You can use any of the following addresses. You can use the IPv4 or IPv6 address or the DNS name, if you have configured one.

• The management address. By default (on most platforms), the Management interface is a DHCP client, so the IP address depends on your DHCP server.

• The address of a data interface that you have opened for HTTPS access. By default (on most platforms), the “inside” interface allows HTTPS access, so you can connect to the default inside address 192.168.95.1. See Default Configuration Prior to Initial Setup for details about your model's inside IP address.

  If you changed the HTTPS data port, you must include the custom port in the URL. For example, if you changed the port to 4443: https://ftd.example.com:4443

You can use the admin username, which is a pre-defined user. The default admin password is Admin123. On AWS, the default admin password is the AWS Instance ID, unless you define a default password with user data (Advanced Details > User Data) during the initial deployment.

Your session will expire after 30 minutes of inactivity, and you will be prompted to log in again. You can log out by selecting Log Out from the user icon drop-down menu in the upper right of the page.

This will take you to the SAML server for login. Do not enter credentials, just click the link. If you enter local credentials and click Login, that logs you in using the local database.

When on the SAML server's login page, log in as you would normally do. If you use a Common Access Card (CAC) for login, click the link to sign in using certificates. The device manager does not directly deal with CAC authentication.

You can click Generate to have a random 16 character password generated for you. Click the Show Password () button to see the passwords unmasked. Then, click the Copy To Clipboard link so you can paste the password in the confirmation field.

The page includes the minimum requirements for a password. You cannot change these minimum requirements. Passwords must:

• Be 8 – 128 characters

• Have at least one lower and one upper case letter

• Have at least one digit

• Have at least one special character

• Not contain repeated letters

The dashboard shows a visual status for the device, including enabled interfaces and whether key settings are configured (colored green) or still need to be configured. For more information, see Viewing Interface and Management Status.

Above the status image is a summary of the device model, software version, VDB (System and Vulnerability Database) version, and the last time intrusion rules were updated. This area also shows high availability status, including links to configure the feature; see High Availability (Failover). It also shows cloud registration status, where you see the account to which the device is registered if you are using cloud management; see Configuring Cloud Services.

Below the image are groups for the various features you can configure, with summaries of the configurations in each group, and actions you can take to manage the system configuration.

Following is a summary of the groups:

• Interface—You should have at least two data interfaces configured in addition to the management interface. See Interfaces.

• Routing—The routing configuration. You must define a default route. Other routes might be necessary depending on your configuration. See Routing.

• Updates—Geolocation, intrusion rule, and vulnerability database updates, and system software upgrades. Set up a regular update schedule to ensure that you have the latest database updates if you use those features. You can also go to this page if you need to download an update before the regularly schedule update occurs. See Updating System Databases and Feeds.

• System Settings—This group includes a variety of settings. Some are basic settings that you would configure when you initially set up the device and then rarely change. See System Settings.

• Smart License—Shows the current state of the system licenses. You must install the appropriate licenses to use the system. Some features require additional licenses. See Licensing the System.

• Backup and Restore—Back up the system configuration or restore a previous backup. See Backing Up and Restoring the System.

• Troubleshoot—Generate a troubleshooting file at the request of the Cisco Technical Assistance Center. See Creating a Troubleshooting File.

• Site-to-Site VPN—The site-to-site virtual private network (VPN) connections between this device and remote devices. See Managing Site-to-Site VPNs.

• Remote Access VPN—The remote access virtual private network (VPN) configuration that allows outside clients to connect to your inside network. See Configuring Remote Access VPN.

• Advanced Configuration—Use FlexConfig and Smart CLI to configure features that you otherwise cannot configure using Firewall Device Manager. See Advanced Configuration.

• Device Administration—View the audit log or export a copy of the configuration. See Auditing and Change Management.

Changes are not active on the device until you deploy them. See Deploying Your Changes.

The Security Policies page shows the general flow of a connection through the system, and the order in which security policies are applied.

You might not need to configure each policy type, although you must always have an access control policy. Following is a summary of the policies:

• SSL Decryption—If you want to inspect encrypted connections (such as HTTPS) for intrusions, malware, and so forth, you must decrypt the connections. Use the SSL decryption policy to determine which connections need to be decrypted. The system re-encrypts the connection after inspecting it. See Configuring SSL Decryption Policies.

• Identity—If you want to correlate network activity to individual users, or control network access based on user or user group membership, use the identity policy to determine the user associated with a given source IP address. See Configuring Identity Policies.

• Security Intelligence—Use the Security Intelligence policy to quickly drop connections from or to selected IP addresses or URLs. By blocking known bad sites, you do not need to account for them in your access control policy. Cisco provides regularly updated feeds of known bad addresses and URLs so that the Security Intelligence block lists update dynamically. Using feeds, you do not need to edit the policy to add or remove items in the block lists. See Configuring Security Intelligence.

• NAT (Network Address Translation)—Use the NAT policy to convert internal IP addresses to externally routeable addresses. See Configure NAT.

• Access Control—Use the access control policy to determine which connections are allowed on the network. You can filter by security zone, IP address, protocol, port, application, URL, user or user group. You also apply intrusion and file (malware) policies using access control rules. Use this policy to implement URL filtering. See Configuring the Access Control Policy.

• Intrusion—Use the intrusion policies to inspect for known threats. Although you apply intrusion policies using access control rules, you can edit the intrusion policies to selectively enable or disable specific intrusion rules. See Intrusion Policies.

Changes are not active on the device until you deploy them. See Deploying Your Changes.

The icon is highlighted with a dot when there are undeployed changes.

The Pending Changes window shows a comparison of the deployed version of the configuration with the pending changes. These changes are color-coded to indicate removed, added, or edited elements. See the legend in the window for an explanation of the colors.

If the deployment requires that inspection engines be restarted, the page includes a message that provides detail on what changed that requires a restart. If momentary traffic loss at this time would be unacceptable, close the dialog box and wait until a better time to deploy changes.

If the icon is not highlighted, you can still click it to see the date and time of the last successful deployment job. There is also a link to show you the deployment history, which takes you to the audit page filtered to show deployment jobs only.

The window will show that the deployment is in progress. You can close the window, or wait for deployment to complete. If you close the window while deployment is in progress, the job does not stop. You can see results in the task list or audit log. If you leave the window open, click the Deployment History link to view the results.

Optionally, you can do the following:

• Name the Job—To name the deployment job, click the drop-down arrow on the Deploy Now button and select Name the Deployment Job. Enter a name, then click Deploy. The name will appear in the audit and deployment history as part of the job, which might make it easier for you to find the job.

  For example, if you name a job “DMZ Interface Configuration,” a successful deployment will be named “Deployment Completed: DMZ Interface Configuration.” In addition, the name is used as the Event Name in Task Started and Task Completed events related to the deployment job.

• Force a full deployment—If you are having problems and would like to force the system to deploy the full configuration, rather than just the changes, you can click the drop-down arrow on the Deploy Now button and select Apply Full Deployment. A full deployment results in traffic interruption, so you must acknowledge that you want to perform this action before you can click Deploy.

• Discard Changes—To discard all pending changes, click More Options > Discard All. You are prompted for confirmation.

• Copy Changes—To copy the list of changes to the clipboard, click More Options > Copy to Clipboard. This option works only if there are fewer than 500 changes.

• Download Changes—To download the list of changes as a file, click More Options > Download as Text. You are prompted to save the file to your workstation. The file is in YAML format. You can view it in a text editor if you do not have an editor that specifically supports YAML format.

The task list opens, displaying the status and details of system tasks.

If you find a persistent problem, you might need to fix the device configuration. For example, a persistent failure to obtain database updates could indicate that there is no path to the Internet for the device's management IP address. You might need to contact the Cisco Technical Assistance Center (TAC) for some issues as indicted in the task descriptions.

You can do the following with the task list:

• Click the Success or Failures buttons to filter the list based on these statuses.

• Click the delete icon () for a task to remove it from the list.

• Click Remove All Completed Tasks to empty the list of all tasks that are not in progress.

Some commands take longer to produce output than others, please be patient. If you get a message that the command execution timed out, please try again. You will also get a time out error if you enter a command that requires interactive responses, such as show perfstats . If the problem persists, you might need to use an SSH client instead of the CLI Console.

Following are some tips on how to use the window.

• Press the Tab key to automatically complete a command after partially typing it. Also, Tab will list out the parameters available at that point in the command. Tab works down to three levels of keyword. After three levels, you need to use the command reference for more information.

• You can stop command execution by pressing Ctrl+C.

• To move the window, click and hold anywhere in the header, then drag the window to the desired location.

• Click the Expand () or Collapse () button to make the window bigger or smaller.

• Click the Undock Into Separate Window () button to detach the window from the web page into its own browser window. To dock it again, click the Dock to Main Window () button.

• Click and drag to highlight text, then press Ctrl+C to copy output to the clipboard.

• Click the Clear CLI () button to erase all output.

• Click the Copy Last Output () button to copy the output from the last command you entered to the clipboard.

Although the credentials you use to log into the Firewall Device Manager validate your access to the CLI, you are never actually logged into the CLI when using the console.