Step 1

Prepare the template.

1. Clone the GitHub repository to your local folder. See https://github.com/CiscoDevNet/cisco-ftdv/tree/master/cluster/aws.

2. Modify infrastructure.yaml and deploy_ngfw_cluster.yaml with the required parameters.

3. Modify cluster/aws/lambda-python-files/Configuration.json with initial settings.

   For example:

   
   {
     "licenseCaps": ["BASE", "MALWARE", "THREAT"],
     "performanceTier": "FTDv50",
     "fmcIpforDeviceReg": "DONTRESOLVE",
     "RegistrationId": "cisco",
     "NatId": "cisco",
     "fmcAccessPolicyName": "AWS-ACL"
   }
   

   • Keep the fmcIpforDeviceReg setting as DONTRESOLVE.

   • The fmcAccessPolicyName needs to match an access policy on the Firewall Management Center.

   Note	FTDv5 and FTDv10 tiers are not supported.

4. Create a file named cluster_layer.zip to provide essential Python libraries to Lambda functions.

   We recommend to use the Amazon Linux with Python 3.9 installed to create the cluster_layer.zip file.

   Note	If you need an Amazon Linux environment, you can create an EC2 instance using Amazon Linux 2023 AMI or use AWS Cloudshell, which runs the latest version of Amazon Linux.

   For creating the cluster-layer.zip file, you need to first create requirements.txt file that consists of the python library package details and then run the shell script.

   1. Create the requirements.txt file by specifying the python package details.

      The following is the sample package details that you provide in the requirements.txt file:

      $ cat requirements.txt 
      pycryptodome
      paramiko
      requests
      scp
      jsonschema
      cffi
      zipp
      importlib-metadata

   2. Run the following shell script to create cluster_layer.zip file.

      $ pip3 install --platform manylinux2014_x86_64 
      --target=./python/lib/python3.9/site-packages 
      --implementation cp --python-version 3.9 --only-binary=:all: 
      --upgrade -r requirements.txt
      $ zip -r cluster_layer.zip ./python

   Note	If you encounter a dependency conflict error during installation, such as urllib3 or cryptography, it is recommended that you include the conflicting packages along with their recommended versions in the requirements.txt file. After that, you can run the installation again to resolve the conflict.

5. Copy the resulting cluster_layer.zip file to the lambda python files folder - cluster/aws/lambda-python-files.

6. Create the cluster_layer.zip, custom_metrics_publisher.zip, cluster_manger.zip and lifecycle_ftdv.zip files.

   A make.py file can be found in the cloned repository (cluster/aws/make.py). This will zip the python files into a Zip file and copy to a target folder.

   python3 make.py build

   Note	If you are using a private IP address for the Management Center Virtual registration, then make sure that you set USE_PUBLIC_IP_FOR_FMC_CONN to False in the cisco-ftdv/cluster/aws/lambda-python-files/constant.py file.

Step 2

Deploy infrastructure.yaml and note the output values for cluster deployment. Before deploying the infrastructure stack, it is important to identify the AWS region and the availability zones that will be used. Each AWS region has a different set of availability zones and VPC infrastructure, therefore it is essential to select the correct region and availability zones for your deployment.

1. On the AWS Console, go to CloudFormation and click Create stack; select With new resources(standard).

2. Select Upload a template file, click Choose file, and select infrastructure.yaml from the target folder.

3. Click Next and provide the required information.

   Parameter	Allowed Values/Type	Description
   ClusterName	String	Enter unique Cluster name.
   ClusterNumber	Number	Enter unique Cluster number.
   VpcCidr	String	Enter the CIDR block for a new VPC
   NoOfAZs	Number	Select 2 or 3 Availability Zones (AZs) for releases 7.6.0 and above; for lower releases, Select 1AZ. Management, Inside, Outside and CCL subnets will be distributed across the chosen AZs accordingly.
   ListOfAZs	List	Select Availability Zones (Count should match with Number of Availability Zones)
   MgmtSubnetNames	CommaDelimitedList	Management subnets name (With Internet GW as Route)
   MgmtSubnetCidrs	CommaDelimitedList	Management subnets Cidr list
   InsideSubnetNames	CommaDelimitedList	Inside subnets name (With Private Route)
   InsideSubnetCidrs	CommaDelimitedList	Inside subnets Cidr list
   CCLSubnetNames	CommaDelimitedList	Enter CCL subnet name
   CCLSubnetCidrs	CommaDelimitedList	Enter CCL subnet CIDR
   LambdaAZs	List	Select 2 Availability Zones for Lambda
   LambdaSubnetNames	CommaDelimitedList	Enter Lambda Subnets name (With NAT GW as Route), for Lambda Functions
   LambdaSubnetCidrs	CommaDelimitedList	Enter Lambda Subnet CIDRs

4. Enter a unique Cluster Name and Cluster Number for the cluster.

5. Select the availability zone from the Availability Zone list. This field lists only availability zones based on the AWS region that you select for deploying the infrastructure stack using the ClusterFormation template.

6. Click Next, then Create stack.

7. After the deployment is complete, go to Outputs and note the S3 BucketName.

Step 3

Upload cluster_layer.zip, cluster_manager.zip, custom_metrics_publisher.zip, and cluster_lifecycle.zip to the S3 bucket created by infrastructure.yaml.

Note	Make sure that the Elastic IP address of the Lambda NAT Gateway is added to the security group associated with the Management Center Virtual.

Step 4

Deploy deploy_ngfw_cluster.yaml.

1. Go to CloudFormation and click on Create stack; select With new resources(standard).

2. Select Upload a template file, click Choose file, and select deploy_ngfw_cluster.yaml from the target folder.

3. Click Next and provide the required information.

4. Provide the following cluster and infrastructure configuration information.

   Parameter	Allowed Values/Type	Description
   Cluster Configuration
   ClusterGrpNamePrefix	String	This is the cluster name Prefix. The cluster number will be added as a suffix.
   ClusterNumber	String	This is the cluster number. This will be suffixed to the cluster name (msa-ftdv-infra). For example, if this value is 1, the group name will be msa-ftdv-infra-1. It should be at least 1 digit, but not more than 3 digits. Default: 1.
   ClusterSize	Numbers	This is the total number of Firewall Threat Defense Virtual nodes in a cluster. Minimum: 1 Maximum:16
   Infrastructure Details
   NoOfAZs	String	This is the total number of availability zones into which Firewall Threat Defense Virtual is deployed. (The number of availability zones varies from a Minimum 1 to Maximum 3 depending on a region). The subnet will be created in these availability zones. The availability zones available in this list is based on the region selected for deploying the cluster. Note   Management, Inside, and Cluster Control Link (CCL) subnets are created across three availability zones based on this parameters.
   AZ	String	The availability zone list is based on the region you plan to deploy. In Availability Zone list, select the valid availability zone (1 availability zone or 2 availability zones or 3 availability zones). Count should match with the value of Number of Availability Zones parameter.
   NotifyEmailID	String	Email address to which cluster events email will be sent. You must accept a subscription email request to receive this email notification. Example: admin@company.com
   VpcId	String	The VPC ID for the cluster group. Type: AWS::EC2::VPC::Id
   S3BktName	String	The S3 Bucket that contains the uploaded Lambda zip files. You must specify correct bucket name.
   MgmtSubnetIds	List	Enter only one subnet per availability zone. If you select multiple subnets from a same availability zone, then selecting an incorrect subnet may cause issues while deploying the Firewall Threat Defense Virtual instances. Type: List<AWS::EC2::Subnet::Id>
   InsideSubnetIds	List	Enter at least one subnet per availability zone. If multiple subnets from the same Availability Zone are selected, then selecting an incorrect subnet may cause issues while deploying the Firewall Threat Defense Virtual instances. Type: List<AWS::EC2::Subnet::Id>
   LambdaSubnets	List	Enter at least two subnet for the Lambda functions. The two subnets you enter must have a NAT gateway to enable the Lambda functions to communicate with AWS services, which are public DNS. Type: List<AWS::EC2::Subnet::Id>
   CCLSubnetIds	String	Enter at least one subnet per availability zone. If multiple subnets from the same Availability Zone are selected, then selecting an incorrect subnet may cause issues while deploying the Firewall Threat Defense Virtual instances. Type: List<AWS::EC2::Subnet::Id>
   CCLSubnetRanges	String	Enter IP addresses range of CCL subnets for different availability zones. Exclude first 4 reserved IP addresses. IP address pool for Cluster Control Link (CCL). IP address is allocated to the CCL interfaces of the Firewall Threat Defense Virtual instance from CCL IP address pool.
   MgmtInterfaceSG	List	Select security group ID for the Firewall Threat Defense Virtual instances. Type: List<AWS::EC2::SecurityGroup::Id>
   InsideInterfaceSG	List	Select security group ID for the inside interface of Firewall Threat Defense Virtual instances. Type: List<AWS::EC2::SecurityGroup::Id>
   LambdaSG	List	Select a security group for the Lambda functions. Ensure outbound connections is set to ANYWHERE. Type: List<AWS::EC2::SecurityGroup::Id>
   CCLInterfaceSG	List	Select a security group ID for CCL interface of the Firewall Threat Defense Virtual instances.
   GWLB Configuration
   DeployGWLBE	String	Click Yes to deploy the GWLB endpoint. By default, the value is set to No.
   VpcIdLBE	String	Enter VPC to deploy Gateway Load Balancer Endpoint. Note   Do not enter any value in this field if you are not deploying the GWLB endpoint.
   GWLBESubnetId	String	Enter only one subnet ID. Note   Do not enter any value in this field if you are not deploying the GWLB endpoint. Ensure that the subnet belongs to the correct VPC, and the availability zones that you have specified.
   TargetFailover	String	Enable Target Failover support when a target fails or deregisters. (By default, the value of this parameter is set to rebalance). no_rebalance: Directs existing flows to failed targets and new flows to healthy targets, ensuring backward compatibility. rebalance: Redistributes existing flows while ensuring that new flows go to healthy targets. rebalance is supported from Firewall Threat Defense Virtual Version 7.4.1 and later.
   TgHealthPort	String	Enter Health Check Port for GWLB. Note   By default, this port must not be used for traffic. Ensure the value you provide is a valid TCP port. Default: 8080
   Cisco NGFWv Instance Configuration
   InstanceType	String	Cisco Firewall Threat Defense Virtual EC2 instance type. Ensure that the AWS Region supports Instance Type you select. By default, c5.xlarge is selected.
   LicenseType	String	Choose Cisco Firewall Threat Defense Virtual EC2 instance license type. Ensure that the AMI ID that you enter in AMI-ID parameter is of the same licensing type. By default, BYOL is selected.
   AssignPublicIP	String	Set the value as true to assign a public IP address for Firewall Threat Defense Virtual from the AWS IP address pool.
   AmiID	String	Choose the correct AMI ID as per the region, version, and license type (BYOL or PAYG). Firewall Threat Defense Virtual 7.2 and later support clustering, and Firewall Threat Defense Virtual Version 7.6 and later support the autoscaling and multiple availability zone enhancements. Type: AWS::EC2::Image::Id
   ngfwPassword	String	Firewall Threat Defense Virtual instance password. All Firewall Threat Defense Virtual instances come up with a default password, which is in the Userdata field of the Launch Template (Cluster Group). The password is activated after Firewall Threat Defense Virtual is accessible. Minimum length must be 8 characters. The password can either be a plain text password or a KMS encrypted password.
   KmsArn	String	Enter ARN of an existing KMS (AWS KMS key to encrypt at rest). If you specify a value in this field, then the Firewall Threat Defense Virtual instance's admin password must be an encrypted password. Example of generating an encrypted password: "aws kms encrypt --key-id <KMS ARN> --plaintext <password> " The password encryption must be done using only the specified ARN.
   FMC Automation Configuration
   fmcDeviceGrpName	String	Enter a unique name for the cluster group in management center.
   fmcPublishMetrics	String	Select true to create a Lambda Function to poll management center and publish specific device group metrics to AWS CloudWatch. Allowed values: true false By default, the value is set to true.
   fmcMetricsUsername	String	Enter a unique internal user name for polling memory metrics from management center. The user must have privileges of Network Admin and Maintenance User or more .
   fmcMetricsPassword	String	Enter the password. If you have mentioned KMS Master Key ARN parameter, ensure to provide an encrypted password. Ensure to enter the correct password because entering incorrect password may result in failure of metrics collection.
   fmcServer	String	The IP address can be an external IP address or the IP address reachable in Firewall Threat Defense Virtual management subnet in the VPC. Minimum length: 7 Maximum length:15
   fmcOperationsUsername	String	Provide a unique internal user name for Firewall Management Center Virtual for CloudWatch. The user must have Administrator privileges.
   fmcOperationsPassword	String	Enter the password. If you have mentioned KMS Master Key ARN parameter, ensure to provide an encrypted password.
   Scaling Configuration
   CpuThresholds	CommaDelimitedList	(Optional) Specifying non-zero lower and upper thresholds will create scale policies. If (0,0) is selected, no CPU scaling alarm or policies will be created. Evaluation points and data points are at default or recommended values. By default, Autoscale is enabled in this template. Autoscale can be disabled after deployment.
   MemoryThresholds	CommaDelimitedList	Specifying non-zero lower and upper threshold will create scale policies. If (0,0) is selected, no memory scaling alarm or policies will be created. Evaluation points and data points are at default or recommended values.

5. Click Next.

6. Click to acknowledge all the AWS CloudFormation options.

7. Click Submit to deploy the cluster.

8. Click Next, then Create stack.

   The Lambda functions manage the rest of the process, and the Firewall Threat Defense Virtuals will automatically register with the Firewall Management Center.

Step 5

Verify the cluster deployment by logging into any one of the nodes and using the show cluster info command.

Step 1

On the AWS Console, go to Services > EC2

Step 2

Click Target Groups to view the target groups page.

Step 3

Select the target group to which the Firewall Threat Defense Virtual data interface IPs are registered. The target group details page is displayed, where you can enable the Target failover attributes.

Step 4

Go to the Attributes menu.

Step 5

Click Edit to edit the attributes.

Step 6

Toggle the Rebalance flows slider button to the right to enable target failover to configure GWLB to rebalance and forward the existing network packets to a healthy target node in the event of target failover or deregistration.

Step 1

Prepare the template.

1. Clone the github repository to your local folder. See https://github.com/CiscoDevNet/cisco-ftdv/tree/master/cluster/azure.

2. Modify azure_ftdv_gwlb_cluster.json and azure_ftdv_gwlb_cluster_parameters.json with the required parameters.

   OR

   Modify withoutDiagnostic templates, azure_withoutDiagnostic_ftdv_gwlb_cluster_parameters.json and azure_withoutDiagnostic_ftdv_gwlb_cluster.json, with the required parameter for deploying cluster without the diagnostic interface.

Step 2

Log into the Azure Portal: https://portal.azure.com.

Step 3

Create a Resource Group.

1. In the Basics tab, choose the Subscription and Resource Group from the drop-down lists.

2. Choose the required Region.

Step 4

Create a virtual network with 4 subnets: Management, Diagnostic, Outside, and Cluster Control Link (CCL).

1. Create the virtual network.

   1. In the Basics tab, choose the Subscription and Resource Group from the drop-down lists.

   2. Choose the required Region. Click Next: IP addresses.

   In the IP Addresses tab, click Add subnet and add the following subnets – Management, Diagnostic, Data, and Cluster Control Link.

   If you are deploying the Firewall Threat Defense Virtual 7.4.1 cluster without a Diagnostic interface, then you must skip the Diagnostic subnet creation.

2. Add the subnets.

Step 5

Deploy the custom template.

1. Click Create > Template deployment (deploy using custom templates).

2. Click Build your own template in the editor.

3. Click Load File, and upload azure_ftdv_gwlb_cluster.json or azure_withoutDiagnostic_ftdv_gwlb_cluster.json, if you have opted for without diagnostic interface deployment.

4. Click Save.

Step 6

Configure the Instance details.

1. Enter the required values and then click Review + create.

2. Click Create after the validation is passed.

Step 7

After the instance is running, verify the cluster deployment by logging into any one of the nodes and entering the show cluster info command.

Step 8

In the Azure Portal, click the Function app to register the cluster with the Firewall Management Center.

Step 9

Create FTPS Credentials by clicking Deployment Center > FTPS credentials > User scope > Configure Username and Password, and then click Save.

Step 10

Upload the Cluster_Function.zip file to the Function app by executing the following curl command in the local terminal.

curl -X POST -u username --data-binary @"Cluster_Function.zip" https:// Function_App_Name.scm.azurewebsites.net/api/zipdeploy

Note	The curl command might take few minutes (~2 to 3 minutes) to complete command execution.

The function will be uploaded to the Function app. The function will start, and you can see the logs in the storage account’s outqueue. The device registration with the Management Center will be initiated.

Step 1

Prepare the template.

1. Clone the github repository to your local folder. See https://github.com/CiscoDevNet/cisco-ftdv/tree/master/cluster/azure.

2. Modify azure_ftdv_nlb_cluster.json and azure_ftdv_nlb_cluster_parameters.json with the required parameters.

   Modify withoutDiagnostic templates, azure_withoutDiagnostic_ftdv_nlb_cluster_parameters.json and azure_withoutDiagnostic_ftdv_nlb_cluster.json, with the required parameter for deploying cluster without the diagnostic interface.

Step 2

Log into the Azure Portal: https://portal.azure.com.

Step 3

Create a Resource Group.

1. In the Basics tab, choose the Subscription and Resource Group from the drop-down lists.

2. Choose the required Region.

Step 4

Create a virtual network with 5 subnets: Management, Diagnostic, Inside, Outside, and Cluster Control Link.

1. Create the virtual network.

   1. In the Basics tab, choose the Subscription and Resource Group from the drop-down lists.

   2. b) Choose the required Region. Click Next: IP addresses.

2. Add the subnets.

   In the IP Addresses tab, click Add subnet and add the following subnets – Management, Diagnostic, Inside, Outside, and Cluster Control Link.

   If you are deploying the Firewall Threat Defense Virtual 7.4.1 cluster without a Diagnostic interface, then you must skip the Diagnostic subnet creation.

Step 5

Deploy the custom template.

1. Click Create > Template deployment (deploy using custom templates).

2. Click Build your own template in the editor.

3. Click Load File, and upload azure_ftdv_nlb_cluster.json or azure_withoutDiagnostic_ftdv_nlb_cluster.json, if you have opted for without diagnostic interface deployment.

4. Click Save.

Step 6

Configure the instance details.

1. Enter the required values and then click Review + create.

   Note	For the cluster control link starting and ending addresses, specify only as many addresses as you need (up to 16). A larger range can affect performance.

2. Click Create after the validation is passed.

Step 7

After the instance is running, verify the cluster deployment by logging into any one of the nodes and using the show cluster info command.

Step 8

In the Azure Portal, click the Function app to register the cluster to the Firewall Management Center.

Step 9

Create FTPS Credentials by clicking Deployment Center > FTPS credentials > User scope > Configure Username and Password, and then click Save.

Step 10

Upload the Cluster_Function.zip file to the Function app by executing the following curl command in the local terminal.

Step 1

Download the templates from GitHub to your local folder.

Step 2

Edit infrastructure.yaml , cluster_function_infra.yaml and deploy_ngfw_cluster.yaml with the required resourceNamePrefix parameter (for example, ngfwvcls) and other required user inputs.

Step 3

Create a bucket using Google Cloud Shell to upload the Google cloud function source archive file ftdv_cluster_function.zip.

Step 4

Create an archive file for the cluster infrastructure.

zip -j ftdv_cluster_function.zip ./cluster-function/*

Step 5

Upload the Google source archive that you created earlier.

Step 6

Deploy infrastructure for the cluster.

Step 7

If you are using private IP addresses, perform the steps given below:

1. Launch and set up the Management Center Virtual with a Threat Defense Virtual management VPC.

2. Create a VPC connector to connect the Google Cloud functions with the Threat Defense Virtual management VPC.

   gcloud compute networks vpc-access connectors create vpc-connector-name --region us-central1 --subnet resourceNamePrefix-ftdv-mgmt-subnet28

Step 8

If the Management Center is remote from the Threat Defense Virtual, and the Threat Defense Virtual needs an external IP address, ensure that you set deployWithExternalIP to True in cluster_function_infra.yaml.

Step 9

Deploy the cluster function infrastructure.

Step 10

Deploy the cluster.

Step 1

For the unit you want to disable, choose Devices > Device Management, click the More (), and choose Disable Node Clustering.

Step 2

Confirm that you want to disable clustering on the node.

Step 3

To reenable clustering, see Rejoin the Cluster.

Step 1

For the unit you want to reactivate, choose Devices > Device Management, click the More (), and choose Enable Node Clustering.

Step 2

Confirm that you want to enable clustering on the node.

Step 1

Choose Devices > Device Management More () for the cluster, and then choose Cluster Live Status to open the Cluster Status dialog box.

Step 2

Click Reconcile All.

For more information about the cluster status, see Monitoring the Cluster.

Step 1

Choose Devices > Device Management, click More () for the cluster or node, and choose Unregister.

Step 2

You are prompted to unregister the cluster or node; click Yes.

Step 3

You can register the cluster to a new (or the same) Firewall Management Center by adding one of the cluster members as a new device.

1. Connect to one cluster node's CLI, and identify the new Firewall Management Center using the configure manager add command.

2. Choose Devices > Device Management, and then click Add Device.

Step 4

To re-add a deleted node, see Reconcile Cluster Nodes.