Deploy the Firepower Threat Defense Virtual on Azure

This chapter explains how to deploy the Firepower Threat Defense Virtual from the Azure portal.

About Azure Deployment

You can deploy the FTDv in Azure using templates. Cisco provides two kinds of templates:

Solution Template in the Azure Marketplace—Use the solution template available in the Azure Marketplace to deploy the FTDv using the Azure portal. You can use an existing resource group and storage account (or create them new) to deploy the virtual appliance. To use the solution template, see Deploy from the Azure Marketplace Using the Solution Template.
Custom Template using a Managed Image from a VHD (available from https://software.cisco.com/download/home )—In addition to the Marketplace-based deployment, Cisco provides a compressed virtual hard disk (VHD) that you can upload to Azure to simplify the process of deploying the FTDv in Azure. Using a Managed Image and two JSON files (a Template file and a Parameters File), you can deploy and provision all the resources for the FTDv in a single, coordinated operation. To use the custom template, see Deploy from Azure Using a VHD and Resource Template.

End-to-End Procedure

The following flowchart illustrates the workflow for deploying the FTDv on Microsoft Azure using the Solution template.


	Workspace	Steps
	Azure Cloud	Deploy from the Azure Marketplace Using the Solution Template: Search for “Cisco Firepower NGFW Virtual Firewall” in the Azure Marketplace.
	Azure Cloud	Deploy from the Azure Marketplace Using the Solution Template: Create the firewall.
	Azure Cloud	Deploy from the Azure Marketplace Using the Solution Template: Configure the FTDv settings.
	Azure Cloud	Deploy from the Azure Marketplace Using the Solution Template: Deploy the FTDv.
	FMC or FDM	Manage the FTDv: Managing the FTDv with the FMC Managing the FTDv with the FDM

The following flowchart illustrates the workflow for deploying the FTDv on Microsoft Azure using a VHD and Resource template.


	Workspace	Steps
	Local Host	Before you begin: Build a JSON template and parameter file.
	Azure Cloud	Before you begin: Existing Linux VM required - if not available, create a Linux VM: Create a Linux virtual machine with the Azure CLI Create a Linux virtual machine with the Azure portal
	Local Host	Deploy from Azure using a VHD and Resource template: Download the FTDv VHD image from the Cisco Download Software page.
	Local Host	Deploy from Azure using a VHD and Resource template: Copy the FTDv VHD image to Linux VM in Azure.
	Azure Cloud	Deploy from Azure using a VHD and Resource template: Unzip and upload the FTDv VHD image to a container.
	Azure Cloud	Deploy from Azure using a VHD and Resource template: Create a managed image from VHD and acquire the Resource ID of that image.
	Azure Cloud	Deploy from Azure using a VHD and Resource template: Create the FTDv firewall using the managed image and a resource template.
	Azure Cloud	Deploy from Azure using a VHD and Resource template: Customize JSON parameters using the parameters template.
	Azure Cloud	Deploy from Azure using a VHD and Resource template: Deploy the FTDv firewall.
	FMC or FDM	Manage the FTDv: Managing the FTDv with the FMC Managing the FTDv with the FDM

Deploy from the Azure Marketplace Using the Solution Template

The following instructions show you how to deploy the solution template for the FTDv that is available in the Azure Marketplace. This is a top-level list of steps to set up the FTDv in the Microsoft Azure environment. For detailed steps about the Azure setup, see Getting Started with Azure.

When you deploy the FTDv in Azure, it automatically generates various configurations, such as resources, public IP addresses, and route tables. You can further manage these configurations after deployment. For example, you may want to change the Idle Timeout value from the default, which is a low timeout.

Note

To use the customizable ARM templates available in the GitHub repository, see Deploy from Azure Using a VHD and Resource Template.

Procedure

Step 1

Log into the Azure Resource Manager (ARM) portal.

The Azure portal shows virtual elements associated with the current account and subscription regardless of data center location.

Step 2

Choose Azure Marketplace > Virtual Machines.

Step 3

Search Marketplace for “Cisco Firepower NGFW Virtual (FTDv)”, choose the offering, and click Create.

Step 4

Configure the basic settings.

Enter a name for the virtual machine. This name should be unique within your Azure subscription.

Important

If you use an existing name the deployment will fail.

Choose your licensing method, either BYOL or PAYG.

Choose BYOL (Bring Your Own License) to use a Cisco Smart License Account.

Choose PAYG (Pay As You Go) licensing to use a usage-based billing model without having to purchase Cisco Smart Licensing.

Important

You can only use PAYG when you manage the FTDv using the FMC.

Enter a username for the FTDv administrator.

Note

The name “admin” is reserved in Azure and cannot be used.

Choose an authentication type, either password or SSH key.

If you choose password, enter a password and confirm.

If you choose SSH key, specify the RSA public key of the remote peer.
Create a password to use with the Admin user account when you log in to configure the FTDv.
Choose your subscription.
Create a new Resource Group.

The FTDv should be deployed into a new Resource Group. The option to deploy into an existing Resource Group only works if that existing Resource Group is empty.

However, you can attach the FTDv to an existing Virtual Network in another Resource Group when configuring the network options in later steps.
Select geographical location. This should be the same for all resources used in this deployment (for example: FTDv, Network, storage accounts).
Click OK.

Step 5

Configure the FTDv settings.

Choose the virtual machine size.

Choose a storage account.

Note

You can use an existing storage account or create a new one. The storage account name can only contain lowercase letters and numbers.

Choose a public IP address.

You can choose a public IP address available for the selected subscription and location, or click Create new.

When you create a new public IP address, you get one from the block of IP addresses that Microsoft owns, so you can’t choose a specific one. The maximum number of public IP addresses you can assign to an interface is based on your Azure subscription.

Important

Azure creates a dynamic public IP address by default. The public IP may change when the VM is stopped and restarted. If you prefer a fixed IP address, you should create a static address. You can also modify the public IP address after deployment and change it from a dynamic to a static address.

Add the DNS label.

Note

The fully qualified domain name will be your DNS label plus the Azure URL: <dnslabel>.<location>.cloudapp.azure.com

Choose a virtual network.

You can choose an existing Azure Virtual Network (VNet) or create a new one and enter the IP address space for the VNet. By default, the Classless Inter-Domain Routing (CIDR) IP address is 10.0.0.0/16.
Configure four subnets for the FTDv network interfaces:
- FTDv Management interface, attached to Nic0 in Azure, the “First subnet”
- FTDv Diagnostic interface, attached to Nic1 in Azure, the “Second subnet”
- FTDv Outside interface, attached to Nic2 in Azure, the “Third subnet”
- FTDv Inside interface, attached to Nic3 in Azure, the “Fourth subnet”
Click OK.

Step 6

View the configuration summary, and then click OK.

Step 7

View the terms of use and then click Purchase.

Deployment times vary in Azure. Wait until Azure reports that the FTDv VM is running.

What to do next

Your next steps depend on what management mode you chose.

If you chose No for Enable Local Manager, you'll use the Firepower Management Center to manage your FTDv; see Managing the FTDv with FMC.
If you chose Yes for Enable Local Manager, you'll use the integrated Firepower Device Manager to manage your FTDv; see Managing the FTDv with FDM.

See How to Manage Your Firepower Threat Defense Virtual Device for an overview of how to choose your management option.

Deploy from Azure Using a VHD and Resource Template

You can create your own custom FTDv images using a compressed VHD image available from Cisco. To deploy using a VHD image, you must upload the VHD image to your Azure storage account. Then, you can create a managed image using the uploaded disk image and an Azure Resource Manager template. Azure templates are JSON files that contain resource descriptions and parameter definitions.

Before you begin

You need the JSON template and corresponding JSON parameter file for your FTDv template deployment. See the sample for the Azure FTDv deployment using VHD and ARM template on Github, where you'll find instructions on how to build a template and parameter file.
This procedure requires an existing Linux VM in Azure. We recommended you use a temporary Linux VM (such as Ubuntu 16.04) to upload the compressed VHD image to Azure. This image will require about 50G of storage when unzipped. Also, your upload times to Azure storage will be faster from a Linux VM in Azure.

If you need to create a VM, use one of the following methods:
- Create a Linux virtual machine with the Azure CLI
- Create a Linux virtual machine with the Azure portal
In your Azure subscription, you should have a storage account available in the Location in which you want to deploy the FTDv.

Procedure

Step 1

Download the FTDv compressed VHD image from the Cisco Download Software page:

Navigate to Products > Security > Firewalls > Next-Generation Firewalls (NGFW) > Firepower NGFW Virtual.
Click Firepower Threat Defense Software.

Follow the instructions for downloading the image.

For example, Cisco_Firepower_Threat_Defense_Virtual-6.2.3-81.vhd.bz2

Step 2

Copy the compressed VHD image to your Linux VM in Azure.

There are many options that you can use to move files up to Azure and down from Azure. This example shows SCP or secure copy:

# scp /username@remotehost.com/dir/Cisco_Firepower_Threat_Defense_Virtual-6.2.3-81.vhd. bz2 <linux-ip>

Step 3

Step 4

Unzip the FTDv VHD image.

There are many options that you can use to unzip or decompress files. This example shows the Bzip2 utility, but there are also Windows-based utilities that would work.

# bunzip2 Cisco_Firepower_Threat_Defense_Virtual-6.2.3-81.vhd.bz2

Step 5

Upload the VHD to a container in your Azure storage account. You can use an existing storage account or create a new one. The storage account name can only contain lowercase letters and numbers.

There are many options that you can use to upload a VHD to your storage account, including AzCopy, Azure Storage Copy Blob API, Azure Storage Explorer, Azure CLI, or the Azure Portal. We do not recommend using the Azure Portal for a file as large as the FTDv VHD.

The following example shows the syntax using Azure CLI:

azure storage blob upload \
       --file <unzipped vhd> \
       --account-name <azure storage account> \
       --account-key yX7txxxxxxxx1dnQ== \
       --container <container> \
       --blob <desired vhd name in azure> \
       --blobtype page

Step 6

Create a Managed Image from the VHD:

In the Azure Portal, select Images.
Click Add to create a new image.
Provide the following information:
- Name—Enter a user-defined name for the managed image.
- Subscription—Choose a subscriptions from the drop-down list.
- Resource group—Choose an existing resource group or create a new one.
- OS disk—Select Linux as the OS type.
- Storage blob—Browse to the storage account to select the uploaded VHD.
- Account type—Choose Standard (HDD) from the drop-down list.
- Host caching—Choose Read/write from the drop-down list.
- Data disks—Leave at the default; don't add a data disk.
Click Create.

Wait for the Successfully created image message under the Notifications tab.

Note

Once the Managed Image has been created, the uploaded VHD and upload Storage Account can be removed.

Step 7

Acquire the Resource ID of the newly created Managed Image.

Internally, Azure associates every resource with a Resource ID. You’ll need the Resource ID when you deploy new FTDv firewalls from this managed image.

In the Azure Portal, select Images.
Select the managed image created in the previous step.
Click Overview to view the image properties.
Copy the Resource ID to the clipboard.

The Resource ID takes the form of:

/subscriptions/<subscription-id>/resourceGroups/<resourceGroup>/providers/Microsoft.Compute/<container>/ <vhdname>

Step 8

Build a FTDv firewall using the managed image and a resource template:

Select New, and search for Template Deployment until you can select it from the options.
Select Create.
Select Build your own template in the editor.

You have a blank template that is available for customizing. See the sample for the Azure FTDv deployment using VHD and ARM template on Github, where you'll find instructions on how to build a template and parameter file.
Paste your customized JSON template code into the window, and then click Save.
Choose a Subscription from the drop-down list.
Choose an existing Resource group or create a new one.
Choose a Location from the drop-down list.
Paste the Managed Image Resource ID from the previous step into the Vm Managed Image Id field.

Step 9

Click Edit parameters at the top of the Custom deployment page. You have a parameters template that is available for customizing.

Click Load file and browse to the customized FTDv parameter file. See the sample for the Azure FTDv deployment using VHD and ARM template on Github, where you'll find instructions on how to build a template and parameter file.
Paste your customized JSON parameters code into the window, and then click Save.

Step 10

Review the Custom deployment details. Make sure that the information in Basics and Settings matches your expected deployment configuration, including the Resource ID.

Step 11

Review the Terms and Conditions, and check the I agree to the terms and conditions stated above check box.

Step 12

Click Purchase to deploy a FTDv firewall using the managed image and a custom template.

If there are no conflicts in your template and parameter files, you should have a successful deployment.

The Managed Image is available for multiple deployments within the same subscription and region.

What to do next

Update the FTDv’s IP configuration in Azure.

Cisco Firepower Threat Defense Virtual for the Microsoft Azure Cloud Getting Started Guide

Bias-Free Language

Book Title

Cisco Firepower Threat Defense Virtual for the Microsoft Azure Cloud Getting Started Guide

Chapter Title