Cable and Register the Firewall
Cable the firewall
Perform Initial Configuration
Register the firewall with the Firewall Management Center

Cable and Register the Firewall

Cable the firewall and then register the firewall to the Firewall Management Center.

Cable the firewall

Connect the Firewall Management Center to the dedicated Management 1/1 interface. The management network needs access to the internet for updates. For example, you can connect the management network to the internet through the firewall itself (for example, by connecting to the inside network).

Obtain a console cable—The firewall does not ship with a console cable by default, so you will need to buy a third-party USB-to-RJ-45 serial cable, for example.
Install an SFP into Management 1/1—It is a 1/10/25-Gbps SFP28 port that requires an SFP/SFP+/SFP28 module.
Install SFPs into the data interface ports—Ethernet 1/1 to 1/12 fixed ports are 1/10/25/50-Gbps SFP28 ports that require SFP/SFP+/SFP28 modules; Ethernet 1/13 through 1/16 are 1/10/25/50-Gbps QSFP28 ports that require SFP/SFP+/QSFP+/SFP28/QSFP28 modules.
See the hardware installation guide for more information.

Perform Initial Configuration

Set the dedicated Management IP address, gateway, and other basic networking settings using the CLI setup script.

Procedure

Step 1

Connect to the console port and access the Firewall Threat Defense CLI. See Access the Firewall Threat Defense CLI.

Step 2

Complete the CLI setup script for the Management interface settings.

Note

You cannot repeat the CLI setup script unless you clear the configuration, for example, by reimaging. However, all of these settings can be changed later at the CLI using configure network commands. See Cisco Secure Firewall Threat Defense Command Reference.


You must accept the EULA to continue.
Press <ENTER> to display the EULA:                 
Cisco General Terms
[...]

Please enter 'YES' or press <ENTER> to AGREE to the EULA:

System initialization in progress.  Please stand by.
You must configure the network to continue.
Configure at least one of IPv4 or IPv6 unless managing via data interfaces.
Do you want to configure IPv4? (y/n) [y]:
Do you want to configure IPv6? (y/n) [y]: n

Guidance: Enter y for at least one of these types of addresses.

Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]:

Enter an IPv4 address for the management interface [192.168.45.61]: 10.89.5.17
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.192

Enter the IPv4 default gateway for the management interface [data-interfaces]: 10.10.10.1

Enter a fully qualified hostname for this system [firepower]: 1010-3
Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220,2620:119:35::35]:
Enter a comma-separated list of search domains or 'none' []: cisco.com
If your networking information has changed, you will need to reconnect.
Disabling IPv6 configuration: management0
Setting DNS servers: 208.67.222.222,208.67.220.220,2620:119:35::35
Setting DNS domains:cisco.com

Setting hostname as 1010-3
Setting static IPv4: 10.89.5.17 netmask: 255.255.255.192 gateway: data on management0
Updating routing tables, please wait...
All configurations applied to the system. Took 3 Seconds.
Saving a copy of running network configuration to local disk.
For HTTP Proxy configuration, run 'configure network http-proxy'

Setting hostname as 1010-3
Setting static IPv4: 10.89.5.17 netmask: 255.255.255.192 gateway: data on management0
Updating routing tables, please wait...
All configurations applied to the system. Took 3 Seconds.
Saving a copy of running network configuration to local disk.
For HTTP Proxy configuration, run 'configure network http-proxy'

Configuring firewall mode ...


Device is in OffBox mode - disabling/removing port 443 from iptables.
Update policy deployment information
    - add device configuration
    - add network discovery
    - add system policy

You can register the sensor to a Firepower Management Center and use the
Firepower Management Center to manage it. Note that registering the sensor
to a Firepower Management Center disables on-sensor Firepower Services
management capabilities.

When registering the sensor to a Firepower Management Center, a unique
alphanumeric registration key is always required.  In most cases, to register
a sensor to a Firepower Management Center, you must provide the hostname or
the IP address along with the registration key.
'configure manager add [hostname | ip address ] [registration key ]'

However, if the sensor and the Firepower Management Center are separated by a
NAT device, you must enter a unique NAT ID, along with the unique registration
key.
'configure manager add DONTRESOLVE [registration key ] [ NAT ID ]'

Later, using the web interface on the Firepower Management Center, you must
use the same registration key and, if necessary, the same NAT ID when you add
this sensor to the Firepower Management Center.
>

Step 3

Identify the Firewall Management Center.

configure manager add {hostname | IPv4_address | IPv6_address | DONTRESOLVE} reg_key nat_id

{hostname | IPv4_address | IPv6_address | DONTRESOLVE}—Specifies either the FQDN or IP address of the Firewall Management Center. If the Firewall Management Center is not directly addressable, use DONTRESOLVE, in which case the firewall must have a reachable IP address or hostname.
reg_key—Specifies a one-time registration key of your choice that you will also specify on the Firewall Management Center when you register the Firewall Threat Defense. The registration key must be between 2 and 36 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-).
nat_id—Specifies a unique, one-time string of your choice that you will also specify on the Firewall Management Center. The NAT ID must be between 2 and 36 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-). This ID cannot be used for any other devices registering to the Firewall Management Center.

Example:


> configure manager add fmc-1.example.com regk3y78 natid56
Manager successfully configured.

Register the firewall with the Firewall Management Center

Procedure

Step 1	Log into the Firewall Management Center. Enter the following URL. https://`fmc_ip_address` Enter your username and password. Click Log In.
Step 2	Choose Devices > Device Management.
Step 3	From the Add drop-down menu, choose Device.
Step 4	Click Registration Key, click Basic, and then click Next. Figure 1. Device Registration Method
Step 5	Configure the device details and click Next. Figure 2. Device Details Domain—In a multidomain environment, choose the leaf domain. Device group—In a single domain environment, add the device to a Device group. Hostname or IP address—Enter the IP address or the hostname of the device you want to add. Leave this field blank if you don't know the device IP address (for example, it's behind NAT). Display name—Enter a name for the device as you want it to display in the Firewall Management Center. You cannot change this name later. Registration key—Enter the same registration key from your initial configuration. Unique NAT ID—Enter the same ID from your initial configuration. Analytics-only management center—Leave this unchecked.
Step 6	Configure the initial device configuration. Figure 3. Initial Device Configuration Access control policy—Choose an initial policy to deploy to the device at registration, or create a new policy. Unless you already have a customized policy you know you need to use, choose Add (), and choose Block all traffic. You can change this later to allow traffic. Smart licensing—Choose your licenses. Is this device physical or virtual?—Choose Physical device License type—Check each license type to assign to the device. You can also apply licenses after you add the device. Transfer packets—Enable this option so that for each intrusion event, the device transfers the packet to the Firewall Management Center for inspection. For each intrusion event, the device sends event information and the packet that triggered the event to the Firewall Management Center for inspection. If you disable it, only event information will be sent to the Firewall Management Center; the packet will not be sent.
Step 7	Click Add device. It may take up to two minutes for the Firewall Management Center to verify the device’s heartbeat and establish communication. If the registration succeeds, the device is added to the list. If it fails, you will see an error message. If the device fails to register, check the following items: Ping—Access the device CLI, and ping the Firewall Management Center IP address using the following command: ping system `ip_address` If the ping is not successful, check your network settings using the show network command. If you need to change the device IP address, use the configure network {ipv4 \| ipv6} manual command. Registration key, NAT ID, and Firewall Management Center IP address—Make sure you are using the same registration key, and if used, NAT ID, on both devices. You can set the registration key and NAT ID on the device using the configure manager add command. For more troubleshooting information, see https://cisco.com/go/fmc-reg-error.