Cisco Firepower 1010 Getting Started Guide

End-to-End Tasks

See the following tasks to deploy the threat defense with the device manager.


	Pre-Configuration	Install the firewall. See the hardware installation guide.
	Pre-Configuration	Review the Network Deployment and Default Configuration.
	Pre-Configuration	Cable the Device.
	Pre-Configuration	Power On the Firewall.
	CLI	(Optional) Check the Software and Install a New Version
	CLI	(Optional) Change Management Network Settings at the CLI.
	Device Manager	Log Into the Device Manager.
	Device Manager	Complete the Initial Configuration.
	Cisco Commerce Workspace	(Optional) Configure Licensing: Obtain feature licenses.
	Smart Software Manager	Configure Licensing: Generate a license token.
	Device Manager	Configure Licensing: Register the device with the Smart Licensing Server.
	Device Manager	Configure the Firewall in the Device Manager.

Review the Network Deployment and Default Configuration

You can manage the threat defense using the device manager from either the Management 1/1 interface or the inside interface. The dedicated Management interface is a special interface with its own network settings.

The following figure shows the recommended network deployment. If you connect the outside interface directly to a cable modem or DSL modem, we recommend that you put the modem into bridge mode so the threat defense performs all routing and NAT for your inside networks. If you need to configure PPPoE for the outside interface to connect to your ISP, you can do so after you complete initial setup in device manager.

Note

If you cannot use the default management IP address (for example, your management network does not include a DHCP server), then you can connect to the console port and perform initial setup at the CLI, including setting the Management IP address, gateway, and other basic networking settings.

If you need to change the inside IP address, you can do so after you complete initial setup in the device manager. For example, you may need to change the inside IP address in the following circumstances:

(7.0 and later) The inside IP address is 192.168.95.1. (6.7 and earlier) The inside IP address is 192.168.1.1. If the outside interface tries to obtain an IP address on the 192.168.1.0 network, which is a common default network, the DHCP lease will fail, and the outside interface will not obtain an IP address. This problem occurs because the threat defense cannot have two interfaces on the same network. In this case you must change the inside IP address to be on a new network.
If you add the threat defense to an existing inside network, you will need to change the inside IP address to be on the existing network.

The following figure shows the default network deployment for the threat defense using the device manager with the default configuration.

Note

For 6.7 and earlier, the inside IP address is 192.168.1.1.

For 6.5 and earlier, the Management 1/1 default IP address is 192.168.45.45.

Default Configuration

The configuration for the firewall after initial setup includes the following:

inside—IP address (7.0 and later) 192.168.95.1; (pre-7.0) 192.168.1.1.
- (6.5 and later) Hardware switch—Ethernet 1/2 through 1/8 belong to VLAN 1
- (6.4) Software switch (Integrated Routing and Bridging)—Ethernet 1/2 through 1/8 belong to bridge group interface (BVI) 1
outside—Ethernet 1/1, IP address from IPv4 DHCP and IPv6 autoconfiguration
inside→outside traffic flow

management—Management 1/1 (management)

(6.6 and later) IP address from DHCP
(6.5 and earlier) IP address 192.168.45.45

Note

The Management 1/1 interface is a special interface separate from data interfaces that is used for management, Smart Licensing, and database updates. The physical interface is shared with a second logical interface, the Diagnostic interface. Diagnostic is a data interface, but is limited to other types of management traffic (to-the-device and from-the-device), such as syslog or SNMP. The Diagnostic interface is not typically used. See the Cisco Secure Firewall Device Manager Configuration Guide for more information.

DNS server for management—OpenDNS: (IPv4) 208.67.222.222, 208.67.220.220; (IPv6) 2620:119:35::35, or servers you specify during setup. DNS servers obtained from DHCP are never used.
NTP—Cisco NTP servers: 0.sourcefire.pool.ntp.org, 1.sourcefire.pool.ntp.org, 2.sourcefire.pool.ntp.org, or servers you specify during setup
Default routes
- Data interfaces—Obtained from outside DHCP, or a gateway IP address you specify during setup
- Management interface—(6.6 and later) Obtained from management DHCP. If you do not receive a gateway, then the default route is over the backplane and through the data interfaces. (6.5 and earlier) Over the backplane and through the data interfaces
  
  Note that the Management interface requires internet access for licensing and updates, either over the backplane or using a separate internet gateway. Note that only traffic originating on the Management interface can go over the backplane; otherwise, Management does not allow through traffic for traffic entering Management from the network.
DHCP server—Enabled on the inside interface and (6.5 and earlier only) management interface
Device Manager access—All hosts allowed on Management and the inside interface.
NAT—Interface PAT for all traffic from inside to outside

Cable the Device

Note

For 6.7 and earlier, the inside IP address is 192.168.1.1.

For version 6.5 and earlier, the Management 1/1 default IP address is 192.168.45.45.

Note

In version 6.5 and later, Ethernet1/2 through 1/8 are configured as hardware switch ports; PoE+ is also available on Ethernet1/7 and 1/8. In version 6.4, Ethernet1/2 through 1/8 are configured as bridge group members (software switch ports); PoE+ is not available. The initial cabling is the same for both versions.

Note

PoE is not supported on the Firepower 1010E.

Manage the Firepower 1010 on either Management 1/1 or Ethernet 1/2 through 1/8. The default configuration also configures Ethernet1/1 as outside.

Procedure

Step 1	Install and familiarize yourself with your hardware using the hardware installation guide.
Step 2	Connect your management computer to one of the following interfaces: Ethernet 1/2 through 1/8—Connect your management computer directly to one of the inside switch ports (Ethernet 1/2 through 1/8). inside has a default IP address (192.168.95.1) and also runs a DHCP server to provide IP addresses to clients (including the management computer), so make sure these settings do not conflict with any existing inside network settings (see Default Configuration). Management 1/1 (labeled MGMT)—Connect Management 1/1 to your management network, and make sure your management computer is on—or has access to—the management network. Management 1/1 obtains an IP address from a DHCP server on your management network; if you use this interface, you must determine the IP address assigned to the threat defense so that you can connect to the IP address from your management computer. If you need to change the Management 1/1 IP address from the default to configure a static IP address, you must also cable your management computer to the console port. See (Optional) Change Management Network Settings at the CLI.
Step 3	Connect the outside network to the Ethernet 1/1 interface. By default, the IP address is obtained using IPv4 DHCP and IPv6 autoconfiguration, but you can set a static address during initial configuration.
Step 4	Connect inside devices to the remaining switch ports, Ethernet 1/2 through 1/8. Ethernet 1/7 and 1/8 are PoE+ ports.

Power On the Firewall

System power is controlled by the power cord; there is no power button.

Note

The first time you boot up the threat defense, initialization can take approximately 15 to 30 minutes.

Before you begin

It's important that you provide reliable power for your device (using an uninterruptable power supply (UPS), for example). Loss of power without first shutting down can cause serious file system damage. There are many processes running in the background all the time, and losing power does not allow the graceful shutdown of your system.

Procedure

Step 1

Attach the power cord to the device, and connect it to an electrical outlet.

The power turns on automatically when you plug in the power cord.

Step 2

Check the Power LED on the back or top of the device; if it is solid green, the device is powered on.

Step 3

Check the Status LED on the back or top of the device; after it is solid green, the system has passed power-on diagnostics.

(Optional) Check the Software and Install a New Version

To check the software version and, if necessary, install a different version, perform these steps. We recommend that you install your target version before you configure the firewall. Alternatively, you can perform an upgrade after you are up and running, but upgrading, which preserves your configuration, may take longer than using this procedure.

What Version Should I Run?

Cisco recommends running a Gold Star release indicated by a gold star next to the release number on the software download page. You can also refer to the release strategy described in https://www.cisco.com/c/en/us/products/collateral/security/firewalls/bulletin-c25-743178.html; for example, this bulletin describes short-term release numbering (with the latest features), long-term release numbering (maintenance releases and patches for a longer period of time), or extra long-term release numbering (maintenance releases and patches for the longest period of time, for government certification).

Procedure

Step 1

Connect to the CLI. See Access the Threat Defense and FXOS CLI for more information. This procedure shows using the console port, but you can use SSH instead.

Log in with the admin user and the default password, Admin123.

You connect to the FXOS CLI. The first time you log in, you are prompted to change the password. This password is also used for the threat defense login for SSH.

Note

If the password was already changed, and you do not know it, you must perform a factory reset to reset the password to the default. See the FXOS troubleshooting guide for the factory reset procedure.

Example:


firepower login: admin
Password: Admin123
Successful login attempts for user 'admin' : 1

[...]

Hello admin. You must change your password.
Enter new password: ********
Confirm new password: ********
Your password was updated successfully.

[...]

firepower#

Step 2

At the FXOS CLI, show the running version.

scope ssa

show app-instance

Example:


Firepower# scope ssa
Firepower /ssa # show app-instance

Application Name     Slot ID    Admin State     Operational State    Running Version Startup Version Cluster Oper State
-------------------- ---------- --------------- -------------------- --------------- --------------- ------------------
ftd                  1          Enabled         Online               7.4.0.65        7.4.0.65        Not Applicable

Step 3

If you want to install a new version, perform these steps.

If you need to set a static IP address for the Management interface, see (Optional) Change Management Network Settings at the CLI. By default, the Management interface uses DHCP.

You will need to download the new image from a server accessible from the Management interface.
Perform the reimage procedure in the FXOS troubleshooting guide.

After the firewall reboots, you connect to the FXOS CLI again.
At the FXOS CLI, you are prompted to set the admin password again.

(Optional) Change Management Network Settings at the CLI

If you cannot use the default management IP address, then you can connect to the console port and perform initial setup at the CLI, including setting the Management IP address, gateway, and other basic networking settings. You can only configure the Management interface settings; you cannot configure inside or outside interfaces, which you can later configure in the GUI.

Note

You cannot repeat the CLI setup script unless you clear the configuration; for example, by reimaging. However, all of these settings can be changed later at the CLI using configure network commands. See Cisco Secure Firewall Threat Defense Command Reference.

Procedure

Step 1

Connect to the threat defense console port. See Access the Threat Defense and FXOS CLI for more information.

Log in with the admin user and the default password, Admin123.

You connect to the FXOS CLI. The first time you log in, you are prompted to change the password. This password is also used for the threat defense login for SSH.

Note

If the password was already changed, and you do not know it, you must reimage the device to reset the password to the default. See the FXOS troubleshooting guide for the reimage procedure.

Example:


firepower login: admin
Password: Admin123
Successful login attempts for user 'admin' : 1

[...]

Hello admin. You must change your password.
Enter new password: ********
Confirm new password: ********
Your password was updated successfully.

[...]

firepower#

Step 2

Connect to the threat defense CLI.

connect ftd

Example:


firepower# connect ftd
>

Step 3

The first time you log into the threat defense, you are prompted to accept the End User License Agreement (EULA). You are then presented with the CLI setup script.

Defaults or previously-entered values appear in brackets. To accept previously entered values, press Enter.

See the following guidelines:

Enter the IPv4 default gateway for the management interface—If you set a manual IP address, enter either data-interfaces or the IP address of the gateway router. The data-interfaces setting sends outbound management traffic over the backplane to exit a data interface. This setting is useful if you do not have a separate Management network that can access the internet. Traffic originating on the Management interface includes license registration and database updates that require internet access. If you use data-interfaces, you can still use the device manager (or SSH) on the Management interface if you are directly-connected to the Management network, but for remote management for specific networks or hosts, you should add a static route using the configure network static-routes command. Note that the device manager management on data interfaces is not affected by this setting. If you use DHCP, the system uses the gateway provided by DHCP and uses the data-interfaces as a fallback method if DHCP doesn't provide a gateway.
If your networking information has changed, you will need to reconnect—If you are connected with SSH to the default IP address but you change the IP address at initial setup, you will be disconnected. Reconnect with the new IP address and password. Console connections are not affected.
Manage the device locally?—Enter yes to use the device manager. A no answer means you intend to use the on-premises or cloud-delivered management center to manage the device.

Example:


You must accept the EULA to continue.
Press <ENTER> to display the EULA:
End User License Agreement
[...]

Please enter 'YES' or press <ENTER> to AGREE to the EULA: 

System initialization in progress.  Please stand by.
You must configure the network to continue.
You must configure at least one of IPv4 or IPv6.
Do you want to configure IPv4? (y/n) [y]:
Do you want to configure IPv6? (y/n) [n]:
Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]:
Enter an IPv4 address for the management interface [192.168.45.45]: 10.10.10.15
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.192
Enter the IPv4 default gateway for the management interface [data-interfaces]: 10.10.10.1
Enter a fully qualified hostname for this system [firepower]: ftd-1.cisco.com
Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220]:
Enter a comma-separated list of search domains or 'none' []:
If your networking information has changed, you will need to reconnect.
For HTTP Proxy configuration, run 'configure network http-proxy'

Manage the device locally? (yes/no) [yes]: yes

>

Step 4

Log into the device manager on the new Management IP address.

Log Into the Device Manager

Log into the device manager to configure your threat defense.

Before you begin

Use a current version of Firefox, Chrome, Safari, Edge, or Internet Explorer.

Procedure

Step 1

Enter the following URL in your browser.

(7.0 and later) Inside (Ethernet1/2 through 1/8)—https://192.168.95.1 .You can connect to the inside address on any inside switch port (Ethernet1/2 through 1/8).
(6.7 and earlier) Inside (Ethernet1/2 through 1/8)—https://192.168.1.1 .You can connect to the inside address on any inside switch port (Ethernet1/2 through 1/8).
(6.6 and later) Management—https://management_ip . The Management interface is a DHCP client, so the IP address depends on your DHCP server. If you changed the Management IP address at the CLI setup, then enter that address.
(6.5 and earlier) Management—https://192.168.45.45 . If you changed the Management IP address at the CLI setup, then enter that address.

Step 2

Log in with the username admin, and thedefault password Admin123.

What to do next

Run through the device manager setup wizard; see Complete the Initial Configuration.

Complete the Initial Configuration

Use the setup wizard when you first log into the device manager to complete the initial configuration. After you complete the setup wizard, you should have a functioning device with a few basic policies in place:

An outside (Ethernet1/1) and an inside interface. Ethernet1/2 through 1/8 are switch ports on the inside VLAN1 interface (6.5 and later) or inside bridge group members on BVI1 (6.4).
Security zones for the inside and outside interfaces.
An access rule trusting all inside to outside traffic.
An interface NAT rule that translates all inside to outside traffic to unique ports on the IP address of the outside interface.
A DHCP server running on the inside interface.

Note

If you performed the (Optional) Change Management Network Settings at the CLI procedure, then some of these tasks, specifically changing the admin password and configuring the outside and management interfaces, should have already been completed.

Procedure

Step 1

You are prompted to read and accept the End User License Agreement and change the admin password.

You must complete these steps to continue.

Step 2

Configure the following options for the outside and management interfaces and click Next.

Note

Your settings are deployed to the device when you click Next. The interface will be named “outside” and it will be added to the “outside_zone” security zone. Ensure that your settings are correct.

Outside Interface—This is the data port that you connected to your gateway router. You cannot select an alternative outside interface during initial device setup. The first data interface is the default outside interface.

Configure IPv4—The IPv4 address for the outside interface. You can use DHCP or manually enter a static IP address, subnet mask, and gateway. You can also select Off to not configure an IPv4 address. You cannot configure PPPoE using the setup wizard. PPPoE may be required if the interface is connected to a DSL modem, cable modem, or other connection to your ISP, and your ISP uses PPPoE to provide your IP address. You can configure PPPoE after you complete the wizard.

Configure IPv6—The IPv6 address for the outside interface. You can use DHCP or manually enter a static IP address, prefix, and gateway. You can also select Off to not configure an IPv6 address.
Management Interface

DNS Servers—The DNS server for the system's management address. Enter one or more addresses of DNS servers for name resolution. The default is the OpenDNS public DNS servers. If you edit the fields and want to return to the default, click Use OpenDNS to reload the appropriate IP addresses into the fields.

Firewall Hostname—The hostname for the system's management address.

Step 3

Configure the system time settings and click Next.

Time Zone—Select the time zone for the system.
NTP Time Server—Select whether to use the default NTP servers or to manually enter the addresses of your NTP servers. You can add multiple servers to provide backups.

Step 4

(Optional) Configure the smart licenses for the system.

Your purchase of the threat defense device automatically includes a Base license. All additional licenses are optional.

You must have a smart license account to obtain and apply the licenses that the system requires. Initially, you can use the 90-day evaluation license and set up smart licensing later.

To register the device now, click the link to log into your Smart Software Manager account, and see Configure Licensing.

To use the evaluation license, select Start 90 day evaluation period without registration.

Step 5

Click Finish.

What to do next

Although you can continue using the evaluation license, we recommend that you register and license your device; see Configure Licensing.
You can also choose to configure the device using the device manager; see Configure the Firewall in the Device Manager.

Configure Licensing

The threat defense uses Smart Software Licensing, which lets you purchase and manage a pool of licenses centrally.

When you register the chassis, the Smart Software Manager issues an ID certificate for communication between the chassis and the Smart Software Manager. It also assigns the chassis to the appropriate virtual account.

For a more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide

The Essentials license is included automatically. Smart Licensing does not prevent you from using product features that you have not yet purchased. You can start using a license immediately, as long as you are registered with the Smart Software Manager, and purchase the license later. This allows you to deploy and use a feature, and avoid delays due to purchase order approval. See the following licenses:

Essentials—(Required) Essentials license.
IPS—Security Intelligence and Next-Generation IPS
Malware Defense—Malware defense
URL—URL Filtering
Cisco Secure Client—Secure Client Advantage, Secure Client Premier, or Secure Client VPN Only

Before you begin

Have a master account on the Smart Software Manager.

If you do not yet have an account, click the link to set up a new account. The Smart Software Manager lets you create a master account for your organization.
Your Smart Software Licensing account must qualify for the Strong Encryption (3DES/AES) license to use some features (enabled using the export-compliance flag).

Procedure

Step 1

Make sure your Smart Licensing account contains the available licenses you need.

When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart Software License account. However, if you need to add licenses yourself, use the Find Products and Solutions search field on the Cisco Commerce Workspace. Search for the following license PIDs:

Note

If a PID is not found, you can add the PID manually to your order.

IPS, Malware Defense, and URL license combination:
- L-FPR1010T-TMC=
When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:
- L-FPR1010T-TMC-1Y
- L-FPR1010T-TMC-3Y
- L-FPR1010T-TMC-5Y
Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Step 2

In the Smart Software Manager, request and copy a registration token for the virtual account to which you want to add this device.

Click Inventory.
On the General tab, click New Token.
On the Create Registration Token dialog box enter the following settings, and then click Create Token:
- Description
- Expire After—Cisco recommends 30 days.
- Allow export-controlled functionality on the products registered with this token—Enables the export-compliance flag if you are in a country that allows for strong encryption. You must select this option now if you plan to use this functionality. If you enable this functionality later, you will need to re-register your device with a new product key and reload the device. If you do not see this option, your account does not support export-controlled functionality.
The token is added to your inventory.
Click the arrow icon to the right of the token to open the Token dialog box so you can copy the token ID to your clipboard. Keep this token ready for later in the procedure when you need to register the threat defense.

Figure 4. View Token

Figure 5. Copy Token

Step 3

In the device manager, click Device, and then in the Smart License summary, click View Configuration.

You see the Smart License page.

Step 4

Click Register Device.

Then follow the instructions on the Smart License Registration dialog box to paste in your token:

Step 5

Click Register Device.

You return to the Smart License page. While the device registers, you see the following message:

After the device successfully registers and you refresh the page, you see the following:

Step 6

Click the Enable/Disable control for each optional license as desired.

Enable—Registers the license with your Cisco Smart Software Manager account and enables the controlled features. You can now configure and deploy policies controlled by the license.
Disable—Unregisters the license with your Cisco Smart Software Manager account and disables the controlled features. You cannot configure the features in new policies, nor can you deploy policies that use the feature.
If you enabled the Cisco Secure Client license, select the type of license you want to use: Advantage, Premier, VPN Only, or Premier and Advantage.

After you enable features, if you do not have the licenses in your account, you will see the following non-compliance message after you refresh the page:

Step 7

Choose Resync Connection from the gear drop-down list to synchronize license information with Cisco Smart Software Manager.

Configure the Firewall in the Device Manager

The following steps provide an overview of additional features you might want to configure. Please click the help button (?) on a page to get detailed information about each step.

Procedure

Step 1

If you want to convert a bridge group interface (6.4) or want to convert a switch port to a firewall interface (6.5 and later), choose Device, and then click the link in the Interfaces summary.

Click the edit icon () for each interface to set the mode and define the IP address and other settings.

The following example configures an interface to be used as a “demilitarized zone” (DMZ), where you place publicly-accessible assets such as your web server. Click Save when you are finished.

Step 2

If you configured new interfaces, choose Objects, then select Security Zones from the table of contents.

Edit or create new zones as appropriate. Each interface must belong to a zone, because you configure policies based on security zones, not interfaces. You cannot put the interfaces in zones when configuring them, so you must always edit the zone objects after creating new interfaces or changing the purpose of existing interfaces.

The following example shows how to create a new dmz-zone for the dmz interface.

Step 3

If you want internal clients to use DHCP to obtain an IP address from the device, choose Device > System Settings > DHCP Server, then select the DHCP Servers tab.

There is already a DHCP server configured for the inside interface, but you can edit the address pool or even delete it. If you configured other inside interfaces, it is very typical to set up a DHCP server on those interfaces. Click + to configure the server and address pool for each inside interface.

You can also fine-tune the WINS and DNS list supplied to clients on the Configuration tab. The following example shows how to set up a DHCP server on the inside2 interface with the address pool 192.168.4.50-192.168.4.240.

Step 4

Choose Device, then click View Configuration (or Create First Static Route) in the Routing group and configure a default route.

The default route normally points to the upstream or ISP router that resides off the outside interface. A default IPv4 route is for any-ipv4 (0.0.0.0/0), whereas a default IPv6 route is for any-ipv6 (::0/0). Create routes for each IP version you use. If you use DHCP to obtain an address for the outside interface, you might already have the default routes that you need.

Note

The routes you define on this page are for the data interfaces only. They do not impact the management interface. Set the management gateway on Device > System Settings > Management Interface.

The following example shows a default route for IPv4. In this example, isp-gateway is a network object that identifies the IP address of the ISP gateway (you must obtain the address from your ISP). You can create this object by clicking Create New Network at the bottom of the Gateway drop-down list.

Step 5

Choose Policies and configure the security policies for the network.

The device setup wizard enables traffic flow between the inside-zone and outside-zone, and interface NAT for all interfaces when going to the outside interface. Even if you configure new interfaces, if you add them to the inside-zone object, the access control rule automatically applies to them.

However, if you have multiple inside interfaces, you need an access control rule to allow traffic flow from inside-zone to inside-zone. If you add other security zones, you need rules to allow traffic to and from those zones. These would be your minimum changes.

In addition, you can configure other policies to provide additional services, and fine-tune NAT and access rules to get the results that your organization requires. You can configure the following policies:

SSL Decryption—If you want to inspect encrypted connections (such as HTTPS) for intrusions, malware, and so forth, you must decrypt the connections. Use the SSL decryption policy to determine which connections need to be decrypted. The system re-encrypts the connection after inspecting it.
Identity—If you want to correlate network activity to individual users, or control network access based on user or user group membership, use the identity policy to determine the user associated with a given source IP address.
Security Intelligence—Use the Security Intelligence policy to quickly drop connections from or to blacklisted IP addresses or URLs. By blacklisting known bad sites, you do not need to account for them in your access control policy. Cisco provides regularly updated feeds of known bad addresses and URLs so that the Security Intelligence blacklist updates dynamically. Using feeds, you do not need to edit the policy to add or remove items in the blacklist.
NAT (Network Address Translation)—Use the NAT policy to convert internal IP addresses to externally routeable addresses.
Access Control—Use the access control policy to determine which connections are allowed on the network. You can filter by security zone, IP address, protocol, port, application, URL, user or user group. You also apply intrusion and file (malware) policies using access control rules. Use this policy to implement URL filtering.
Intrusion—Use the intrusion policies to inspect for known threats. Although you apply intrusion policies using access control rules, you can edit the intrusion policies to selectively enable or disable specific intrusion rules.

The following example shows how to allow traffic between the inside-zone and dmz-zone in the access control policy. In this example, no options are set on any of the other tabs except for Logging, where At End of Connection is selected.

Step 6

Choose Device, then click View Configuration in the Updates group and configure the update schedules for the system databases.

If you are using intrusion policies, set up regular updates for the Rules and VDB databases. If you use Security Intelligence feeds, set an update schedule for them. If you use geolocation in any security policies as matching criteria, set an update schedule for that database.

Step 7

Click the Deploy button in the menu, then click the Deploy Now button (), to deploy your changes to the device.

Changes are not active on the device until you deploy them.

Access the Threat Defense and FXOS CLI

Use the command-line interface (CLI) to set up the system and do basic system troubleshooting. You cannot configure policies through a CLI session. You can access the CLI by connecting to the console port.

You can also access the FXOS CLI for troubleshooting purposes.

Note

You can alternatively SSH to the Management interface of the threat defense device. Unlike a console session, the SSH session defaults to the threat defense CLI, from which you can connect to the FXOS CLI using the connect fxos command. You can later connect to the address on a data interface if you open the interface for SSH connections. SSH access to data interfaces is disabled by default. This procedure describes console port access, which defaults to the FXOS CLI.

Procedure

Step 1

To log into the CLI, connect your management computer to the console port. The Firepower 1000 ships with a USB A-to-B serial cable. Be sure to install any necessary USB serial drivers for your operating system. The console port defaults to the FXOS CLI. Use the following serial settings:

9600 baud
8 data bits
No parity
1 stop bit

You connect to the FXOS CLI. Log in to the CLI using the admin username and the password you set at initial setup (the default is Admin123).

Example:


firepower login: admin
Password:
Last login: Thu May 16 14:01:03 UTC 2019 on ttyS0
Successful login attempts for user 'admin' : 1

firepower#

Step 2

Access the threat defense CLI.

connect ftd

Example:


firepower# connect ftd
>

After logging in, for information on the commands available in the CLI, enter help or ? . For usage information, see Cisco Secure Firewall Threat Defense Command Reference.

Step 3

To exit the threat defense CLI, enter the exit or logout command.

This command returns you to the FXOS CLI prompt. For information on the commands available in the FXOS CLI, enter ? .

Example:


> exit
firepower#

View Hardware Information

Use the command-line interface (CLI) to view information about your hardware, including the device model, hardware version, serial number, and chassis components including power supplies and network modules. You can access the CLI by connecting to the console port; see Access the Threat Defense and FXOS CLI.

Procedure

Step 1

To display the hardware model of the device, use the show model command.

> show model

Example:


> show model
Cisco Firepower 1010 Threat Defense

Step 2

To display the chassis serial number, use the show serial-number command.

> show serial-number

Example:


> show serial-number
JMX1943408S

This information is also shown in show version system , show running-config , and show inventory output.

Step 3

To display information about all of the Cisco products installed in the networking device that are assigned a product identifier (PID), version identifier (VID), and serial number (SN), use the show inventory command.

> show inventory

From the threat defense CLI:

Example:


> show inventory
Name: "module 0", DESCR: "Firepower 1010 Appliance, Desktop, 8 GE, 1 MGMT"
PID: FPR-1010          , VID: V00     , SN: JMX1943408S

From the FXOS CLI:

Example:


firepower /chassis # show inventory
Chassis    PID             Vendor            Serial (SN) HW Revision
---------- --------------- ----------------- ----------- -----------
         1 FPR-1010        Cisco Systems, In JMX1943408S 0.3

Power Off the Firewall

It's important that you shut down your system properly. Simply unplugging the power can cause serious file system damage. Remember that there are many processes running in the background all the time, and unplugging or shutting off the power does not allow the graceful shutdown of your firewall system.

The Firepower 1010 chassis does not have an external power switch.You can power off the firewall using device manager, or you can use the FXOS CLI.

Power Off the Firewall Using the Device Manager

You can shut down your system properly using the device manager.

Procedure

Step 1

Use the device manager to shut down the firewall.

Note

For 6.4 and earlier, enter the shutdown command at the device manager CLI.

Click Device, then click the System Settings > Reboot/Shutdown link.
Click Shut Down.

Step 2

If you have a console connection to the firewall, monitor the system prompts as the firewall shuts down. You will see the following prompt:


System is stopped.
It is safe to power off now.

Do you want to reboot instead? [y/N]

If you do not have a console connection, wait approximately 3 minutes to ensure the system has shut down.

Step 3

You can now unplug the power to physically remove power from the chassis if necessary.

Power Off the Device at the CLI

You can use the FXOS CLI to safely shut down the system and power off the device. You access the CLI by connecting to the console port; see Access the Threat Defense and FXOS CLI.

Procedure

Step 1	In the FXOS CLI, connect to local-mgmt: firepower # connect local-mgmt
Step 2	Issue the shutdown command: firepower(local-mgmt) # shutdown Example: `firepower(local-mgmt)# shutdown This command will shutdown the system. Continue? Please enter 'YES' or 'NO': yes INIT: Stopping Cisco Threat Defense......ok`
Step 3	Monitor the system prompts as the firewall shuts down. You will see the following prompt: `System is stopped. It is safe to power off now. Do you want to reboot instead? [y/N]`
Step 4	You can now unplug the power to physically remove power from the chassis if necessary.

What's Next?

To continue configuring your threat defense, see the documents available for your software version at Navigating the Cisco Firepower Documentation.

For information related to using the device manager, see Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Bias-Free Language

Results

Chapter: Threat Defense Deployment with the Device Manager

Threat Defense Deployment with the Device Manager

End-to-End Tasks

Review the Network Deployment and Default Configuration

Default Configuration

Cable the Device

Procedure

Power On the Firewall

Before you begin

Procedure

(Optional) Check the Software and Install a New Version

Procedure

Example:

Example:

(Optional) Change Management Network Settings at the CLI

Procedure

Example:

Example:

Example:

Log Into the Device Manager

Before you begin

Procedure

What to do next

Complete the Initial Configuration

Procedure

What to do next

Configure Licensing

Before you begin

Procedure

Configure the Firewall in the Device Manager

Procedure

Access the Threat Defense and FXOS CLI

Procedure

Example:

Example:

Example:

View Hardware Information

Procedure

Example:

Example:

Example:

Example:

Power Off the Firewall

Power Off the Firewall Using the Device Manager

Procedure

Power Off the Device at the CLI

Procedure

Example:

What's Next?

Was this Document Helpful?

Contact Cisco