Cisco FPR1010-ASA-K9 User manual

Cisco Firepower 1010 Getting Started Guide
First Published: 2019-06-13
Last Modified: 2023-01-23
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

CHAPTER 1
Which Operating System and Manager is Right
for You?
Your hardware platform can run one of two operating systems. For each operating system, you have a choice
of managers. This chapter explains the operating system and manager choices.
•Operating Systems, on page 1
•Managers, on page 1
Operating Systems
You can use either the Secure Firewall ASA or the Secure Firewall Threat Defense (formerly Firepower Threat
Defense) operating system on your hardware platform:
• ASA—The ASA is a traditional, advanced stateful firewall and VPN concentrator.
You may want to use the ASA if you do not need the advanced capabilities of the threat defense, or if
you need an ASA-only feature that is not yet available on the threat defense. Cisco provides ASA-to-threat
defense migration tools to help you convert your ASA to the threat defense if you start with ASA and
later reimage to threat defense.
• Threat Defense—The threat defense is a next-generation firewall that combines an advanced stateful
firewall, VPN concentrator, and next generation IPS. In other words, the threat defense takes the best of
ASA functionality and combines it with the best next-generation firewall and IPS functionality.
We recommend using the threat defense over the ASA because it contains most of the major functionality
of the ASA, plus additional next generation firewall and IPS functionality.
To reimage between the ASA and the threat defense, see the Cisco Secure Firewall ASA and Secure Firewall
Threat Defense Reimage Guide.
Managers
The threat defense and ASA support multiple managers.
Cisco Firepower 1010 Getting Started Guide
1

Threat Defense Managers
Table 1: Threat Defense Managers
DescriptionManager
The management center is a powerful, web-based, multi-device manager that runs on
its own server hardware, or as a virtual device on a hypervisor. You should use the
management center if you want a multi-device manager, and you require all features
on the threat defense. The management center also provides powerful analysis and
monitoring of traffic and events.
In 6.7 and later, the management center can manage the threat defenses from the outside
(or other data) interface instead of from the standard Management interface. This feature
is useful for remote branch deployments.
The management center is not compatible with other managers because the
management center owns the threat defense configuration, and you are not
allowed to configure the threat defense directly, bypassing the management
center.
Note
To get started with the management center on the Management network, see Threat
Defense Deployment with the Management Center, on page 5.
To get started with the management center on a remote network, see Threat Defense
Deployment with a Remote Management Center, on page 47.
Secure Firewall Management Center
(formerly Firepower Management Center)
The device manager is a web-based, simplified, on-device manager. Because it is
simplified, some threat defense features are not supported using the device manager.
You should use the device manager if you are only managing a small number of devices
and don't need a multi-device manager.
Both the device manager and CDO in FDM mode can discover the
configuration on the firewall, so you can use the device manager and CDO
to manage the same firewall. The management center is not compatible with
other managers.
Note
To get started with the device manager, see Threat Defense Deployment with the Device
Manager, on page 89.
Secure Firewall Device Manager (formerly
Firepower Device Manager)
Cisco Firepower 1010 Getting Started Guide
2
Which Operating System and Manager is Right for You?
Threat Defense Managers

DescriptionManager
CDO offers two management modes:
• (7.2 and later) Cloud-delivered management center mode with all of the
configuration functionality of an on-premises management center. For the analytics
functionality, you can use either Secure Cloud Analytics in the cloud or an on-prem
management center.
•(Existing CDO users only) Device manager mode with a simplified user experience.
This mode is only available to users who are already using CDO to manage threat
defenses in device manager mode. This mode is not covered in this guide.
Because CDO is cloud-based, there is no overhead of running CDO on your own servers.
CDO also manages other security devices, such as ASAs, so you can use a single manager
for all of your security devices.
To get started with CDO provisioning, see Threat Defense Deployment with CDO, on
page 117.
Cisco Defense Orchestrator (CDO)
The threat defense REST API lets you automate direct configuration of the threat defense.
This API is compatible with the device manager and CDO use because they can both
discover the configuration on the firewall. You cannot use this API if you are managing
the threat defense using the management center.
The threat defense REST API is not covered in this guide. For more information, see
the Cisco Secure Firewall Threat Defense REST API Guide.
Secure Firewall Threat Defense REST API
The management center REST API lets you automate configuration of management
center policies that can then be applied to managed threat defenses. This API does not
manage the threat defense directly.
The management center REST API is not covered in this guide. For more information,
see the Secure Firewall Management Center REST API Quick Start Guide.
Secure Firewall Management Center REST
API
ASA Managers
Table 2: ASA Managers
DescriptionManager
ASDM is a Java-based, on-device manager that provides full ASA functionality. You
should use ASDM if you prefer using a GUI over the CLI, and you only need to manage
a small number of ASAs. ASDM can discover the configuration on the firewall, so you
can also use the CLI, CDO, or CSM with ASDM.
To get started with ASDM, see ASA Deployment with ASDM, on page 167.
Adaptive Security Device Manager
(ASDM)
You should use the ASA CLI if you prefer CLIs over GUIs.
The CLI is not covered in this guide. For more information, see the ASA configuration
guides.
CLI
Cisco Firepower 1010 Getting Started Guide
3
Which Operating System and Manager is Right for You?
ASA Managers

DescriptionManager
CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some
ASA features are not supported using CDO. You should use CDO if you want a
multi-device manager that offers a simplified management experience. And because
CDO is cloud-based, there is no overhead of running CDO on your own servers. CDO
also manages other security devices, such as threat defenses, so you can use a single
manager for all of your security devices. CDO can discover the configuration on the
firewall, so you can also use the CLI or ASDM.
CDO is not covered in this guide. To get started with CDO, see the CDO home page.
CDO
CSM is a powerful, multi-device manager that runs on its own server hardware. You
should use CSM if you need to manage large numbers of ASAs. CSM can discover the
configuration on the firewall, so you can also use the CLI or ASDM. CSM does not
support managing the threat defenses.
CSM is not covered in this guide. For more information, see the CSM user guide.
Cisco Security Manager (CSM)
The ASA REST API lets you automate ASA configuration. However, the API does not
include all ASA features, and is no longer being enhanced.
The ASA REST API is not covered in this guide. For more information, see the Cisco
ASA REST API Quick Start Guide.
ASA REST API
Cisco Firepower 1010 Getting Started Guide
4
Which Operating System and Manager is Right for You?
ASA Managers

CHAPTER 2
Threat Defense Deployment with the
Management Center
Is This Chapter for You?
To see all available operating systems and managers, see Which Operating System and Manager is Right for
You?, on page 1. This chapter applies to the threat defense with the management center.
This chapter explains how to complete the initial configuration of your threat defense and how to register the
firewall to the management center located on your management network. For remote branch deployment,
where the management center resides at a central headquarters, see Threat Defense Deployment with a Remote
Management Center, on page 47.
In a typical deployment on a large network, you install multiple managed devices on network segments. Each
device controls, inspects, monitors, and analyzes traffic, and then reports to a managing management center.
The management center provides a centralized management console with a web interface that you can use to
perform administrative, management, analysis, and reporting tasks in service to securing your local network.
About the Firewall
The hardware can run either threat defense software or ASA software. Switching between threat defense and
ASA requires you to reimage the device. You should also reimage if you need a different software version
than is currently installed. See Reimage the Cisco ASA or Firepower Threat Defense Device.
The firewall runs an underlying operating system called the Secure Firewall eXtensible Operating System
(FXOS). The firewall does not support the FXOS Secure Firewall chassis manager; only a limited CLI is
supported for troubleshooting purposes. See the Cisco FXOS Troubleshooting Guide for the Firepower
1000/2100 and Secure Firewall 3100 with Firepower Threat Defense for more information.
Privacy Collection Statement—The firewall does not require or actively collect personally identifiable
information. However, you can use personally identifiable information in the configuration, for example for
usernames. In this case, an administrator might be able to see this information when working with the
configuration or when using SNMP.
•Before You Start, on page 6
•End-to-End Procedure, on page 6
•Review the Network Deployment, on page 8
•Cable the Device (6.5 and Later), on page 10
•Cable the Device (6.4), on page 12
•Power On the Firewall, on page 13
•(Optional) Check the Software and Install a New Version, on page 13
Cisco Firepower 1010 Getting Started Guide
5

•Complete the Threat Defense Initial Configuration, on page 15
•Log Into the Management Center, on page 23
•Obtain Licenses for the Management Center, on page 24
•Register the Threat Defense with the Management Center, on page 25
•Configure a Basic Security Policy, on page 28
•Access the Threat Defense and FXOS CLI, on page 43
•Power Off the Firewall, on page 44
•What's Next?, on page 45
Before You Start
Deploy and perform initial configuration of the management center. See the Cisco Firepower Management
Center 1600, 2600, and 4600 Hardware Installation Guide or Cisco Secure Firewall Management Center
Virtual Getting Started Guide.
End-to-End Procedure
See the following tasks to deploy the threat defense with management center on your chassis.
Cisco Firepower 1010 Getting Started Guide
6
Threat Defense Deployment with the Management Center
Before You Start

Install the firewall. See the hardware installation guide.Pre-Configuration
Review the Network Deployment, on page 8.Pre-Configuration
Cable the Device (6.5 and Later), on page 10
Cable the Device (6.4), on page 12.
Pre-Configuration
Power On the Firewall, on page 13.Pre-Configuration
(Optional) Check the Software and Install a New Version, on page 13CLI
Cisco Firepower 1010 Getting Started Guide
7
Threat Defense Deployment with the Management Center
End-to-End Procedure

Complete the Threat Defense Initial Configuration, on page 15.CLI or Device
Manager
Log Into the Management Center, on page 23.Management Center
Obtain Licenses for the Management Center, on page 24: Buy feature licenses.Cisco Commerce
Workspace
Obtain Licenses for the Management Center, on page 24: Generate a license
token for the management center.
Smart Software
Manager
Obtain Licenses for the Management Center, on page 24: Register the
management center with the Smart Licensing server.
Management Center
Register the Threat Defense with the Management Center, on page 25Management Center
Configure a Basic Security Policy, on page 28Management Center
Review the Network Deployment
6.5 and Later Deployment
The dedicated Management 1/1 interface is a special interface with its own network settings. By default, the
Management 1/1 interface is enabled and configured as a DHCP client. If your network does not include a
DHCP server, you can set the Management interface to use a static IP address during initial setup at the console
port. You can configure other interfaces after you connect the threat defense to the management center. Note
that Ethernet1/2 through 1/8 are enabled as switch ports by default.
In 6.5 and earlier, the Management interface is configured with an IP address (192.168.45.45).
Note
The following figure shows the recommended network deployment for the Firepower 1010.
The management center can only communicate with the threat defense on the Management interface. Moreover,
both the management center and the threat defense require internet access from management for licensing
and updates.
In the following diagram, the Firepower 1010 acts as the internet gateway for the Management interface and
the management center by connecting Management 1/1 directly to an inside switch port, and by connecting
the management center and management computer to other inside switch ports. (This direct connection is
allowed because the Management interface is separate from the other interfaces on the threat defense.)
Cisco Firepower 1010 Getting Started Guide
8
Threat Defense Deployment with the Management Center
Review the Network Deployment

Figure 1: Suggested Network Deployment
6.4 Deployment
The dedicated Management 1/1 interface is a special interface with its own network settings. By default, only
the Management 1/1 interface is enabled and configured with an IP address (192.168.45.45). This interface
also runs a DHCP server initially; after you select the management center as the manager during initial setup,
the DHCP server is disabled. You can configure other interfaces after you connect the threat defense to the
management center.
The following figure shows the recommended network deployment for the Firepower 1010.
The management center can only communicate with the threat defense on the Management interface. Moreover,
both the management center and the threat defense require internet access from management for licensing
and updates.
In the following diagram, the Firepower 1010 acts as the internet gateway for the Management interface and
the management center by connecting Management 1/1 to an inside interface through a Layer 2 switch, and
by connecting the management center and management computer to the switch. (This direct connection is
allowed because the Management interface is separate from the other interfaces on the threat defense.)
Cisco Firepower 1010 Getting Started Guide
9
Threat Defense Deployment with the Management Center
Review the Network Deployment

Figure 2: Suggested Network Deployment
Cable the Device (6.5 and Later)
To cable the recommended scenario on the Firepower 1010, see the following illustration, which shows a
sample topology using Ethernet1/1 as the outside interface and the remaining interfaces as switch ports on
the inside network.
Other topologies can be used, and your deployment will vary depending on your requirements. For
example, you can convert the switch ports to firewall interfaces.
Note
Cisco Firepower 1010 Getting Started Guide
10
Threat Defense Deployment with the Management Center
Cable the Device (6.5 and Later)

Figure 3: Cabling the Firepower 1010
For version 6.5 and earlier, the Management 1/1 default IP address is 192.168.45.45.
Note
Procedure
Step 1 Install the chassis. See the hardware installation guide.
Step 2 Connect Management1/1 directly to one of the switch ports, Ethernet1/2 through 1/8.
Step 3 Cable the following to the switch ports, Ethernet1/2 through 1/8:
• Management Center
• Management computer
• Additional end points
Step 4 Connect the management computer to the console port. You need to use the console port to access the CLI
for initial setup if you do not use SSH to the Management interface or use the device manager for initial setup.
Step 5 Connect Ethernet 1/1 to your outside router.
Cisco Firepower 1010 Getting Started Guide
11
Threat Defense Deployment with the Management Center
Cable the Device (6.5 and Later)

Cable the Device (6.4)
To cable the recommended scenario on the Firepower 1010, see the following illustration, which shows a
sample topology using a Layer 2 switch.
Other topologies can be used, and your deployment will vary depending on your requirements.
Note
Figure 4: Cabling the Firepower 1010
Procedure
Step 1 Install and familiarize yourself with your hardware using the hardware installation guide.
Step 2 Cable the following to a Layer 2 Ethernet switch:
• Inside interface (for example, Ethernet 1/2)
• Management 1/1 interface
• Management Center
• Management computer
The Firepower 1010 and the management center both have the same default management IP address:
192.168.45.45. This guide assumes that you will set different IP addresses for your devices during
initial setup. Note that the management center on 6.5 and later defaults to a DHCP client for the
management interface; however, if there is no DHCP server, it will default to 192.168.45.45.
Note
Step 3 Connect the management computer to the console port. You need to use the console port to access the CLI
for initial setup if you do not use SSH to the Management interface.
Step 4 Connect the outside interface (for example, Ethernet 1/1) to your outside router.
Cisco Firepower 1010 Getting Started Guide
12
Threat Defense Deployment with the Management Center
Cable the Device (6.4)

Step 5 Connect other networks to the remaining interfaces.
Power On the Firewall
System power is controlled by the power cord; there is no power button.
The first time you boot up the threat defense, initialization can take approximately 15 to 30 minutes.
Note
Before you begin
It's important that you provide reliable power for your device (using an uninterruptable power supply (UPS),
for example). Loss of power without first shutting down can cause serious file system damage. There are
many processes running in the background all the time, and losing power does not allow the graceful shutdown
of your system.
Procedure
Step 1 Attach the power cord to the device, and connect it to an electrical outlet.
The power turns on automatically when you plug in the power cord.
Step 2 Check the Power LED on the back or top of the device; if it is solid green, the device is powered on.
Step 3 Check the Status LED on the back or top of the device; after it is solid green, the system has passed power-on
diagnostics.
(Optional) Check the Software and Install a New Version
To check the software version and, if necessary, install a different version, perform these steps. We recommend
that you install your target version before you configure the firewall. Alternatively, you can perform an upgrade
after you are up and running, but upgrading, which preserves your configuration, may take longer than using
this procedure.
What Version Should I Run?
Cisco Firepower 1010 Getting Started Guide
13
Threat Defense Deployment with the Management Center
Power On the Firewall

Cisco recommends running a Gold Star release indicated by a gold star next to the release number on the
software download page. You can also refer to the release strategy described in https://www.cisco.com/c/en/
us/products/collateral/security/firewalls/bulletin-c25-743178.html; for example, this bulletin describes short-term
release numbering (with the latest features), long-term release numbering (maintenance releases and patches
for a longer period of time), or extra long-term release numbering (maintenance releases and patches for the
longest period of time, for government certification).
Procedure
Step 1 Connect to the CLI. See Access the Threat Defense and FXOS CLI, on page 43 for more information. This
procedure shows using the console port, but you can use SSH instead.
Log in with the admin user and the default password, Admin123.
You connect to the FXOS CLI. The first time you log in, you are prompted to change the password. This
password is also used for the threat defense login for SSH.
If the password was already changed, and you do not know it, you must perform a factory reset to
reset the password to the default. See the FXOS troubleshooting guide for the factory reset procedure.
Note
Example:
firepower login: admin
Password: Admin123
Successful login attempts for user 'admin' : 1
[...]
Hello admin. You must change your password.
Enter new password: ********
Confirm new password: ********
Your password was updated successfully.
[...]
firepower#
Step 2 At the FXOS CLI, show the running version.
scope ssa
show app-instance
Example:
Firepower# scope ssa
Firepower /ssa # show app-instance
Application Name Slot ID Admin State Operational State Running Version Startup
Version Cluster Oper State
-------------------- ---------- --------------- -------------------- ---------------
--------------- ------------------
ftd 1 Enabled Online 7.2.0.65 7.2.0.65
Not Applicable
Step 3 If you want to install a new version, perform these steps.
Cisco Firepower 1010 Getting Started Guide
14
Threat Defense Deployment with the Management Center
(Optional) Check the Software and Install a New Version

a) If you need to set a static IP address for the Management interface, see Complete the Threat Defense
Initial Configuration Using the CLI, on page 20. By default, the Management interface uses DHCP.
You will need to download the new image from a server accessible from the Management interface.
b) Perform the reimage procedure in the FXOS troubleshooting guide.
Complete the Threat Defense Initial Configuration
You can complete the threat defense initial configuration using the CLI or device manager.
Complete the Threat Defense Initial Configuration Using the Device Manager
Connect to the device manager to perform initial setup of the threat defense. When you perform initial setup
using the device manager, all interface configuration completed in the device manager is retained when you
switch to the management center for management, in addition to the Management interface and manager
access settings. Note that other default configuration settings, such as the access control policy or security
zones, are not retained. When you use the CLI, only the Management interface and manager access settings
are retained (for example, the default inside interface configuration is not retained).
Before you begin
•Deploy and perform initial configuration of the management center. See the Cisco Firepower Management
Center 1600, 2600, and 4600 Hardware Installation Guide. You will need to know the management center
IP address or hostname before you set up the threat defense.
• Use a current version of Firefox, Chrome, Safari, Edge, or Internet Explorer.
Procedure
Step 1 Log in to the device manager.
a) Enter one of the following URLs in your browser.
• Inside (Ethernet1/2 through 1/8)—https://192.168.95.1.You can connect to the inside address on
any inside switch port (Ethernet1/2 through 1/8).
• Management—https://management_ip. The Management interface is a DHCP client, so the IP
address depends on your DHCP server. You might have to set the Management IP address to a static
address as part of this procedure, so we recommend that you use the inside interface so you do not
become disconnected.
b) Log in with the username admin, and the default password Admin123.
c) You are prompted to read and accept the End User License Agreement and change the admin password.
Step 2 Use the setup wizard when you first log into the device manager to complete the initial configuration. You
can optionally skip the setup wizard by clicking Skip device setup at the bottom of the page.
Cisco Firepower 1010 Getting Started Guide
15
Threat Defense Deployment with the Management Center
Complete the Threat Defense Initial Configuration

After you complete the setup wizard, in addition to the default configuraton for the inside interface (Ethernet1/2
through 1/8, which are switch ports on VLAN1)., you will have configuration for an outside (Ethernet1/1)
interface that will be maintained when you switch to management center management.
a) Configure the following options for the outside and management interfaces and click Next.
1. Outside Interface Address—This interface is typically the internet gateway, and might be used as
your manager access interface. You cannot select an alternative outside interface during initial device
setup. The first data interface is the default outside interface.
If you want to use a different interface from outside (or inside) for manager access, you will have to
configure it manually after completing the setup wizard.
Configure IPv4—The IPv4 address for the outside interface. You can use DHCP or manually enter
a static IP address, subnet mask, and gateway. You can also select Off to not configure an IPv4 address.
You cannot configure PPPoE using the setup wizard. PPPoE may be required if the interface is
connected to a DSL modem, cable modem, or other connection to your ISP, and your ISP uses PPPoE
to provide your IP address. You can configure PPPoE after you complete the wizard.
Configure IPv6—The IPv6 address for the outside interface. You can use DHCP or manually enter
a static IP address, prefix, and gateway. You can also select Off to not configure an IPv6 address.
2. Management Interface
You will not see Management Interface settings if you performed intial setup at the CLI. Note that
setting the Management interface IP address is not part of the setup wizard. See Step Step 3, on page
16 to set the Management IP address.
DNSServers—The DNS server for the firewall's Management interface. Enter one or more addresses
of DNS servers for name resolution. The default is the OpenDNS public DNS servers. If you edit the
fields and want to return to the default, click Use OpenDNS to reload the appropriate IP addresses
into the fields.
Firewall Hostname—The hostname for the firewall's Management interface.
b) Configure the Time Setting (NTP) and click Next.
1. Time Zone—Select the time zone for the system.
2. NTP Time Server—Select whether to use the default NTP servers or to manually enter the addresses
of your NTP servers. You can add multiple servers to provide backups.
c) Select Start 90 day evaluation period without registration.
Do not register the threat defense with the Smart Software Manager; all licensing is performed on the
management center.
d) Click Finish.
e) You are prompted to choose Cloud Management or Standalone. For management center management,
choose Standalone, and then Got It.
Step 3 (Might be required) Configure a static IP address for the Management interface. Choose Device, then click
the System Settings >Management Interface link.
If you want to configure a static IP address, be sure to also set the default gateway to be a unique gateway
instead of the data interfaces. If you use DHCP, you do not need to configure anything.
Cisco Firepower 1010 Getting Started Guide
16
Threat Defense Deployment with the Management Center
Complete the Threat Defense Initial Configuration Using the Device Manager

Step 4 If you want to configure additional interfaces, including an interface other than outside or inside, choose
Device, and then click the link in the Interfaces summary.
See Configure the Firewall in the Device Manager, on page 107 for more information about configuring
interfaces in the device manager. Other device manager configuration will not be retained when you register
the device to the management center.
Step 5 Choose Device >System Settings >Central Management, and click Proceed to set up the management
center management.
Step 6 Configure the Management Center/CDO Details.
Cisco Firepower 1010 Getting Started Guide
17
Threat Defense Deployment with the Management Center
Complete the Threat Defense Initial Configuration Using the Device Manager

Figure 5: Management Center/CDO Details
a) For Do you know the Management Center/CDO hostname or IP address, click Yes if you can reach
the management center using an IP address or hostname, or No if the management center is behind NAT
or does not have a public IP address or hostname.
Cisco Firepower 1010 Getting Started Guide
18
Threat Defense Deployment with the Management Center
Complete the Threat Defense Initial Configuration Using the Device Manager