Hello? Welcome to this Cisco secure Firewall onboarding steps cyber capsule. My name is Amando Costria and I'm a CX customer success specialist. In today's video, we'll talk about how to set up.00:06Cisco secure firewall. Then we'll talk about smart licensing. We'll then proceed to configure the policies. And finally, we'll talk about how to integrate the system to the Cisco success network and how to go about setting up automatic updates.00:20So let's talk about how to plan your deployment. Planning your deployment includes but it's not limited to identifying the functions performances, and features required for your environment, deciding on the network and cloud products to meet your requirements and creating a topology to.00:36To design your deployment environment. In this deployment, we will set up a secure firewall as standalone system and have both the management center and the firewall center share the subnets shown on the slide and reassigned the configuration listed to the right.00:54If you'll deploy either a hardware or virtual firewall management center interface needs to be completed prior to setting up a system. Please ensure to follow the user guides specific to hardware or virtual. Depending on which option you select, the initial deployment is slightly different.01:17For hardware management center, install cable and power on. For virtual firewall Management Center, number one, download the installation package, number two, deploy the OPIA template, number three, verify the virtual machine properties, and number four power on and initialize the virtual appliance.01:34So once you gain access to the FMC CLI, you'll be prompted to enter default credentials to admin and admin 123 as a default password. Go ahead and type in a custom password. Set up a host name.01:54And go ahead and type in the management IP. Next, go ahead and type in the default gateway along with the DNS and the time server.02:12Alrighty, Summary looks good. Let's do yes for hardware firewall FTD, go ahead and install cable and power on the device.02:36Read the installation guide to access the system CLI and for virtual FTD. Number one, download the installation package. Number two, deploy the OVF template, number three, verify the virtual machine properties. Number four, power on and initialize the virtual appliance.02:53Once you power on and initialize the virtual appliance, you'll type in admin and the username, and default password is gonna be admin 123 with a capital A system's gonna prompt you to change the default password, and after that, you'll want to set up a device management IP address.03:09Then go ahead and type in the default gateway, give it a name and then type in the DNS server.03:30Since you will be managing the device with FMC, let's go ahead and type in nope.03:55And the next step is gonna be to set up the FMC. Okay, so you're gonna be prompted with the greater than sign when FTD is finished setting up, and you can type in configured manager add, type in the FMC IP address.04:01And then the registration key for these FTD. Okay, so key points to remember when your deployment are installing and completing initial configuration for firewall management center and installing and completing initial configuration for firewall threat defense.04:16Let's next talk about smart licensing. You need to purchase the necessary smart licenses and make sure that they are associated to your smart account. In this demo, we are going to select the variable licensing associated to an EA agreement. Be sure to enable the license according to what.04:36You have acquired. As you go about setting up a firewall, step one, go to Cisco software Central and log in with your cisco.com credentials and step two, click the account icon top right and select create an account. You'll be routed to the portal that will host your smart account.04:54Go to the customer's portal assuming you are a Cisco customer and continue to enter an account name and domain name to have the smart account created. Continue to manage your licenses in Cisco Software Central. Once you've logged in with your smart account, you can come to manage licenses.05:15And go to the inventory tab. Go ahead and map your virtual account, and if you've not mapped any, then you will be showing a default virtual account. I'm selecting mine and then I'll go ahead and click new token.05:32To go ahead and create a new token, to integrate it FMC with a software central. Giving it a name FTD setup, and then creating a token. Alrighty. So I'll go ahead and select it, copy.05:50And HTTPS to the FMC GUI, and once I'm logged in, I can go to system for settings and then under smart licenses, I will be able to paste the token I just copied.06:06Let's just give it a moment to load, ok. So I will now come to register, paste the token, and make sure that I'm taking both enabling Cisco success network integration and Cisco support diagnostics integration.06:27Okay, that was good to go and FMC is now syncing to the software central. FMC must be able to access the internet because the certificate is exchanged between the FMC and the smart license cloud with HTTPS.06:46Alright, we'll now be registering the device in FMC. Under device device management, we'll go ahead and click the add button and click device. Let's go ahead and type in the host IP. That's gonna be the FTD management IP. Type in the registration key.07:05And we'll turn up a new access control policy. So let's go ahead and click create new policy and have it be lock all traffic as a default, giving you the name, and then.07:21Linking save. Alrighty, we'll go with the EA licensing tier, so that'll have to be FTBAP variable, and we'll go ahead and select the three licenses that makes sense.07:37This deployment and click register.07:54Okay, so you'll notice the registration process begins and here are some things to keep in mind when adding an FTD to an FMC. You wanna make sure the TCP port 8305 traffic is allowed from the FTD to FMC. You want to use the same registration key and NAT ID if you entered one that was configured on the FTD.08:16If the FTD is behind the router with a dynamic public IP address, use the unique NAT ID feature. This will allow you to specify a unique NAT ID value on the FTD when adding the FMCS the manager.08:36Okay, policy deployment applied successfully and we're good. Okay, so come through analysis and unified events, monitor traffic going through the device.08:54And to see traffic through for this demo, we're gonna go ahead and select the one month time window. So let's go ahead and do that, click apply, give it a moment and then you will show connections coming through the device. You can.09:10Even click on go live to see traffic coming through in real time.09:30Okay, so key points to remember. Cisco smart Licensing crowser simplifies the way you purchase, deploy, organize and optimize Cisco products. Your smart account is a centralized location to view users, registered.09:41Products and managed smart licenses. FTD devices will be added under device management and you will utilize the same registration key you entered when you finished setting up FTD over the CLI. That's next, talk about configuring policies via the firewall management center.09:54Go to devices, then NAT to set up a NAT policy, click threat defense NAT policy and enter a policy name. Select the FTD that you've enabled, and click add to policy. Let's go ahead and click save.10:14Top right, let's click add role. Under interface objects, we're gonna select inside as the source and then outside as the destination and then under translation, we're gonna be selecting the source as any, and then we want to have that traffic be translated to the outside interface ID.10:32So that's gonna be a dynamic translation. Alrighty? We're good to save. Let's click ok and click save. Come to policies and then access control and find the access control policy that we've already created. Let's go ahead and edit that and we'll.10:52To add one rule to allow traffic through.11:12Under action, make sure that you are allowing and then under source select inside as the source zone and then outside as the destination zone. Then under intrusion policy, go ahead and select the balanced security and connectivity as the default policy, click add and then click save.11:15To save the policy. Have now enabled a NAT policy to translate traffic to the outside interface of that device and you have enabled an access control policy to let traffic through. All right, so key points to remember are to select a policy, to configure that and customize the policy.11:33To see to your specifications. Finally, be sure to save changes and deploy the configuration to have it committed to memory. Okay, let's next talk about integrating secure firewall to the Cisco success network and automatic updates.11:53So come to integration and then securex, and go ahead and select the checkbox next to enable Cisco success network along with the enabled Cisco support diagnostics option, and then go ahead and click save.12:10The Cisco success network allows firewall management center to continuously stream real time configuration and operating state information.12:37To the Cisco success network cloud, the telemetry collected includes but is not limited to software version data, managed devices data, deployment information, encrypted visibility engine statistics, event summaries, VPN data, and more. Streaming this telemetry includes the following benefits.12:44Number one, inform you of available unused features that can increase the effectiveness of a product in your network and number two, inform you of additional tech support services and monitoring that is available through your product to help Cisco improve our products. To update intrusion rules, click the settings icon and.13:01And select content updates.13:21Then click the rule updates tab. Here you can choose the manual update option or a customized scheduling for the automatic update option. We just set that up to occur daily at 10:40 p.m.. The firewall management center can be used to upgrade the system software for.13:25For itself and the devices it manages. It can also receive updates from various databases and feeds that provide advanced services, including intrusion rules, URLs categories, and reputations, security intelligence.13:45
