You can use any of the following addresses. You can use the IPv4 or IPv6 address or the DNS name, if you have configured one.

• The management address. By default (on most platforms), this is 192.168.45.45 on the Management interface.

• The address of a data interface that you have opened for HTTPS access. By default (on platforms), the “inside” interface allows HTTPS access, so you can connect to the default inside address 192.168.1.1. On device models where the inside interface is a bridge group, you can connect to this address through any bridge group member interface. See Default Configuration Prior to Initial Setup for details about your model's inside IP address.

The default admin password is Admin123.

Your session will expire after 30 minutes of inactivity, and you will be prompted to log in again. You can log out by selecting Log Out from the user icon drop-down menu in the upper right of the page.

The admin user account has the required privileges, but any account with config privileges will work. You can use an SSH session or the Console port.

For certain device models, the Console port puts you into the FXOS CLI. Use the connect ftd command to get to the FTD CLI.

configure user add username {basic | config}

You can define the user with the following privilege levels:

• config —Gives the user configuration access. This gives the user full administrator rights to all commands.

• basic —Gives the user basic access. This does not allow the user to enter configuration commands.

You can use the following commands to change the default account behavior.

• configure user aging username max_days warn_days

  Sets an expiration date for the user's password. Specify the maximum number of days for the password to be valid followed by the number of days before expiration the user will be warned about the upcoming expiration. Both values are 1 to 9999, but the warning days must be less than the maximum days. When you create the account, there is no expiration date for the password.

• configure user forcereset username

  Forces the user to change the password on the next login.

• configure user maxfailedlogins username number

  Sets the maximum number of consecutive failed logins you will allow before locking the account, from 1 to 9999. Use the configure user unlock command to unlock accounts. The default for new accounts is 5 consecutive failed logins.

• configure user minpasswdlen username number

  Sets a minimum password length, which can be from 1 to 127.

• configure user strengthcheck username { enable | disable}

  Enables or disables password strength checking, which requires a user to meet specific password criteria when changing their password. When a user’s password expires or if the configure user forcereset command is used, this requirement is automatically enabled the next time the user logs in.

Users can get locked out of their accounts, or you might need to remove accounts or fix other issues. Use the following commands to manage the user accounts on the system.

• configure user access username { basic | config}

  Changes the privileges for a user account.

• configure user delete username

  Deletes the specified account.

• configure user disable username

  Disables the specified account without deleting it. The user cannot log in until you enable the account.

• configure user enable username

  Enables the specified account.

• configure user password username

  Changes the password for the specified user. Users should normally change their own password using the configure password command.

• configure user unlock username

  Unlocks a user account that was locked due to exceeding the maximum number of consecutive failed login attempts.

The dashboard shows a visual status for the device, including enabled interfaces and whether key settings are configured (colored green) or still need to be configured. For more information, see Viewing Interface and Management Status.

Above the status image is a summary of the device model, software version, VDB (System and Vulnerability Database) version, and the last time intrusion rules were updated.

Below the image are groups for the various features you can configure, with summaries of the configurations in each group, and actions you can take to manage the system configuration.

Following is a summary of the groups:

• Interface—You should have at least two data interfaces configured in addition to the management interface. See Interfaces.

• Routing—The routing configuration. You must define a default route. Other routes might be necessary depending on your configuration. See Routing.

• Updates—Geolocation, intrusion rule, and vulnerability database updates, and system software upgrades. Set up a regular update schedule to ensure that you have the latest database updates if you use those features. You can also go to this page if you need to download an update before the regularly schedule update occurs. See Updating System Databases and Feeds.

• System Settings—This group includes a variety of settings. Some are basic settings that you would configure when you initially set up the device and then rarely change. See System Settings.

• Smart License—Shows the current state of the system licenses. You must install the appropriate licenses to use the system. Some features require additional licenses. See Licensing the System.

• Backup and Restore—Back up the system configuration or restore a previous backup. See Backing Up and Restoring the System.

• Troubleshoot—Generate a troubleshooting file at the request of the Cisco Technical Assistance Center. See Creating a Troubleshooting File.

• Site-to-Site VPN—The site-to-site virtual private network (VPN) connections between this device and remote devices. See Managing Site-to-Site VPNs.

• Remote Access VPN—The remote access virtual private network (VPN) configuration that allows outside clients to connect to your inside network. See Configuring Remote Access VPN.

• Advanced Configuration—Use FlexConfig and Smart CLI to configure features that you otherwise cannot configure using Firepower Device Manager. See Advanced Configuration.

Changes are not active on the device until you deploy them. See Deploying Your Changes.

The Security Policies page shows the general flow of a connection through the system, and the order in which security policies are applied.

You might not need to configure each policy type, although you must always have an access control policy. Following is a summary of the policies:

• SSL Decryption—If you want to inspect encrypted connections (such as HTTPS) for intrusions, malware, and so forth, you must decrypt the connections. Use the SSL decryption policy to determine which connections need to be decrypted. The system re-encrypts the connection after inspecting it. See Configuring SSL Decryption Policies.

• Identity—If you want to correlate network activity to individual users, or control network access based on user or user group membership, use the identity policy to determine the user associated with a given source IP address. See Configuring Identity Policies.

• Security Intelligence—Use the Security Intelligence policy to quickly drop connections from or to blacklisted IP addresses or URLs. By blacklisting known bad sites, you do not need to account for them in your access control policy. Cisco provides regularly updated feeds of known bad addresses and URLs so that the Security Intelligence blacklist updates dynamically. Using feeds, you do not need to edit the policy to add or remove items in the blacklist. See Configuring Security Intelligence.

• NAT (Network Address Translation)—Use the NAT policy to convert internal IP addresses to externally routeable addresses. See Configure NAT.

• Access Control—Use the access control policy to determine which connections are allowed on the network. You can filter by security zone, IP address, protocol, port, application, URL, user or user group. You also apply intrusion and file (malware) policies using access control rules. Use this policy to implement URL filtering. See Configuring the Access Control Policy.

• Intrusion—Use the intrusion policies to inspect for known threats. Although you apply intrusion policies using access control rules, you can edit the intrusion policies to selectively enable or disable specific intrusion rules. See Managing Intrusion Policies.

Changes are not active on the device until you deploy them. See Deploying Your Changes.

The icon is highlighted with a dot when there are undeployed changes.

The Deployment Summary page opens. The window shows a list of previous deployments with summary information on the changes (“modified objects”), when the deployment was initiated and completed, and the status of each deployment.

If the deployment requires that inspection engines be restarted, the page includes a message that provides detail on what changed that requires a restart. If momentary traffic loss at this time would be unacceptable, close the dialog box and wait until a better time to deploy changes.

If the icon is not highlighted, you can still click it to see the results of previous deployment jobs.

The task list opens, displaying the status and details of system tasks.

If you find a persistent problem, you might need to fix the device configuration. For example, a persistent failure to obtain database updates could indicate that there is no path to the Internet for the device's management IP address. You might need to contact the Cisco Technical Assistance Center (TAC) for some issues as indicted in the task descriptions.

You can do the following with the task list:

• Click the Success or Failures buttons to filter the list based on these statuses.

• Click the delete icon () for a task to remove it from the list.

• Click Remove All Completed Tasks to empty the list of all tasks that are not in progress.

Some commands take longer to produce output than others, please be patient. If you get a message that the command execution timed out, please try again. You will also get a time out error if you enter a command that requires interactive responses, such as show perfstats . If the problem persists, you might need to use an SSH client instead of the CLI Console.

Following are some tips on how to use the window.

• Press the Tab key to automatically complete a command after partially typing it. Also, Tab will list out the parameters available at that point in the command. Tab works down to three levels of keyword. After three levels, you need to use the command reference for more information.

• You can stop command execution by pressing Ctrl+C.

• To move the window, click and hold anywhere in the header, then drag the window to the desired location.

• Click the Expand () or Collapse () button to make the window bigger or smaller.

• Click the Undock Into Separate Window () button to detach the window from the web page into its own browser window. To dock it again, click the Dock to Main Window () button.

• Click and drag to highlight text, then press Ctrl+C to copy output to the clipboard.

• Click the Clear CLI () button to erase all output.

• Click the Copy Last Output () button to copy the output from the last command you entered to the clipboard.

Although the credentials you use to log into Firepower Device Manager validate your access to the CLI, you are never actually logged into the CLI when using the console.