Step 1

Choose Administration > Integrations > Firewall Management Center.

Step 2

Select Cloud-Delivered FMC and click the links in the Actions, Management, or Settings pane to open the Cloud-Delivered Firewall Management Center in a new tab.

Step 1

Choose Devices > Device Management, and click Edit () for the firewall.

Step 2

Click Interfaces.

Step 3

To create breakout ports from a 40-Gb or larger interface, click the Break icon for the interface.

Step 4

Click Edit () for the interface that you want to use for inside.

1. From the Security Zone drop-down list, choose an existing inside security zone or add a new one by clicking New.

   For example, add a zone called inside_zone. You apply your security policy based on zones or groups. For example, configure your access control policy to enable traffic to go from the inside zone to the outside zone, but not from outside to inside.

2. Enter a Name up to 48 characters in length.

   For example, name the interface inside.

3. Check the Enabled check box.

4. Leave the Mode set to None.

5. Click the IPv4 and/or IPv6 tab.

   • IPv4—Choose Use Static IP from the drop-down list, and enter an IP address and subnet mask in slash notation.

     For example, enter 192.168.1.1/24

     

   • IPv6—Check the Autoconfiguration check box for stateless autoconfiguration.

     

6. Click OK.

Step 5

Click Edit () for the interface that you want to use for outside.

1. From the Security Zone drop-down list, choose an existing outside security zone or add a new one by clicking New.

   For example, add a zone called outside_zone.

   You should not alter any other basic settings because doing so will disrupt the Firewall Management Center management connection.

2. Click OK.

Step 6

Configure a DMZ interface to host a web server, for example.

1. Click Edit () for the interface you want to use.

2. From the Security Zone drop-down list, choose an existing DMZ security zone or add a new one by clicking New.

   For example, add a zone called dmz_zone.

3. Enter a Name up to 48 characters in length.

   For example, name the interface dmz.

4. Check the Enabled check box.

5. Leave the Mode set to None.

6. Click the IPv4 and/or IPv6 tab and configure the IP address as desired.

7. Click OK.

Step 7

Click Save.

Step 1

Choose Devices > Device Management, and click Edit () for the device.

Step 2

Choose DHCP > DHCP Server.

Step 3

In the Server area, click Add and configure the following options.

• Interface—Choose the interface name from the drop-down list.

• Address Pool—Set the range of IP addresses. The IP addresses must be on the same subnet as the selected interface and cannot include the IP address of the interface itself.

• Enable DHCP Server—Enable the DHCP server on the selected interface.

Step 4

Click OK.

Step 5

Click Save.

Step 1

Choose Devices > NAT, and click New Policy.

Step 2

Name the policy, select the devices that you want to use the policy, and click Save.

The policy is added the Firewall Management Center. You still have to add rules to the policy.

Step 3

Click Add Rule.

Step 4

Configure the basic rule options:

• NAT Rule—Choose Auto NAT Rule.

• Type—Choose Dynamic.

Step 5

On the Interface Objects page, add the outside zone from the Available Interface Objects area to the Destination Interface Objects area.

Step 6

On the Translation page, configure the following options:

• Original Source—Click Add () to add a network object for all IPv4 traffic (0.0.0.0/0).

  

  Note	You cannot use the system-defined any-ipv4 object, because Auto NAT rules add NAT as part of the object definition, and you cannot edit system-defined objects.

• Translated Source—Choose Destination Interface IP.

Step 7

Click Save to add the rule.

Step 8

Click Save on the NAT page to save your changes.

Step 1

Choose Policies > Access Control heading > Access Control, and click Edit () for the access control policy assigned to the device.

Step 2

Click Add Rule, and set the following parameters.

1. Name this rule, for example, inside-to-outside.

2. Select the inside zone from Zones

3. Click Add Source Zone.

4. Select the outside zone from Zones.

5. Click Add Destination Zone.

Leave the other settings as is.

Step 3

(Optional) Customize associated policies by clicking on the policy type in the packet flow diagram.

Prefilter, Decryption, Security Intelligence, and Identity policies are applied before an access control rule. Customizing these policies is not required, but after you know your network's needs, they let you improve network performance by either fastpathing trusted traffic (bypassing processing) or blocking traffic so no further processing is required.

• Prefilter Rules—The Default Prefilter Policy passes all traffic for the other rules to act on (analyzes). The only change to the default policy you can make is to block tunnel traffic. Otherwise, you can create a new prefilter policy to associate with the access control policy that can analyze (pass on), fastpath (bypass further checks) or block.

  Prefiltering lets you improve performance by dealing with traffic before it gets any further, by either blocking or fastpathing. In a new policy, you can add tunnel rules and prefilter rules. A tunnel rule lets you fastpath, block, or rezone plaintext (non-encrypted), passthrough tunnels. A prefilter rule lets you fastpath or block non-tunneled traffic identified by IP address, port, and protocol.

  For example, if you know you want to block all FTP traffic on your network, but fastpath SSH traffic from an administrator, you can add a new prefilter policy.

• Decryption—Decryption is not applied by default. Decryption is a way to expose network traffic to deep inspection. In most cases, you don't want to decrypt traffic, and can only do so if it is legally allowed. For maximum network protection, a decryption policy might be a good idea for traffic going to critical servers or coming from untrusted network segments.

• Security Intelligence—(Requires the IPS license) Security Intelligence is enabled by default. Security Intelligence is another early defense against malicious activity applied before passing connections to the access control policy for further processing. Security Intelligence uses reputation intelligence to quickly block connections to or from IP addresses, URLs, and domain names provided by Talos, the threat intelligence organization at Cisco. You can add or delete additional IP addresses, URLs, or domains if desired.

  Note	If you do not have the IPS license, this policy will not be deployed even though it shows in your access control policy as enabled.

• Identity—Identity is not applied by default. You can require a user to authenticate before allowing traffic to be processed by the access control policy.

Step 4

(Optional) Add an Intrusion policy that is applied after the access control rule.

1. Click the Intrusion Policy drop-down list.

   

2. Choose one of the system-provided policies from the list.

Step 5

(Optional) Add a File policy that is applied after the access control rule.

1. Click the File Policy drop-down list and choose either an existing policy or add one by choosing the Open File Policy List.

   

   For a new policy, the Policies > Access Control heading > Malware & File page opens in a separate tab.

2. See the Cisco Secure Firewall Device Manager Configuration Guide for details on creating the policy.

3. Return to the Add Rule page and select the newly created policy from the drop-down list.

Step 6

Click Apply.

Step 7

Click Save.

Step 1

Choose Devices > Platform Settings and create or edit the Firewall Threat Defense policy.

Step 2

Select SSH Access.

Step 3

Identify the outside interface and IP addresses that allow SSH connections.

1. Click Add to add a new rule, or click Edit to edit an existing rule.

2. Configure the rule properties:

   • IP Address—The network object or group that identifies the hosts or networks you are allowing to make SSH connections. Choose an object from the drop-down menu, or click + to add a new network object.

   • Available Zones/Interfaces—Add the outside zone or type the outside interface name into the field below the Selected Zones/Interfaces list and click Add.

   

3. Click OK.

Step 4

Click Save.

Step 1

Click Deploy in the upper right.

Step 2

For a quick deployment, check specific devices and then click Deploy.

Or click Deploy All to deploy to all devices.

Otherwise, for additional deployment options, click Advanced Deploy.

Step 3

Ensure that the deployment succeeds. Click the icon to the right of the Deploy button in the menu bar to see status for deployments.