Step 1

Use a web browser to navigate to the FMC's IP address: https://<Firepower Management Center-IP>.

Step 2

Log into the FMC using admin as the username and Admin123 as the password for the admin account. (The password is case-sensitive.)

Step 3

At the Change Password screen:

1. (Optional) Check the Show password check box to see the password while using this screen.

2. (Optional) Click the Generate Password button to have the system create a password for you that complies with the listed criteria. (Generated passwords are nonmnemonic; take careful note of the password if you choose this option.)

3. To set a password of your choosing, enter a new password in the New Password and Confirm Password text boxes.

   The password must comply with the criteria listed in the dialog.

   Note

   The FMC compares your password against a password cracking dictionary that checks not only for many English dictionary words but also other character strings that could be easily cracked with common password hacking techniques. For example, the initial configuration script may reject passwords such as "abcdefg" or "passw0rd".

   Note

   On completion of the initial configuration process the system sets the passwords for the two admin accounts (one for web access and the other for CLI access) to the same value. The password must comply with the strong password requirements described in the Firepower Management Center Administration Guide for your version. If you change the password for either admin account thereafter, they will no longer be the same, and the strong password requirement can be removed from the web interface admin account.

4. Click Next.

   Once you click Next on the Change Password screen and the wizard has accepted the new admin password, that password is in effect for both the web interface and CLI admin accounts even if you do not complete the remaining wizard activities.

Step 4

At the User Agreement screen, read the EULA and click Accept to proceed.

Step 5

Click Next.

Step 6

At the Change Network Settings screen:

1. Enter a Fully Qualified Domain Name. If default value is shown, you may use that if it is compatible with your network configuration. Otherwise, enter a fully qualified domain name (syntax <hostname>.<domain>) or hostname.

2. Choose the boot protocol for the Configure IPv4 option, either Using DHCP or Using Static/Manual.

   If you use DHCP, you must use DHCP reservation, so the assigned address does not change. If the DHCP address changes, device registration will fail because the FMC network configuration gets out of sync. To recover from a DHCP address change, connect to the FMC (using the hostname or the new IP address) and navigate to System () > Configuration > Management Interfaces to reset the network.

3. Accept the displayed value, if one is shown, for IPv4 Address or enter a new value. Use dotted decimal form (for example, 192.168.45.45).

   Note	If you change the IP address during initial configuration, you need to reconnect to the FMC using the new network information.

4. Accept the displayed value, if one is shown, for Network Mask or enter a new value. Use dotted decimal form (for example, 255.255.0.0).

   Note	If you change the network mask during initial configuration, you need to reconnect to the FMC using the new network information.

5. You can accept the displayed value, if one is shown, for Gateway or enter a new default gateway. Use dotted decimal form (for example, 192.168.0.1).

   Note	If you change the gateway address during initial configuration, you may need to reconnect to the FMC using the new network information.

6. (Optional) For DNS Group you can accept the default value, Cisco Umbrella DNS.

   To change the DNS settings, choose Custom DNS Servers from the drop-down list, and enter IPv4 addresses for the Primary DNS and Secondary DNS. If your FMC does not have internet access you cannot use a DNS outside of your local network. Configure no DNS Server by choosing Custom DNS Servers from the drop-down list and leaving the Primary DNS and Secondary DNS fields blank.

   Note	If you use FQDNs rather than IP addresses to specify NTP servers, you must specify DNS at this time. If you are using an evaluation license DNS is optional, but DNS is required to use permanent licenses for your deployment.

7. For NTP Group Servers you can accept the default value, Default NTP Servers. In this case the system uses 0.sourcefire.pool.ntp.org as the primary NTP server, and 1.sourcefire.pool.ntp.org as the secondary NTP server.

   To configure other NTP servers, choose Custom NTP Group Servers from the drop-down list and enter the FQDNs or IP addresses of one or two NTP servers reachable from your network. If your FMC does not have internet access you cannot use an NTP server outside of your local network.

Step 7

Click Finish.

Step 1

Log into the FMCv at the console using admin as the username and Admin123 as the password for the admin account. Note that the password is case-sensitive.

Step 2

When prompted, press Enter to display the End User License Agreement (EULA).

Step 3

Review the EULA. When prompted, enter yes, YES, or press Enter to accept the EULA.

Step 4

To ensure system security and privacy, the first time you log in to the FMC you are required to change the admin password. When the system prompts for a new password, enter a new password complying with the restrictions displayed, and enter the same password again when the system prompts for confirmation.

Step 5

Answer the prompts to configure network settings.

Enter a hostname or fully qualified domain name for this system [firepower]: fmc
Configure IPv4 via DHCP or manually? (dhcp/manual) [DHCP]: manual
Enter an IPv4 address for the management interface [192.168.45.45]: 10.10.0.66
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.224
Enter the IPv4 default gateway for the management interface [ ]: 10.10.0.65
Enter a comma-separated list of DNS servers or 'none' [CiscoUmbrella]: 208.67.222.222,208.67.220.220
Enter a comma-separated list of NTP servers [0.sourcefire.pool.ntp.org, 1.sourcefire.pool.ntp.org]: 

Step 6

The system displays a summary of your configuration selections. Review the settings you have entered.

Hostname:                           fmc
IPv4 configured via:                manual configuration
Management interface IPv4 address:  10.10.0.66
Management interface IPv4 netmask:  255.255.255.224
Management interface IPv4 gateway:  10.10.0.65
DNS servers:                        208.67.222.222,208.67.220.220
NTP servers:                        0.sourcefire.pool.ntp.org, 1.sourcefire.pool.ntp.org

Step 7

The final prompt gives you the opportunity to confirm the settings.

Are these settings correct? (y/n) y
If your networking information has changed, you will need to reconnect. 

Updated network configuration. 

Step 8

After you have accepted the settings, you can enter exit to exit the FMC CLI.

Step 1

(Optional, applies only to models 2500 and 4500) eth2 management interface —If your model includes 10-Gigabit Ethernet SFP+ interfaces, install any FMC-supported SFP+ transceivers and cables as needed. You can connect this interface to the same or different network from your other management interfaces depending on your network needs. For more information about management interfaces and network topology, see the Firepower Management Center Configuration Guide.

Step 2

(Optional, applies only to models 2500 and 4500) eth3 management interface —If your model includes 10-Gigabit Ethernet SFP+ interfaces, install any FMC-supported SFP+ transceivers and cables as needed. You can connect this interface to the same or different network from your other management interfaces depending on your network needs. For more information about management interfaces and network topology, see the Firepower Management Center Configuration Guide.

Step 3

(Optional) USB port —Connect a keyboard to the USB port.

Step 4

(Optional) Use the RJ-45 to DP-9 console cable supplied with the appliance (Cisco part number 72-3383-XX) to connect a local computer to the FMC serial port. You can use this connection for serial or Lights Out Management access to the FMC; see Set Up Alternate FMC Access.

Step 5

eth0 management interface (labeled "1" on the rear panel)— Using an Ethernet cable, connect the eth0 interface to the default management network reachable from your management PC. This interface is the default management interface and is enabled by default. Confirm that the link LED is on for both the network interface on the local computer and the FMC management interface.

Step 6

(Optional) eth1 management interface (labeled "2" on the rear panel)—Connect this management interface to the same or different network from your other management interfaces depending on your network needs. For information about management interfaces and network topology, see the Firepower Management Center Configuration Guide for your version.

Step 7

(Optional) VGA port —Connect a monitor to the VGA port.

Step 8

Power supply—Use one of the supported power cords to connect the power supplies of the chassis to your power source. For more information about supported power cords, see the Cisco Firepower Management Center 1000, 2500, and 4500 Hardware Installation Guide.

Step 9

Power—Press the Power button on the front of the chassis, and verify that the front panel power status LED is on.

Step 10

Verify— Use the diagram in Front Panel LEDs and their States to check that the front-panel LEDs reflect a good status.

Step 1

If you have not already, connect the monitor to the VGA port and the keyboard to one of the USB ports on the rear of the chassis.

Step 2

Access the Linux shell on the FMC using admin as the username and Admin123 as the password. (The password is case-sensitive.) Use the steps appropriate to your version; see Access the CLI or the Linux Shell on the FMC.

Step 3

Run the following script to configure the FMC network settings: sudo /usr/local/sf/bin/configure-network.

Step 4

Answer the prompts to provide the IPv4 and (optionally ) IPv6 configuration information for your appliance.

Step 5

The final prompt gives you the opportunity to confirm the settings.

Step 6

After you have accepted the settings, enter exit to log out of the shell.

Step 1

Direct your browser to https://mgmt_ip/, where mgmt_ip is the IP address of the FMC interface:

Step 2

Log in using admin as the username and Admin123 as the password. (The password is case-sensitive.)

Step 3

In the Change Password section of the Setup page, change the password for the admin accounts. The admin account for the web interface has Administrator privileges and cannot be deleted. We recommend that you use a strong password that is at least eight alphanumeric characters of mixed case and includes at least one numeric character. Avoid using words that appear in a dictionary.

Step 4

The FMC’s network settings allow it to communicate on your management network. Configure these settings in the Network Settings section of the Setup page:

• If you already configured the network settings for appliance access using a keyboard and monitor, the Network Settings section of the Setup page may be prepopulated.

• If values are not prepopulated under Network Settings, or if you want to change the prepopulated values, you must choose the management network protocol. The system provides a dual stack implementation for both IPv4 and IPv6 management environments; you can specify IPv4, IPv6, or Both.

  Depending on your protocol choice, the Setup page displays fields where you must enter the IPv4 or IPv6 management IP address, netmask or prefix length, and default gateway for the FMC. You can also specify up to three DNS servers, as well as the host name and domain for the device.

  • For IPv4, you must enter the address and netmask in dotted decimal form (for example, a netmask of 255.255.0.0).

  • For IPv6 networks, check the Assign the IPv6 address using router autoconfiguration check box to automatically assign IPv6 network settings. Otherwise, you must set the address in colon-separated hexadecimal form and the number of bits in the prefix (for example, a prefix length of 112).

Step 5

(Optional) In the Time Settings section of the Setup page you can set the time for a FMC one of two ways: either manually or using the network time protocol (NTP) from an NTP server.

• To set the time using network time protocol (NTP), select Via NTP from and specify one or more NTP servers the FMC can access.
• To set the time manually, select Manually and enter the current time in the provided fields.

Step 6

(Optional) If you plan to perform intrusion detection and prevention in your deployment, in the Recurring Rule Update Imports section of the Setup page, we recommend that you check Enable Recurring Rule Update Imports from the Support Site.

Step 7

(Optional) If you plan to perform geolocation-related analysis in your deployment, in the Recurring Geolocation Updates section of the Setup page, we recommend that you check Enable Recurring Weekly Updates from the Support Site and specify the Update Start Time using the provided fields. To perform a GeoDB update as part of the initial configuration process, check the Install Now checkbox.

Step 8

(Optional) In the Automatic Backups section of the Setup page, you can check Enable Automatic Backups to create a scheduled task that creates a weekly backup of the configurations on the FMC that can be restored in case of failure.

Step 9

You use the FMC to manage licenses for the devices it manages. The FMC can manage devices regardless of the type of license they require:

Step 10

Read the End User License Agreement carefully; if you agree to abide by its provisions, then check the I have read and agree to the End User License Agreement checkbox.

Step 11

Make sure that all the information you provided is correct, and click Apply.

Step 12

If you connected directly to the appliance's management interface using an Ethernet cable, once you click Apply you will be disconnected from the FMC because its IP address has changed. Disconnect the computer and connect the FMC interface to the management network. To complete the remaining procedures in the guide use a browser on a computer on the management network to access the FMC GUI at the IP address or host name that you just configured.

Step 13

Verify that the initial setup was successful by monitoring the Tasks tab in the Message Center.

Step 1

Direct your browser to https://ipaddress_or_hostname/, where ipaddress or hostname corresponds to your FMC.

Step 2

In the Username and Password fields, enter your user name and password.

Step 3

Click Login.

Step 1

Choose System > Users.

Step 2

On the Users tab, click Create User.

Step 3

Enter a User Name and provide or choose values for the characteristics of the user account.

Step 4

Click Save.

Step 1

Choose System > Configuration > Time Synchronization.

Step 2

Disable the Serve Time via NTP option.

Step 3

Choose Via NTP for the Set My Clock option.

Step 4

For Versions 6.2 - 6.4:Click Add and enter the host name or IP address for an NTP server accessible from your FMC. Then click Save.

Step 1

Locate the serial port on the FMC rear panel.

Step 2

Use the RJ-45 to DB-9 console cable supplied with the appliance (Cisco part number 72-3383-XX) to connect a local computer to the FMC serial port.

Step 3

Use terminal emulation software (such as HyperTerminal or XModem) on the local computer to interact with the FMC. Set the terminal emulator for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

Step 1

Enable LOM for the FMC. See Enable Lights-Out Management.

Step 2

Enable LOM for users who will use the feature. See Enable Lights-Out Management Users.

Step 3

Use a third-party IPMI utility to access the FMC.

Step 1

Synchronize time to a physical NTP server.

Step 2

Set the IP addresses for the DNS and NTP servers using one of the following methods:

• If your network at the staging location can access the DNS and NTP servers at the target location, use the IP addresses for the DNS and NTP servers at the target location.
• If your network at the staging location cannot access the DNS and NTP servers at the target location, use the staging location information and reset at the target location.

Step 3

Use the time zone for the target deployment if you set the time on the appliance manually instead of using NTP. For more information, see the Firepower Management Center Administration Guide for your version.

Step 1

Use the installation procedures appropriate for your version:

Step 2

For more information on installing the chassis, see the Cisco Firepower Management Center 1000, 2500, and 4500 Hardware Installation Guide.

Step 1

Safely power down the FMC. For more information, see the Cisco Firepower Management Center 1000, 2500, and 4500 Hardware Installation Guide.

Step 2

Ensure that your appliance is safely prepared for shipping. For more information, see Shipping Considerations.

Step 1

Obtain the restore and ISO update files. See Obtain the Restore ISO and Update Files.

Step 2

Start the restore process using one of these two methods:

• Start the Restore Utility Using KVM or Physical Serial Port
• Start the Restore Utility Using Lights-Out Management (This is useful if you do not have physical access to the appliance.)

  Caution

  When restoring a device to factory settings for Versions 6.3+ using LOM, if you do not have physical access to the appliance and you delete the license and network settings, you will be unable to access the appliance after the restore.

Step 3

Use the interactive restore menu to identify the appliance’s management interface. See Identify the Appliance's Management Interface.

Step 4

Use the interactive restore menu to specify the ISO image location and transport method. See Specify the ISO Image Location and Transport Method.

Step 5

(Optional) Use the interactive restore menu to select system software and/or rule updates to include with the restore process. See Select System Software and Rule Updates during Restore.

Step 6

(Optional) Save the system configuration you have selected for use in future restore activities. See Save FMC Configuration.

Step 7

Use the interactive restore menu to download the ISO and update files, and mount the image on the appliance. See Download the ISO and Update Files and Mount the Image.

Step 8

You have two options based on the software version to which you are restoring the appliance:

• If you are restoring the system to a different major version, perform the two-pass restore process:

  1. The first pass updates the restore image. See Update the Restore Image.

  2. The second pass installs the new version of the system software. See Install the New System Software Version.

• If you are restoring the system to the same major version, you need only install the new version of the system software. See Install the New System Software Version.

Step 1

Using the username and password for your support account, log into the Support Site at https://sso.cisco.com/autho/forms/CDClogin.html.

Step 2

Browse to the software download section at: https://software.cisco.com/download/navigator.html.

Step 3

Enter a search string in the Find area on the page that appears for the system software you want to download and install.

Step 4

Find the image (ISO image) that you want to download. You can click one of the links on the left side of the page to view the appropriate section of the page.

Step 5

Click the ISO image you want to download.

Step 6

Copy the files to an HTTP (web) server, FTP server, or SCP-enabled host that the appliance can access on its management network.

Step 1

Using your keyboard/monitor or serial connection, log into the appliance’s shell using the admin account. Use the steps appropriate to your version; see Access the CLI or the Linux Shell on the FMC.

Step 2

Reboot the appliance; enter sudo reboot. Provide the admin password when prompted.

Step 3

Monitor the reboot status. When the boot menu appears, quickly select Option 3 to restore the system.

Step 4

The system prompts for the display mode for the restore utility’s interactive menu. Quickly choose from:

• For a keyboard and monitor connection, enter 1 and press Enter.
• For a serial connection, enter 2 and press Enter.

Step 5

Press Enter to confirm the copyright notice.

Step 1

At your computer’s command prompt, enter the IPMI command to start the SOL session:

• For IPMItool, enter: sudo ipmitool -I lanplus -H IP_address -U admin sol activate
• For ipmiutil, enter: sudo ipmiutil sol -a -V4 -J3 -N IP_address -U admin -P password

Step 2

Reboot the appliance as root user; enter sudo reboot. Provide the admin password when prompted.

Step 3

Monitor the reboot status. When the boot menu appears, quickly select Option 3 to restore the system.

Step 4

The system prompts for the display mode for the restore utility’s interactive menu. Enter 2 and press Enter to load the interactive restore menu using the appliance’s serial connection.

Step 5

Press Enter to confirm the copyright notice.

Step 1

From the restore utility main menu, choose 1 IP Configuration.

Step 2

Choose the appliance’s management interface (generally eth0).

Step 3

Choose the protocol you are using for your management network: IPv4 or IPv6.

Step 4

Choose a method to assign an IP address to the management interface:

• Static: A series of pages prompts you to manually enter the IP address, network mask or prefix length, and default gateway for the management interface.
• DHCP: The appliance automatically detects the IP address, network mask or prefix length, and default gateway for the management interface, and then displays the IP address.

Step 5

When prompted, confirm your settings.

Step 1

From the restore utility main menu, choose 2 Choose the transport protocol.

Step 2

On the page that appears, choose either HTTP, FTP, or SCP.

Step 3

Use the series of pages presented by the restore utility to provide the necessary information for the protocol you chose; see Restore Files Download Configuration.

Step 4

Choose the ISO image you want to use.

Step 5

When prompted, confirm your settings.

Step 1

From the restore utility main menu, choose 3 Select Patches/Rule Updates.

Step 2

Choose the system software update, if any, you want to use. You do not have to choose an update; press Enter without selecting an update to continue. If there are no system software updates in the appropriate location, the system prompts you to press Enter to continue.

Step 3

Select the rule update, if any, you want to use. You do not have to select an update; press Enter without selecting an update to continue. If there are no rule updates in the appropriate location, the system prompts you to press Enter to continue.

Step 1

From the restore utility main menu, choose 4 Download and Mount ISO.

Step 2

When prompted, confirm your choice. If you are downloading from an SCP server, enter your password when prompted. The system downloads and mounts the appropriate files.

Step 1

From the restore utility main menu, choose 5 Run the Install.

Step 2

When prompted (twice), confirm that you want to reboot the appliance.

Step 3

The system prompts for the display mode for the restore utility’s interactive menu:

• For a keyboard and monitor connection, enter 1 and press Enter.
• For a serial connection, enter 2 and press Enter.

Step 4

Press Enter to confirm the copyright notice.

Step 1

From the restore utility main menu, choose 5 Run the Install.

Step 2

Confirm that you want to restore the appliance.

Step 3

Choose whether you want to delete the appliance’s license and network settings.

Step 4

Enter your final confirmation that you want to restore the appliance.

Step 1

From the restore utility main menu, choose 6 Save Configuration.

Step 2

When prompted, confirm that you want to save the configuration.

Step 3

When prompted, enter a name for the configuration.

Step 1

From the restore utility main menu, choose 7 Load Configuration.

Step 2

Choose the configuration you want to use.

Step 3

When prompted, confirm that you want to load the configuration.