote Access VPN. The template finds the Remote Access VPN configuration that owns the profile and updates its certificate.

SAML Server template

Set SAML server object name to the object under Objects > Identity Sources. This template updates the service provider certificate presented by the FTD during the SAML exchange; it does not replace the identity provider’s signing certificate.

The SAML template requires an RSA certificate.

Pending configuration changes

An FDM deployment applies all pending configuration changes on the device, not only the certificate change made by CertKit. Review pending work before the scheduled certificate deployment. Use a deployment window when the combined change requires controlled timing.

Common problems

  • Target not found: confirm the exact connection profile or SAML server object name.
  • Deployment fails after a successful import: review all pending FDM changes, including changes unrelated to CertKit.
  • Wrong SAML certificate changed: confirm that the selected object is the FTD service provider object rather than the identity provider configuration.
  • SAML template rejects the certificate: issue or select a certificate with an RSA key.

For a product overview, see certificate automation for Cisco Firepower.