Prerequisites

• A Microsoft Azure account. You can create one at https://azure.microsoft.com/en-us/ .

  After you create an account on Azure, you can log in, search the marketplace for Cisco Firepower Threat Defense, and choose the “Cisco Firepower NGFW Virtual (NGFWv)” offering.

• A Cisco Smart Account. You can create one at Cisco Software Central.

  License the FTDv; see Cisco Firepower System Feature Licenses for an overview of feature licenses for the firewall System, including helpful links.

• For the FTDv and system compatibility, see FTDv Compatibility.

Communication Paths

• Management interface—Used to connect the FTDv to the Firepower Management Center.

  Note

  In 6.7 and later, you can optionally configure a data interface for FMC management instead of the Management interface. The Management interface is a pre-requisite for data interface management, so you still need to configure it in your initial setup. For more information about configuring a data interface for FMC access, see the configure network management-data-interface command in Cisco Firepower Threat Defense Command Reference.

• Diagnostic interface—Used for diagnostics and reporting; cannot be used for through traffic.

• Inside interface (required)—Used to connect the FTDv to inside hosts.

• Outside interface (required)—Used to connect the FTDv to the public network.

Supported Features

• Routed firewall mode only

• Azure Accelerated Networking (AN)

• Management mode, one of two choices:

  • You can use the Firepower Management Center to manage your FTDv; see Managing the FTDv with FMC.

  • You can use the integrated Firepower Device Manager to manage your FTDv; see Managing the FTDv with FDM.

• Public IP addressing—Assign public IP addresses to Management 0/0 and GigabitEthernet0/0.

  You can assign a public IP address to other interfaces as needed; see Public IP addresses for Azure's guidelines regarding public IPs, including how to create, change, or delete a public IP address.

• Interfaces:

  • FTDv deploys with 4 vNICs by default.

  • With larger instance support you have the ability to deploy the FTDv with a maximum of 8 vNICs.

  • To add addition vNICs to you FTDv deployment, following the guidelines provided by Microsoft’s Add network interfaces to or remove network interfaces from virtual machines.

  • You configure your FTDv interfaces using your manager. See the configuration guide for your management platform, either FMC or FDM, for complete information about interface support and configuration.

Licensing

• BYOL (Bring Your Own License) using a Cisco Smart License Account.

• PAYG (Pay As You Go) licensing, a usage-based billing model that allows customer to run FTDv without having to purchase Cisco Smart Licensing. All licensed features (Malware/Threat/URL Filtering/VPN, etc.) are enabled for a registered PAYG FTDv device. Licensed features cannot be edited or modified from the FMC. (Version 6.5+)

  Note	PAYG licensing is not supported on the FTDv devices deployed in the FDM mode.

See the "Licensing" chapter in the Firepower Management Center Administration Guide for guidelines when licensing your FTDv device.

Performance Tiers for FTDv Smart Licensing

The FTDv supports performance-tiered licensing that provides different throughput levels and VPN connection limits based on deployment requirements.

Performance Optimizations

To achieve the best performance out of the FTDv, you can make adjustments to the both the VM and the host. See Virtualization Tuning and Optimization on Azure for more information.

Receive Side Scaling—The FTDv supports Receive Side Scaling (RSS), which is a technology utilized by network adapters to distribute network receive traffic to multiple processor cores. Supported on Version 7.0 and later. See Multiple RX Queues for Receive Side Scaling (RSS) for more information.

Unsupported Features

• Licensing:

  • PLR (Permanent License Reservation)

  • PAYG (Pay As You Go) (Versions 6.4 and earlier)

• Networking (many of these limitations are Microsoft Azure restrictions):

  • Jumbo frames

  • IPv6

  • 802.1Q VLANs

  • Transparent Mode and other Layer 2 features; no broadcast, no multicast.

  • Proxy ARP for an IP address that the device does not own from an Azure perspective (impacts some NAT capabilities).

  • Promiscuous mode (no capture of subnet traffic).

  • Inline-set modes, passive mode.

    Note	Azure policy prevents the FTDv from operating in transparent firewall or inline mode because it does not allow interfaces to operate in promiscuous mode.

  • ERSPAN (uses GRE, which is not forwarded in Azure).

• Management:

  • Console access; management is performed over the network using the FMC (SSH is available for some setup and maintenance activities)

  • Azure portal “reset password” function

  • Console-based password recovery; because the user does not have real-time access to the console, password recovery is not possible. It is not possible to boot the password recovery image. The only recourse is to deploy a new FTDv VM.

• High Availability (active/standby)

• Clustering

• VM import/export

• FDM user interface (Versions 6.4 and earlier)

Azure DDoS Protection Feature

Azure DDoS Protection in Microsoft Azure is an additional feature implemented at the forefront of the FTDv. In a virtual network, when this feature is enabled it helps to defend applications against common network layer attacks depending on the packet per second of a network’s expected traffic. You can customize this feature based on the network traffic pattern.

For more information about the Azure DDoS Protection feature, see Azure DDoS Protection Standard overview.