Step 1

Log into the Azure Resource Manager (ARM) portal.

Step 2

Choose Azure Marketplace > Virtual Machines.

Step 3

Search Marketplace for “Cisco Firepower NGFW Virtual (Firewall Threat Defense Virtual)”, choose the offering, and click Create.

Step 4

Configure the basic settings.

1. Enter a name for the virtual machine. This name should be unique within your Azure subscription.

   Important

   If you use an existing name the deployment will fail.

2. Choose your licensing method, either BYOL or PAYG.

   Choose BYOL (Bring Your Own License) to use a Cisco Smart License Account.

   Choose PAYG (Pay As You Go) licensing to use a usage-based billing model without having to purchase Cisco Smart Licensing.

   Important

   You can only use PAYG when you manage the Firewall Threat Defense Virtual using the Firewall Management Center.

3. Enter a username for the Firewall Threat Defense Virtual administrator.

   Note	The name “admin” is reserved in Azure and cannot be used.

4. Choose an authentication type, either password or SSH key.

   If you choose password, enter a password and confirm.

   If you choose SSH key, specify the RSA public key of the remote peer.

5. Create a password to use with the Admin user account when you log in to configure the Firewall Threat Defense Virtual.

6. Select the management center you want to register the Firewall Threat Defense Virtual from the FTDv Management drop-down list.

   If you are choosing FMC: Firepower Management Center as the management center for your device, using the following option you can configure the management center for your device.

   • Click Yes to enter the FMC registration information.

     1. Enter the FMC IP address.

     2. Enter the FMC Registration Key for registering the Threat Defense Virtual instances.

     3. [Optional] Enter the management center NAT ID that is used during instance registration.

7. If you are using the virtual machine you are deploying as a cluster, then click Yes (provide day0 cluster configuration) to create and enter the basic day0 configuration details.

   • Enter the day0 configuration details in the Day0 cluster configuration field.

     For information on creating day0 configuration for Azure, see Create the Day0 Configuration for Azure in the Deploy a Threat Defense Virtual Cluster on Azure guide.

     Note	You can only configure the partial day0 config (cluster config): "Cluster": {...} OR "run_config": [...] details.

8. Choose your subscription.

9. Create a new Resource Group.

   The Firewall Threat Defense Virtual should be deployed into a new Resource Group. The option to deploy into an existing Resource Group only works if that existing Resource Group is empty.

   However, you can attach the Firewall Threat Defense Virtual to an existing Virtual Network in another Resource Group when configuring the network options in later steps.

10. Select geographical location. This should be the same for all resources used in this deployment (for example: Firewall Threat Defense Virtual, Network, storage accounts).

11. Click OK.

Step 5

Configure the Firewall Threat Defense Virtual settings.

1. Choose the virtual machine size.

2. Choose a storage account.

   Note	You can use an existing storage account or create a new one. The storage account name can only contain lowercase letters and numbers.

3. Choose a public IP address.

   You can choose a public IP address available for the selected subscription and location, or click Create new.

   When you create a new public IP address, you get one from the block of IP addresses that Microsoft owns, so you can’t choose a specific one. The maximum number of public IP addresses you can assign to an interface is based on your Azure subscription.

   Important

   Azure creates a dynamic public IP address by default. The public IP may change when the VM is stopped and restarted. If you prefer a fixed IP address, you should create a static address. You can also modify the public IP address after deployment and change it from a dynamic to a static address. In case the VM needs to assign the public IPv6 address, refer to the IPv6 standards IPv6 Public IP Address Standards.

4. Add the DNS label.

   Note	The fully qualified domain name will be your DNS label plus the Azure URL: <dnslabel>.<location>.cloudapp.azure.com

5. Choose a virtual network.

   You can choose an existing Azure Virtual Network (VNet) or create a new one and enter the IP address space for the VNet. By default, the Classless Inter-Domain Routing (CIDR) IP address is 10.0.0.0/16.

   If the Virtual Machine is required for the IPv6 addressing, you need to enable it in the virtual network. Example: By default, the CIDR IPv6 address is [ace:cab:deca::/48].

   Note	Virtual Networks, Subnets, Interface, etc., cannot be created by using IPv6 alone. The IPv4 is used by default, and IPv6 can be enabled along with it. For more information on IPv6, see Azure IPv6 Overview

6. Configure four subnets for the Firewall Threat Defense Virtual network interfaces:

   • FTDv Management interface, attached to Nic0 in Azure, the “First subnet”

   • FTDv Data interface 1, attached to Nic1 in Azure, the “Second subnet”

   • FTDv Data interface 2, attached to Nic2 in Azure, the “Third subnet”

   • FTDv Data interface 3, attached to Nic3 in Azure, the “Fourth subnet”

   Note	For the above subnets, if we require IPv6 configuration while creating the subnets, select the IPv6 option and configure IPv6 subnets for the interface.

7. Provide Public inbound ports (mgmt.interface) input to indicate whether any ports are to be opened for public or not. By default, None is selected.

   • Click None to create and attach a network security group with Azure's default security rule to the management interface. Selecting this option allows traffic from sources in the same virtual network and from the Azure load balancer.

   • Click Allow selected ports to view and choose the inbound ports to be opened for acess by the internet. Choose any of the following ports from the Select Inbound Ports drop-down list. By default, SSH (22) is selected.

     • SSH (22)

     • SFTunnel (8305)

     • HTTPs (443)

8. Click OK.

Step 6

View the configuration summary, and then click OK.

Step 7

View the terms of use and then click Purchase.

Step 1

Download the Firewall Threat Defense Virtual compressed VHD image from the Cisco Download Software page:

1. Navigate to Products > Security > Firewalls > Next-Generation Firewalls (NGFW) > Secure Firewall Threat Defense Virtual.

2. Click Firepower Threat Defense Software.

   Follow the instructions for downloading the image.

   For example, Cisco_Secure_Firewall_Threat_Defense_Virtual-X.X.X-xxx.vhd.bz2

Step 2

Copy the compressed VHD image to your Linux VM in Azure.

# scp /username@remotehost.com/dir/Cisco_Secure_Firewall_Threat_Defense_Virtual-7.1.0-92.vhd.bz2 <linux-ip>

Step 3

Log in to the Linux VM in Azure and navigate to the directory where you copied the compressed VHD image.

Step 4

Unzip the Firewall Threat Defense Virtual VHD image.

# bunzip2 Cisco_Firepower_Threat_Defense_Virtual-7.1.0-92.vhd.bz2

Step 5

Upload the VHD to a container in your Azure storage account. You can use an existing storage account or create a new one. The storage account name can only contain lowercase letters and numbers.

azure storage blob upload \
       --file <unzipped vhd> \
       --account-name <azure storage account> \
       --account-key yX7txxxxxxxx1dnQ== \
       --container <container> \
       --blob <desired vhd name in azure> \
       --blobtype page

Step 6

Create a Managed Image from the VHD:

1. In the Azure Portal, select Images.

2. Click Add to create a new image.

3. Provide the following information:

   • Subscription—Choose a subscription from the drop-down list.

   • Resource group—Choose an existing resource group or create a new one.

   • Name—Enter a user-defined name for the managed image.

   • Region—Choose the region in which the VM Is deployed.

   • OS type—Choose Linux as the OS type.

   • VM generation

     Choose Generation 1 for BIOS boot mode.

     Choose Generation 2 for UEFI boot mode.

   • Storage blob—Browse to the storage account to select the uploaded VHD.

   • Account type—As per your requirement, choose Standard HDD, Standard SSD, or Premium SSD, from the drop-down list.

     When you select the VM size planned for deployment of this image, ensure that the VM size supports the selected account type.

   • Host caching—Choose Read/write from the drop-down list.

   • Data disks—Leave at default; don't add a data disk.

4. Click Create.

   Wait for the Successfully created image message under the Notifications tab.

Step 7

Acquire the Resource ID of the newly created Managed Image.

1. In the Azure Portal, select Images.

2. Select the managed image created in the previous step.

3. Click Overview to view the image properties.

4. Copy the Resource ID to the clipboard.

   The Resource ID takes the form of:

   /subscriptions/<subscription-id>/resourceGroups/<resourceGroup>/providers/Microsoft.Compute/<container>/ <vhdname>

Step 8

Build a Firewall Threat Defense Virtual firewall using the managed image and a resource template:

1. On the Azure GUI, search for Custom deployment.

2. Under Select a template, click Build your own template in the editor.

   You have a blank template that is available for customizing. See Github for the template files.

3. Paste your customized JSON template code into the window, and then click Save.

4. Choose a Subscription from the drop-down list.

5. Choose an existing Resource group or create a new one.

6. Choose a Region from the drop-down list.

7. Paste the Managed Image Resource ID from the previous step into the Vm Image Id field.

8. To deploy the Threat Defense Virtual without the diagnostic interface, enter a day-0 configuration script that includes the key-value pair Diagnostic: OFF in the Custom Data field. A sample day-0 configuration script is given below.

   {
   "AdminPassword": "E28@2OiUrhx!",
   "Hostname": "ciscothreatdefensevirtual",
   "FirewallMode": "routed",
   "ManageLocally": "No",
   "Diagnostic": "OFF"
   }

   Note	The key value pair, "Diagnostic": "ON/OFF", is case-sensitive.

   You can also modify the script in the Custom Data field in the ARM template that is used for fresh deployment.

Step 9

Click Edit parameters at the top of the Custom deployment page. You have a parameters template that is available for customizing.

1. Click Load file and browse to the customized Firewall Threat Defense Virtual parameter file. See Github for the template parameters.

2. Paste your customized JSON parameters code into the window, and then click Save.

Step 10

Review the Custom deployment details. Make sure that the information in Basics and Settings matches your expected deployment configuration, including the Resource ID.

Step 11

Review the Terms and Conditions, and check the I agree to the terms and conditions stated above check box.

Step 12

Click Purchase to deploy a Firewall Threat Defense Virtual firewall using the managed image and a custom template.

Step 1

Log into the Azure portal.

Step 2

Enable Programmatic deployment through Azure portal or Azure CLI as follows:

1. Under Azure Services, click Subscriptions to view the subscription blade page.

2. On the left pane, click Programmatic Deployment under the Settings option.

   All the types of resources deployed on the VM are displayed along with the associated subscription offerings.

3. Click Enable under the Status column and corresponding to the Firewall Threat Defense Virtual offering to obtain for programmatic deployment of the custom IPv6 template.

   OR

1. Go to the Linux VM.

2. Run the following CLI command to enable programmatic deployment for deploying custom IPv6 (ARM) template.

   During the command execution, you must only accept the terms once per subscription of the image.

   # Accept terms

   az vm image terms accept -p <publisher> -f <offer> --plan <SKU/plan>

   # Review that terms were accepted (i.e., accepted=true)

   az vm image terms show -p <publisher> -f <offer> --plan <SKU/plan>

   Where,

   • <publisher> - 'cisco'.

   • <offer> - 'cisco-ftdv'

   • <sku/plan> - 'ftdv-azure-byol'

   The following is a command script example to enable programmatic deployment for deploying Firewall Threat Defense Virtual with BYOL subscription plan.

   • az vm image terms show -p cisco -f cisco-ftdv --plan ftdv-azure-byol

Step 3

Run the following command to retrieve the Software version details equivalent to the marketplace image version.

Step 4

Select one of the Firewall Threat Defense Virtual version from the list of available marketplace image versions that are displayed.

Step 5

Download the marketplace custom IPv6 template (ARM templates) from the Cisco GitHub repository.

Step 6

Prepare the parameters file by providing the deployment values in the parameters template file (JSON).

Step 7

Use the ARM template to deploy Firewall Threat Defense Virtual firewall through the Azure portal or Azure CLI. For information about deploying the ARM template on Azure, refer to the following Azure documentation:

Step 1

Download the Firewall Threat Defense Virtual compressed VHD image (*.bz2) from the Cisco Download Software page:

1. Navigate to Products > Security > Firewalls > Next-Generation Firewalls (NGFW) > Secure Firewall Threat Defense Virtual.

2. Click Firepower Threat Defense Software.

   Follow the instructions for downloading the image.

   Cisco_Secure_Firewall_Threat_Defense_Virtual-X.X.X-xxx.vhd.bz2

Step 2

Perform Step 2 through Step 8 in Deploy from Azure Using a VHD and Resource Template .

Step 3

Click Edit parameters at the top of the Custom deployment page. You have a parameters template that is available for customizing.

1. Click Load file and browse to the customized Firewall Threat Defense Virtual parameter file. See the sample for the Azure Firewall Threat Defense Virtual deployment using VHD and custom IPv6 (ARM) template on Github, where you'll find instructions on how to build a template and parameter file.

2. Paste your customized JSON parameters code into the window, and then click Save.

Step 4

Use the ARM template to deploy Firewall Threat Defense Virtual firewall through the Azure portal or Azure CLI. For information about deploying the ARM template on Azure, refer to the following Azure documentation: