Step 1

Connect your computer to the inside interface (Ethernet 1/2).

Step 2

Log into the device manager.

1. Go to https://192.168.95.1.

2. Log in with the username admin and the default password Admin123.

3. You are prompted to read and accept the General Terms and change the admin password.

Step 3

Use the setup wizard.

Note	The exact port configuration depends on your model.

1. Configure the outside and management interfaces.

   

   1. Outside Interface Address—Use a static IP address if you plan for high availability. You cannot configure PPPoE using the setup wizard; you can configure PPPoE after you complete the wizard.

   2. Management Interface—The Management interface settings are used even though you are using manager access on the outside interface. For example, management traffic that is routed over the backplane through the outside interface will resolve FQDNs using these Management interface DNS servers, and not the outside interface DNS servers.

      DNS Servers—The DNS server for the system's management address. The default is the OpenDNS public DNS servers. These will probably match the outside interface DNS servers you set later since they are both accessed from the outside interface.

      Firewall Hostname

2. Configure the Time Setting (NTP) and click Next.

   

3. Select Start 90 day evaluation period without registration.

   

   Do not register the threat defense with the Smart Software Manager; all licensing is performed on the management centerCDO.

4. Click Finish.

   

5. Choose Standalone Device, and then Got It.

Step 4

If you want to configure additional interfaces, choose Device, and then click the link in the Interfaces summary.

Step 5

Register with the management centerCDO by choosing Device > System Settings > Central Management and clicking Proceed

Configure the Management Center/SCC/Details.

Note	Older versions may show "CDO" instead of "SCC."

1. For Do you know the Management Center/SCC Hostname or IP address, click Yes if you can reach the management center using an IP address or hostname or No if the management center is behind NAT or does not have a public IP address or hostname.

2. If you chose Yes, enter the Management Center/SCC Hostname/IP Address.

3. Specify the Management Center/SCC Registration Key.

   This key is a one-time registration key of your choice that you will also specify on the management center when you register the firewall. The registration key must be between 2 and 36 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-). This ID can be used for multiple firewalls registering to the management center.

4. Specify a NAT ID.

   This ID is a unique, one-time string of your choice that you will also specify on the management center. We recommend that you specify the NAT ID even if you know the IP addresses of both devices. The NAT ID must be between 2 and 36 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-). This ID cannot be used for any other firewalls registering to the management center. The NAT ID is used in combination with the IP address to verify that the connection is coming from the correct device; only after authentication of the IP address/NAT ID will the registration key be checked.

Step 6

Configure the Connectivity Configuration.

1. Specify the Threat Defense Hostname.

   This FQDN will be used for the outside interface.

2. Specify the DNS Server Group.

   Choose an existing group, or create a new one. The default DNS group is called CiscoUmbrellaDNSServerGroup, which includes the OpenDNS servers.

   To retain the outside DNS server setting after registration, you need to re-configure the DNS Platform Settings in the management center.

3. For the Management Center/SCC Access Interface, click Data Interface, and then choose outside.

Step 7

(Optional) Click Add a Dynamic DNS (DDNS) method.

Step 8

Click Connect.

The Registration Status dialog box shows the current status of the management centerCDO registration.

Step 9

After the Saving Management Center/SCC Registration Settings step on the status screen, go to the management centerCDO and add the firewall. See Add a Device Using Manual Provisioning.

Step 1

Connect to the console port and access the threat defense CLI. See Access the Threat Defense CLI.

Step 2

Complete the CLI setup script for the Management interface settings.

You must accept the EULA to continue.
Press <ENTER> to display the EULA:                 
Cisco General Terms
[...]

Please enter 'YES' or press <ENTER> to AGREE to the EULA:

System initialization in progress.  Please stand by.
You must configure the network to continue.
Configure at least one of IPv4 or IPv6 unless managing via data interfaces.
Do you want to configure IPv4? (y/n) [y]:
Do you want to configure IPv6? (y/n) [y]: n

Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]:

Enter an IPv4 address for the management interface [192.168.45.61]: 10.89.5.17
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.192
Enter the IPv4 default gateway for the management interface [data-interfaces]:

Enter a fully qualified hostname for this system [firepower]: 1010-3
Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220,2620:119:35::35]:
Enter a comma-separated list of search domains or 'none' []: cisco.com
If your networking information has changed, you will need to reconnect.
Disabling IPv6 configuration: management0
Setting DNS servers: 208.67.222.222,208.67.220.220,2620:119:35::35
Setting DNS domains:cisco.com

Setting hostname as 1010-3
Setting static IPv4: 10.89.5.17 netmask: 255.255.255.192 gateway: data on management0
Updating routing tables, please wait...
All configurations applied to the system. Took 3 Seconds.
Saving a copy of running network configuration to local disk.
For HTTP Proxy configuration, run 'configure network http-proxy'

Manage the device locally? (yes/no) [yes]: no

Setting hostname as 1010-3
Setting static IPv4: 10.89.5.17 netmask: 255.255.255.192 gateway: data on management0
Updating routing tables, please wait...
All configurations applied to the system. Took 3 Seconds.
Saving a copy of running network configuration to local disk.
For HTTP Proxy configuration, run 'configure network http-proxy'

Configuring firewall mode ...


Device is in OffBox mode - disabling/removing port 443 from iptables.
Update policy deployment information
    - add device configuration
    - add network discovery
    - add system policy

You can register the sensor to a Firepower Management Center and use the
Firepower Management Center to manage it. Note that registering the sensor
to a Firepower Management Center disables on-sensor Firepower Services
management capabilities.

When registering the sensor to a Firepower Management Center, a unique
alphanumeric registration key is always required.  In most cases, to register
a sensor to a Firepower Management Center, you must provide the hostname or
the IP address along with the registration key.
'configure manager add [hostname | ip address ] [registration key ]'

However, if the sensor and the Firepower Management Center are separated by a
NAT device, you must enter a unique NAT ID, along with the unique registration
key.
'configure manager add DONTRESOLVE [registration key ] [ NAT ID ]'

Later, using the web interface on the Firepower Management Center, you must
use the same registration key and, if necessary, the same NAT ID when you add
this sensor to the Firepower Management Center.
>

Step 3

Configure the outside interface for manager access.

> configure network management-data-interface
Data interface to use for management: ethernet1/1
Specify a name for the interface [outside]: internet
IP address (manual / dhcp) [dhcp]: manual
IPv4/IPv6 address: 10.10.6.7
Netmask/IPv6 Prefix: 255.255.255.0
Default Gateway: 10.10.6.1
Comma-separated list of DNS servers [none]: 208.67.222.222,208.67.220.220

DDNS server update URL [none]:
Do you wish to clear all the device configuration before applying ? (y/n) [n]:

Configuration done with option to allow manager access from any network, if you wish to change the manager access network
use the 'client' option in the command 'configure network management-data-interface'.

Setting IPv4 network configuration.
Network settings changed.

>

> configure network management-data-interface
Data interface to use for management: ethernet1/1
Specify a name for the interface [outside]:
IP address (manual / dhcp) [dhcp]:  
DDNS server update URL [none]: https://dwinchester:pa$$w0rd17@domains.example.com/nic/update?hostname=<h>&myip=<a>
Do you wish to clear all the device configuration before applying ? (y/n) [n]:

Configuration done with option to allow manager access from any network, if you wish to change the manager access network 
use the 'client' option in the command 'configure network management-data-interface'.

Setting IPv4 network configuration.
Network settings changed.

> 

Step 4

Identify the management center.

> configure manager add fmc-1.example.com regk3y78 natid56
Manager successfully configured.

Step 5

Shut down the threat defense so you can send the device to the remote branch office.

1. Enter the shutdown command.

2. Observe the Power LED and Status LED to verify that the chassis is powered off (appear unlit).

3. After the chassis has successfully powered off, you can then unplug the power to physically remove power from the chassis if necessary.

Step 1

The first time you add a device using a serial number, integrate the management center with Cisco Security Cloud.

1. Choose Integration > Cisco Security Cloud.

2. Click Enable Cisco Security Cloud to open a separate browser tab to log you into your Cisco Security Cloud account and confirm the displayed code.

   Make sure this page is not blocked by a pop-up blocker. If you do not already have a Cisco Security Cloud and CDO account, you can add one during this procedure.

   For detailed information about this integration, see .

   CDO onboards the on-prem management center after you integrate the management center with Cisco Security Cloud. CDO needs the management center in its inventory for zero-touch provisioning to operate. However, you do not need to use CDO directly. If you do use CDO, its management center support is limited to device onboarding, viewing its managed devices, viewing objects associated with the management center, and cross-launching the management center.

3. Make sure Enable Zero-Touch Provisioning is checked.

4. Click Save.

Step 2

Choose Devices > Device Management.

Step 3

From the Add drop-down menu, choose Device (Wizard).

Step 4

Click Use Serial Number, and then click Next.

Step 5

In a multi-domain environment, choose the Domain from the drop-down list and click Next.

Step 6

For the Initial device configuration, click the Basic radio button.

1. Choose an initial Access Control Policy to deploy to the device upon registration, or create a new policy.

   If the device is incompatible with the policy you choose, deploying will fail. This incompatibility could occur for multiple reasons, including licensing mismatches, model restrictions, passive vs inline issues, and other misconfigurations. After you resolve the issue that caused the failure, manually deploy configurations to the device.

2. Choose Smart licensing licenses to apply to the device.

   You can also apply licenses after you add the device, from the System > Licenses > Smart Licenses page.

3. Click Next.

Step 7

Configure the Device details.

1. Enter the Serial number.

2. Enter the Display name as you want it to display in the management center

3. (Optional) Choose the Device Group.

4. Set the device password.

   If this device is unconfigured or a fresh install, then you need to set a new password. If you already logged in and changed the password, then leave this field blank. Otherwise, registration will fail.

Step 8

Click Add Device.

Step 1

Log into the management center.

1. Enter the following URL.

   https://fmc_ip_address

2. Enter your username and password.

3. Click Log In.

Step 2

Choose Devices > Device Management.

Step 3

From the Add drop-down menu, choose Device (Wizard).

Step 4

Click Registration Key, and then click Next.

Step 5

In a multi-domain environment, choose the Domain from the drop-down list and click Next.

Step 6

Click Primary manager.

Step 7

For the Initial Device Configuration, click Basic.

1. Choose an initial Access Control Policy to deploy to the device at registration, or create a new policy. Unless you already have a customized policy you know you need to use, choose Create new policy, and choose Block all traffic. You can change this later to allow traffic; see Configure an Access Control Rule.

2. Choose Smart Licensing licenses to apply to the device.

   You can also apply licenses after you add the device, from the System > Licenses > Smart Licenses page, including the Secure Client remote access VPN license.

3. Click Next.

Step 8

Specify the Device details.

1. For the Host, enter the IP address or the hostname of the device you want to add. Leave this field blank if you don't know the device IP address (for example, it's behind NAT).

2. For the Display name, enter a name for the device as you want it to display in the management center. You cannot change this name later.

3. For the Registration Key, enter the same registration key from your initial configuration.

4. (Optional) Add the device to a Device group

5. For the Unique NAT ID, enter the same ID from your initial configuration.

6. Check Transfer Packets so that for each intrusion event, the device transfers the packet to the management center for inspection.

   For each intrusion event, the device sends event information and the packet that triggered the event to the management center for inspection. If you disable it, only event information will be sent to the management center; the packet will not be sent.

Step 9

Click Add Device.