300-710 · Question #165
A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address https://<FMC IP>/capture/CAPI/pcap/test.pcap, an…
The correct answer is D. Enable the HTTPS server for the device platform policy. The engineer encountered a 403 Forbidden error when trying to export PCAP files via HTTPS from Cisco FMC, indicating a lack of server authorization. To resolve this, the HTTPS server must be explicitly enabled within the device platform policy on the Cisco FMC.
Question
A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address https://<FMC IP>/capture/CAPI/pcap/test.pcap, an error 403: Forbidden is given instead of the PCAP file. Which action must the engineer take to resolve this issue?
Options
- ADisable the proxy setting on the browser
- BDisable the HTTPS server and use HTTP instead
- CUse the Cisco FTD IP address as the proxy server setting on the browser
- DEnable the HTTPS server for the device platform policy
How the community answered
(24 responses)- A13% (3)
- B4% (1)
- C4% (1)
- D79% (19)
Why each option
The engineer encountered a 403 Forbidden error when trying to export PCAP files via HTTPS from Cisco FMC, indicating a lack of server authorization. To resolve this, the HTTPS server must be explicitly enabled within the device platform policy on the Cisco FMC.
Disabling a browser proxy is irrelevant to a 403 Forbidden error originating from the server itself, as the error signifies a server-side configuration issue.
Disabling HTTPS and using HTTP is less secure and may not be supported or desired; the problem is server-side authorization for HTTPS, not the protocol itself.
Using the FTD IP as a browser proxy is incorrect because the request is directly to the FMC IP, and FTD is a managed device, not a proxy for FMC exports.
The 403 Forbidden error indicates that the server understands the request but refuses to authorize it. For Cisco FMC to serve PCAP files over HTTPS, the HTTPS server must be enabled in the device platform policy applied to the managing FTD device, which allows the secure web server on the device to handle such requests.
Concept tested: Cisco FMC packet capture export and HTTPS server configuration
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-70/device_platform_settings.html
Topics
Community Discussion
No community discussion yet for this question.