Cisco Firepower 2100 User manual

Cisco Firepower 2100 Getting Started Guide
First Published: 2019-09-25
Last Modified: 2021-05-26
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

CHAPTER 1
Which Operating System and Manager is Right
for You?
Your hardware platform can run one of two operating systems. For each operating system, you have a choice
of managers. This chapter explains the operating system and manager choices.
•Operating Systems, on page 1
•Managers, on page 1
Operating Systems
You can use either ASA or Firepower Threat Defense (FTD) operating systems on your hardware platform:
• ASA—The ASA is a traditional, advanced stateful firewall and VPN concentrator.
You may want to use the ASA if you do not need the advanced capabilities of the FTD, or if you need
an ASA-only feature that is not yet available on the FTD. Cisco provides ASA-to-FTD migration tools
to help you convert your ASA to an FTD if you start with ASA and later reimage to FTD.
• FTD—FTD, also known as Firepower NGFW, is a next-generation firewall that combines an advanced
stateful firewall, VPN concentrator, and next generation IPS. In other words, the FTD takes the best of
ASA functionality and combines it with the best next-generation firewall and IPS functionality.
We recommend using the FTD over the ASA because it contains most of the major functionality of the
ASA, plus additional next generation firewall and IPS functionality.
To reimage between the ASA and the FTD, see Reimage the Cisco ASA or Firepower Threat Defense Device.
Managers
The FTD and ASA support multiple managers.
Cisco Firepower 2100 Getting Started Guide
1

FTD Managers
Table 1: FTD Managers
DescriptionManager
FDM is a web-based, simplified, on-device manager. Because it is simplified, some
FTD features are not supported using FDM. You should use FDM if you are only
managing a small number of devices and don't need a multi-device manager.
Both FDM and CDO can discover the configuration on the firewall, so you
can use FDM and CDO to manage the same firewall. FMC is not compatible
with other managers.
Note
To get started with FDM, see Firepower Threat Defense Deployment with FDM, on
page 5.
Firepower Device Manager (FDM)
CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some
FTD features are not supported using CDO. You should use CDO if you want a
multi-device manager that offers a simplified management experience (similar to FDM).
And because CDO is cloud-based, there is no overhead of running CDO on your own
servers. CDO also manages other security devices, such as ASAs, so you can use a
single manager for all of your security devices.
In 6.7 and later, CDO offers Low Touch Provisioning that lets branch offices plug in
their hardware and leave it alone: the firewall will automtically register with CDO.
Both FDM and CDO can discover the configuration on the firewall, so you
can use FDM and CDO to manage the same firewall. FMC is not compatible
with other managers.
Note
To get started with CDO low-touch provisioning, see Firepower Threat Defense
Deployment with CDO and Low-Touch Provisioning, on page 107.
To get started with CDO provisioning, see Firepower Threat Defense Deployment with
CDO, on page 125.
Cisco Defense Orchestrator (CDO)
FMC is a powerful, web-based, multi-device manager that runs on its own server
hardware, or as a virtual device on a hypervisor. You should use FMC if you want a
multi-device manager, and you require all features on the FTD. FMC also provides
powerful analysis and monitoring of traffic and events.
In 6.7 and later, FMC can manage FTDs from the outside (or other data) interface instead
of from the standard Management interface. This feature is useful for remote branch
deployments.
FMC is not compatible with other managers because the FMC owns the FTD
configuration, and you are not allowed to configure the FTD directly,
bypassing the FMC.
Note
To get started with FMC on the Management network, see Firepower Threat Defense
Deployment with FMC, on page 29.
To get started with FMC on a remote network, see Firepower Threat Defense Deployment
with a Remote FMC, on page 63.
Firepower Management Center (FMC)
Cisco Firepower 2100 Getting Started Guide
2
Which Operating System and Manager is Right for You?
FTD Managers

DescriptionManager
The FTD REST API lets you automate direct configuration of the FTD. This API is
compatible with FDM and CDO use because they can both discover the configuration
on the firewall. You cannot use this API if you are managing the FTD using FMC.
The FTD REST API is not covered in this guide. For more information, see the FTD
REST API guide.
FTD REST API
The FMC REST API lets you automate configuration of FMC policies that can then be
applied to managed FTDs. This API does not manage an FTD directly.
The FMC REST API is not covered in this guide. For more information, see the FMC
REST API guide.
FMC REST API
ASA Managers
Table 2: ASA Managers
DescriptionManager
ASDM is a Java-based, on-device manager that provides full ASA functionality. You
should use ASDM if you prefer using a GUI over the CLI, and you only need to manage
a small number of ASAs. ASDM can discover the configuration on the firewall, so you
can also use the CLI, CDO, or CSM with ASDM.
To get started with ASDM, see ASA Appliance Mode Deployment with ASDM, on
page 165. If you know you want to use the ASA in Platform mode, see ASA Platform
Mode Deployment with ASDM and Firepower Chassis Manager, on page 185
Adaptive Security Device Manager
(ASDM)
You should use the ASA CLI if you prefer CLIs over GUIs.
The CLI is not covered in this guide. For more information, see the ASA configuration
guides.
CLI
CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some
ASA features are not supported using CDO. You should use CDO if you want a
multi-device manager that offers a simplified management experience. And because
CDO is cloud-based, there is no overhead of running CDO on your own servers. CDO
also manages other security devices, such as FTDs, so you can use a single manager
for all of your security devices. CDO can discover the configuration on the firewall, so
you can also use the CLI or ASDM.
CDO is not covered in this guide. To get started with CDO, see the CDO home page.
Cisco Defense Orchestrator (CDO)
CSM is a powerful, multi-device manager that runs on its own server hardware. You
should use CSM if you need to manage large numbers of ASAs. CSM can discover the
configuration on the firewall, so you can also use the CLI or ASDM. CSM does not
support managing FTDs.
CSM is not covered in this guide. For more information, see the CSM user guide.
Cisco Security Manager (CSM)
Cisco Firepower 2100 Getting Started Guide
3
Which Operating System and Manager is Right for You?
ASA Managers

DescriptionManager
The ASA REST API lets you automate ASA configuration. However, the API does not
include all ASA features, and is no longer being enhanced.
The ASA REST API is not covered in this guide. For more information, see the ASA
REST API guide.
ASA REST API
Cisco Firepower 2100 Getting Started Guide
4
Which Operating System and Manager is Right for You?
ASA Managers

CHAPTER 2
Firepower Threat Defense Deployment with FDM
Is This Chapter for You?
This chapter explains how to complete the initial set up and configuration of your Firepower Threat Defense
(FTD) device using the Firepower Device Manager (FDM) web-based device setup wizard.
FDM lets you configure the basic features of the software that are most commonly used for small networks.
It is especially designed for networks that include a single device or just a few, where you do not want to use
a high-powered multiple-device manager to control a large network containing many FDM devices.
If you are managing large numbers of devices, or if you want to use the more complex features and
configurations that FTD allows, use the Firepower Management Center (FMC) instead.
The Firepower 2100 Series hardware can run either FTD software or ASA software. Switching between FTD
and ASA requires you to reimage the device. See Reimage the Cisco ASA or Firepower Threat Defense
Device.
The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System
(FXOS). The Firepower 2100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is
supported for troubleshooting purposes. See the FXOS troubleshooting guide for more information.
Privacy Collection Statement—The Firepower 2100 Series does not require or actively collect
personally-identifiable information. However, you can use personally-identifiable information in the
configuration, for example for usernames. In this case, an administrator might be able to see this information
when working with the configuration or when using SNMP.
•End-to-End Procedure, on page 6
•Review the Network Deployment and Default Configuration, on page 7
•Cable the Device, on page 10
•Power on the Device, on page 11
•(Optional) Change Management Network Settings at the CLI, on page 12
•Log Into FDM, on page 14
•Complete the Initial Configuration, on page 14
•Configure Licensing, on page 16
•Configure the Firewall in Firepower Device Manager, on page 22
•Access the FTD and FXOS CLI, on page 25
•Power Off the Firewall Using FDM, on page 27
•What's Next?, on page 27
Cisco Firepower 2100 Getting Started Guide
5

End-to-End Procedure
See the following tasks to deploy FTD with FDM on your chassis.
Review the Network Deployment and Default Configuration, on page 7.Pre-Configuration
Cable the Device, on page 10.Pre-Configuration
Power on the Device, on page 11.Pre-Configuration
Cisco Firepower 2100 Getting Started Guide
6
Firepower Threat Defense Deployment with FDM
End-to-End Procedure

(Optional) Change Management Network Settings at the CLI, on page 12.FTD CLI
Log Into FDM, on page 14.Firepower Device
Manager
Complete the Initial Configuration, on page 14.Firepower Device
Manager
(Optional) Obtain feature licenses (Configure Licensing, on page 16).Cisco Commerce
Workspace
Generate a license token (Configure Licensing, on page 16).Smart Software
Manager
Register the device with the Smart Licensing Server (Configure Licensing, on
page 16).
Firepower Device
Manager
Configure the Firewall in Firepower Device Manager, on page 22.Firepower Device
Manager
Review the Network Deployment and Default Configuration
You can manage the FTD using FDM from either the Management 1/1 interface or the inside interface. The
dedicated Management interface is a special interface with its own network settings.
The following figure shows the recommended network deployment. If you connect the outside interface
directly to a cable modem or DSL modem, we recommend that you put the modem into bridge mode so the
FTD performs all routing and NAT for your inside networks. If you need to configure PPPoE for the outside
interface to connect to your ISP, you can do so after you complete initial setup in FDM.
If you cannot use the default management IP address (for example, your management network does not include
a DHCP server), then you can connect to the console port and perform initial setup at the CLI, including
setting the Management IP address, gateway, and other basic networking settings.
If you need to change the inside IP address, you can do so after you complete initial setup in FDM. For
example, you may need to change the inside IP address in the following circumstances:
•(7.0 and later) The inside IP address is 192.168.95.1. (6.7 and earlier) The inside IP address is 192.168.1.1.
If the outside interface tries to obtain an IP address on the 192.168.1.0 network, which is a common
default network, the DHCP lease will fail, and the outside interface will not obtain an IP address. This
problem occurs because the FTD cannot have two interfaces on the same network. In this case you must
change the inside IP address to be on a new network.
• If you add the FTD to an existing inside network, you will need to change the inside IP address to be on
the existing network.
Note
The following figure shows the default network deployment for FTD using FDM with the default configuration.
Cisco Firepower 2100 Getting Started Guide
7
Firepower Threat Defense Deployment with FDM
Review the Network Deployment and Default Configuration

Figure 1: Suggested Network Deployment
For 6.7 and earlier, the Ethernet 1/2 inside IP address is 192.168.1.1.
For 6.5 and earlier, the Management 1/1 default IP address is 192.168.45.45.
Note
Default Configuration
The configuration for the f after initial setup includes the following:
•inside—Ethernet 1/2, IP address (7.0 and later) 192.168.95.1; (pre-7.0) 192.168.1.1.
•outside—Ethernet 1/1, IP address from IPv4 DHCP and IPv6 autoconfiguration
•inside→outside traffic flow
•management—Management 1/1 (management)
• (6.6 and later) IP address from DHCP
• (6.5 and earlier) IP address 192.168.45.45
Cisco Firepower 2100 Getting Started Guide
8
Firepower Threat Defense Deployment with FDM
Default Configuration

The Management 1/1 interface is a special interface separate from
data interfaces that is used for management, Smart Licensing, and
database updates. The physical interface is shared with a second
logical interface, the Diagnostic interface. Diagnostic is a data
interface, but is limited to other types of management traffic
(to-the-device and from-the-device), such as syslog or SNMP. The
Diagnostic interface is not typically used. See the FDM configuration
guide for more information.
Note
•DNS server for management—OpenDNS: (IPv4) 208.67.222.222, 208.67.220.220; (IPv6)
2620:119:35::35, or servers you specify during setup. DNS servers obtained from DHCP are never used.
•NTP—Cisco NTP servers: 0.sourcefire.pool.ntp.org, 1.sourcefire.pool.ntp.org, 2.sourcefire.pool.ntp.org,
or servers you specify during setup
•Default routes
•Data interfaces—Obtained from outside DHCP, or a gateway IP address you specify during setup
•Management interface—(6.6 and later) Obtained from management DHCP. If you do not receive
a gateway, then the default route is over the backplane and through the data interfaces. (6.5 and
earlier) Over the backplane and through the data interfaces
Note that the Management interface requires internet access for licensing and updates, either over
the backplane or using a separate internet gateway. Note that only traffic originating on the
Management interface can go over the backplane; otherwise, Management does not allow through
traffic for traffic entering Management from the network.
•DHCP server—Enabled on the inside interface and (6.5 and earlier only) management interface
•FDM access—All hosts allowed on Management and inside interfaces.
•NAT—Interface PAT for all traffic from inside to outside
Cisco Firepower 2100 Getting Started Guide
9
Firepower Threat Defense Deployment with FDM
Default Configuration

Cable the Device
For 6.7 and earlier, the Ethernet 1/2 inside IP address is 192.168.1.1.
For 6.5 and earlier, the Management 1/1 default IP address is 192.168.45.45.
Note
Manage the Firepower 2100 on either Management 1/1 or Ethernet 1/2. The default configuration also
configures Ethernet1/1 as outside.
Procedure
Step 1 Connect your management computer to either of the following interfaces:
• Ethernet 1/2—Connect your management computer directly to Ethernet 1/2 for initial configuration, or
connect Ethernet 1/2 to your inside network. Ethernet 1/2 has a default IP address (192.168.95.1) and
also runs a DHCP server to provide IP addresses to clients (including the management computer), so
make sure these settings do not conflict with any existing inside network settings (see Default
Configuration, on page 8).
• Management 1/1 (labeled MGMT)—Connect Management 1/1 to your management network, and make
sure your management computer is on—or has access to—the management network. Management 1/1
obtains an IP address from a DHCP server on your management network; if you use this interface, you
must determine the IP address assigned to the FTD so that you can connect to the IP address from your
management computer.
If you need to change the Management 1/1 IP address from the default to configure a static IP address,
you must also cable your management computer to the console port. See (Optional) Change Management
Network Settings at the CLI, on page 12.
You can later configure FDM management access from other interfaces; see the FDM configuration guide.
Cisco Firepower 2100 Getting Started Guide
10
Firepower Threat Defense Deployment with FDM
Cable the Device

Step 2 Connect the outside network to the Ethernet1/1 interface (labeled WAN).
By default, the IP address is obtained using IPv4 DHCP and IPv6 autoconfiguration, but you can set a static
address during initial configuration.
Step 3 Connect other networks to the remaining interfaces.
Power on the Device
The power switch is located to the left of power supply module 1 on the rear of the chassis. It is a toggle
switch that controls power to the system. If the power switch is in standby position, only the 3.3-V standby
power is enabled from the power supply module and the 12-V main power is OFF. When the switch is in the
ON position, the 12-V main power is turned on and the system boots.
Before you begin
It's important that you provide reliable power for your device (for example, using an uninterruptable power
supply (UPS)). Loss of power without first shutting down can cause serious file system damage. There are
many processes running in the background all the time, and losing power does not allow the graceful shutdown
of your system.
Procedure
Step 1 Attach the power cord to the device and connect it to an electrical outlet.
Step 2 Press the power switch on the back of the device.
Step 3 Check the PWR LED on the front of the device; if it is solid green, the device is powered on.
Step 4 Check the SYS LED on the front of the device; after it is solid green, the system has passed power-on
diagnostics.
Before you move the power switch to the OFF position, use the shutdown commands so that the
system can perform a graceful shutdown. This may take several minutes to complete. After the
graceful shutdown is complete, the console displays It is safe to power off now. The front
panel blue locator beacon LED lights up indicating the system is ready to be powered off. You can
now move the switch to the OFF position. The front panel PWR LED flashes momentarily and turns
off. Do not remove the power until the PWR LED is completely off.
See the FXOS Configuration Guide for more information on using the shutdown commands.
Note
Cisco Firepower 2100 Getting Started Guide
11
Firepower Threat Defense Deployment with FDM
Power on the Device

(Optional) Change Management Network Settings at the CLI
If you cannot use the default management IP address, then you can connect to the console port and perform
initial setup at the CLI, including setting the Management IP address, gateway, and other basic networking
settings. You can only configure the Management interface settings; you cannot configure inside or outside
interfaces, which you can later configure in the GUI.
You cannot repeat the CLI setup script unless you clear the configuration; for example, by reimaging. However,
all of these settings can be changed later at the CLI using configure network commands. See the threat
defense command reference.
Note
Procedure
Step 1 Connect to the FTD console port. See Access the FTD and FXOS CLI, on page 25 for more information.
Log in with the admin user and the default password, Admin123.
You connect to the FXOS CLI. The first time you log in, you are prompted to change the password. This
password is also used for the FTD login for SSH.
If the password was already changed, and you do not know it, you must reimage the device to reset
the password to the default. See the FXOS troubleshooting guide for the reimage procedure.
Note
Example:
firepower login: admin
Password: Admin123
Successful login attempts for user 'admin' : 1
[...]
Hello admin. You must change your password.
Enter new password: ********
Confirm new password: ********
Your password was updated successfully.
[...]
firepower#
Step 2 Connect to the FTD CLI.
connect ftd
Example:
firepower# connect ftd
>
Cisco Firepower 2100 Getting Started Guide
12
Firepower Threat Defense Deployment with FDM
(Optional) Change Management Network Settings at the CLI

Step 3 The first time you log in to FTD, you are prompted to accept the End User License Agreement (EULA). You
are then presented with the CLI setup script.
Defaults or previously-entered values appear in brackets. To accept previously entered values, press Enter.
See the following guidelines:
•Enter the IPv4 default gateway for the management interface—If you set a manual IP address, enter
either data-interfaces or the IP address of the gateway router. The data-interfaces setting sends outbound
management traffic over the backplane to exit a data interface. This setting is useful if you do not have
a separate Management network that can access the internet. Traffic originating on the Management
interface includes license registration and database updates that require internet access. If you use
data-interfaces, you can still use the FDM (or SSH) on the Management interface if you are
directly-connected to the Management network, but for remote management for specific networks or
hosts, you should add a static route using the configure network static-routes command. Note that
FDM management on data interfaces is not affected by this setting. If you use DHCP, the system uses
the gateway provided by DHCP and uses the data-interfaces as a fallback method if DHCP doesn't
provide a gateway.
•If your networking information has changed, youwill need to reconnect—If you are connected with
SSH to the default IP address but you change the IP address at initial setup, you will be disconnected.
Reconnect with the new IP address and password. Console connections are not affected.
•Manage the device locally?—Enter yes to use the FDM or the CDO. A no answer means you intend to
use the FMC to manage the device.
Example:
You must accept the EULA to continue.
Press <ENTER> to display the EULA:
End User License Agreement
[...]
Please enter 'YES' or press <ENTER> to AGREE to the EULA:
System initialization in progress. Please stand by.
You must configure the network to continue.
You must configure at least one of IPv4 or IPv6.
Do you want to configure IPv4? (y/n) [y]:
Do you want to configure IPv6? (y/n) [n]:
Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]:
Enter an IPv4 address for the management interface [192.168.45.45]: 10.10.10.15
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.192
Enter the IPv4 default gateway for the management interface [data-interfaces]: 10.10.10.1
Enter a fully qualified hostname for this system [firepower]: ftd-1.cisco.com
Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220]:
Enter a comma-separated list of search domains or 'none' []:
If your networking information has changed, you will need to reconnect.
For HTTP Proxy configuration, run 'configure network http-proxy'
Manage the device locally? (yes/no) [yes]: yes
>
Step 4 Log into the FDM on the new Management IP address.
Cisco Firepower 2100 Getting Started Guide
13
Firepower Threat Defense Deployment with FDM
(Optional) Change Management Network Settings at the CLI

Log Into FDM
Log into FDM to configure your FTD.
Before you begin
• Use a current version of Firefox, Chrome, Safari, Edge, or Internet Explorer.
Procedure
Step 1 Enter the following URL in your browser.
• (7.0 and later) Inside (Ethernet 1/2)—https://192.168.95.1.
• (6.7 and earlier) Inside (Ethernet 1/2)—https://192.168.1.1.
• (6.6 and later) Management—https://management_ip. The Management interface is a DHCP client, so
the IP address depends on your DHCP server. If you changed the Management IP address at the CLI
setup, then enter that address.
• (6.5 and earlier) Management—https://192.168.45.45. If you changed the Management IP address at
the CLI setup, then enter that address.
Step 2 Log in with the username admin, and thedefault password Admin123.
What to do next
• Run through the FDM setup wizard; see Complete the Initial Configuration, on page 14.
Complete the Initial Configuration
Use the setup wizard when you first log into FDM to complete the initial configuration. After you complete
the setup wizard, you should have a functioning device with a few basic policies in place:
• An outside (Ethernet1/1) and an inside interface (Ethernet1/2).
• Security zones for the inside and outside interfaces.
• An access rule trusting all inside to outside traffic.
• An interface NAT rule that translates all inside to outside traffic to unique ports on the IP address of the
outside interface.
• A DHCP server running on the inside interface.
Cisco Firepower 2100 Getting Started Guide
14
Firepower Threat Defense Deployment with FDM
Log Into FDM

If you performed the (Optional) Change Management Network Settings at the CLI, on page 12 procedure,
then some of these tasks, specifically changing the admin password and configuring the outside and management
interfaces, should have already been completed.
Note
Procedure
Step 1 You are prompted to read and accept the End User License Agreement and change the admin password.
You must complete these steps to continue.
Step 2 Configure the following options for the outside and management interfaces and click Next.
Your settings are deployed to the device when you click Next. The interface will be named “outside”
and it will be added to the “outside_zone” security zone. Ensure that your settings are correct.
Note
a) Outside Interface—This is the data port that you connected to your gateway router. You cannot select
an alternative outside interface during initial device setup. The first data interface is the default outside
interface.
Configure IPv4—The IPv4 address for the outside interface. You can use DHCP or manually enter a
static IP address, subnet mask, and gateway. You can also select Off to not configure an IPv4 address.
You cannot configure PPPoE using the setup wizard. PPPoE may be required if the interface is connected
to a DSL modem, cable modem, or other connection to your ISP, and your ISP uses PPPoE to provide
your IP address. You can configure PPPoE after you complete the wizard.
Configure IPv6—The IPv6 address for the outside interface. You can use DHCP or manually enter a
static IP address, prefix, and gateway. You can also select Off to not configure an IPv6 address.
b) Management Interface
DNS Servers—The DNS server for the system's management address. Enter one or more addresses of
DNS servers for name resolution. The default is the OpenDNS public DNS servers. If you edit the fields
and want to return to the default, click Use OpenDNS to reload the appropriate IP addresses into the
fields.
Firewall Hostname—The hostname for the system's management address.
Step 3 Configure the system time settings and click Next.
a) Time Zone—Select the time zone for the system.
b) NTP Time Server—Select whether to use the default NTP servers or to manually enter the addresses of
your NTP servers. You can add multiple servers to provide backups.
Step 4 (Optional) Configure the smart licenses for the system.
Your purchase of a Firepower Threat Defense device automatically includes a Base license. All additional
licenses are optional.
You must have a smart license account to obtain and apply the licenses that the system requires. Initially, you
can use the 90-day evaluation license and set up smart licensing later.
To register the device now, click the link to log into your Smart Software Manager account, and see Configure
Licensing, on page 16.
Cisco Firepower 2100 Getting Started Guide
15
Firepower Threat Defense Deployment with FDM
Complete the Initial Configuration

To use the evaluation license, select Start 90 day evaluation period without registration.
Step 5 Click Finish.
What to do next
• Although you can continue using the evaluation license, we recommend that you register and license
your device; see Configure Licensing, on page 16.
• You can also choose to configure the device using FDM; see Configure the Firewall in Firepower Device
Manager, on page 22.
Configure Licensing
The FTD uses Smart Software Licensing, which lets you purchase and manage a pool of licenses centrally.
When you register the chassis, the Smart Software Manager issues an ID certificate for communication between
the chassis and the Smart Software Manager. It also assigns the chassis to the appropriate virtual account.
For a more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide
The Base license is included automatically. Smart Licensing does not prevent you from using product features
that you have not yet purchased. You can start using a license immediately, as long as you are registered with
the Smart Software Manager, and purchase the license later. This allows you to deploy and use a feature, and
avoid delays due to purchase order approval. See the following licenses:
•Threat—Security Intelligence and Next-Generation IPS
•Malware—Malware
•URL—URL Filtering
•RA VPN—AnyConnect Plus, AnyConnect Apex, or AnyConnect VPN Only
Before you begin
• Have a master account on the Smart Software Manager.
If you do not yet have an account, click the link to set up a new account. The Smart Software Manager
lets you create a master account for your organization.
• Your Smart Software Licensing account must qualify for the Strong Encryption (3DES/AES) license to
use some features (enabled using the export-compliance flag).
Procedure
Step 1 Make sure your Smart Licensing account contains the available licenses you need.
When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart
Software License account. However, if you need to add licenses yourself, use the Find Products and Solutions
search field on the Cisco Commerce Workspace. Search for the following license PIDs:
Cisco Firepower 2100 Getting Started Guide
16
Firepower Threat Defense Deployment with FDM
Configure Licensing

Figure 2: License Search
If a PID is not found, you can add the PID manually to your order.
Note
• Threat, Malware, and URL license combination:
• L-FPR2110T-TMC=
• L-FPR2120T-TMC=
• L-FPR2130T-TMC=
• L-FPR2140T-TMC=
When you add one of the above PIDs to your order, you can then choose a term-based subscription
corresponding with one of the following PIDs:
• L-FPR2110T-TMC-1Y
• L-FPR2110T-TMC-3Y
• L-FPR2110T-TMC-5Y
• L-FPR2120T-TMC-1Y
• L-FPR2120T-TMC-3Y
• L-FPR2120T-TMC-5Y
• L-FPR2130T-TMC-1Y
• L-FPR2130T-TMC-3Y
• L-FPR2130T-TMC-5Y
• L-FPR2140T-TMC-1Y
• L-FPR2140T-TMC-3Y
• L-FPR2140T-TMC-5Y
• RA VPN—See the Cisco AnyConnect Ordering Guide.
Step 2 In the Smart Software Manager, request and copy a registration token for the virtual account to which you
want to add this device.
a) Click Inventory.
Cisco Firepower 2100 Getting Started Guide
17
Firepower Threat Defense Deployment with FDM
Configure Licensing

b) On the General tab, click New Token.
c) On the Create Registration Token dialog box enter the following settings, and then click Create Token:
•Description
•Expire After—Cisco recommends 30 days.
•Allow export-controlled functionaility on the products registered with this token—Enables the
export-compliance flag if you are in a country that allows for strong encryption. You must select this
option now if you plan to use this functionality. If you enable this functionality later, you will need
to re-register your device with a new product key and reload the device. If you do not see this option,
your account does not support export-controlled functionality.
The token is added to your inventory.
d) Click the arrow icon to the right of the token to open the Token dialog box so you can copy the token ID
to your clipboard. Keep this token ready for later in the procedure when you need to register the FTD.
Cisco Firepower 2100 Getting Started Guide
18
Firepower Threat Defense Deployment with FDM
Configure Licensing