Cisco Firepower 1100 User manual

Cisco Firepower 1100 Getting Started Guide
First Published: 2019-06-13
Last Modified: 2022-06-09
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

CHAPTER 1
Which Operating System and Manager is Right
for You?
Your hardware platform can run one of two operating systems. For each operating system, you have a choice
of managers. This chapter explains the operating system and manager choices.
•Operating Systems, on page 1
•Managers, on page 1
Operating Systems
You can use either the Secure Firewall ASA or the Secure Firewall Threat Defense (formerly Firepower Threat
Defense) operating system on your hardware platform:
• ASA—The ASA is a traditional, advanced stateful firewall and VPN concentrator.
You may want to use the ASA if you do not need the advanced capabilities of the threat defense, or if
you need an ASA-only feature that is not yet available on the threat defense. Cisco provides ASA-to-threat
defense migration tools to help you convert your ASA to the threat defense if you start with ASA and
later reimage to threat defense.
• Threat Defense—The threat defense is a next-generation firewall that combines an advanced stateful
firewall, VPN concentrator, and next generation IPS. In other words, the threat defense takes the best of
ASA functionality and combines it with the best next-generation firewall and IPS functionality.
We recommend using the threat defense over the ASA because it contains most of the major functionality
of the ASA, plus additional next generation firewall and IPS functionality.
To reimage between the ASA and the threat defense, see the Cisco Secure Firewall ASA and Threat Defense
Reimage Guide.
Managers
The threat defense and ASA support multiple managers.
Cisco Firepower 1100 Getting Started Guide
1

Threat Defense Managers
Table 1: Threat Defense Managers
DescriptionManager
The management center is a powerful, web-based, multi-device manager that runs on
its own server hardware, or as a virtual device on a hypervisor. You should use the
management center if you want a multi-device manager, and you require all features
on the threat defense. The management center also provides powerful analysis and
monitoring of traffic and events.
In 6.7 and later, the management center can manage the threat defenses from the outside
(or other data) interface instead of from the standard Management interface. This feature
is useful for remote branch deployments.
The management center is not compatible with other managers because the
management center owns the threat defense configuration, and you are not
allowed to configure the threat defense directly, bypassing the management
center.
Note
To get started with the management center on the Management network, see Threat
Defense Deployment with the Management Center, on page 5.
To get started with the management center on a remote network, see Threat Defense
Deployment with a Remote Management Center, on page 41.
Secure Firewall Management Center
(formerly Firepower Management Center)
The device manager is a web-based, simplified, on-device manager. Because it is
simplified, some threat defense features are not supported using the device manager.
You should use the device manager if you are only managing a small number of devices
and don't need a multi-device manager.
Both the device manager and CDO in FDM mode can discover the
configuration on the firewall, so you can use the device manager and CDO
to manage the same firewall. The management center is not compatible with
other managers.
Note
To get started with the device manager, see Threat Defense Deployment with the Device
Manager, on page 83.
Secure Firewall Device Manager (formerly
Firepower Device Manager)
Cisco Firepower 1100 Getting Started Guide
2
Which Operating System and Manager is Right for You?
Threat Defense Managers

DescriptionManager
CDO offers two management modes:
• (7.2 and later) Cloud-delivered management center mode with all of the
configuration functionality of an on-premises management center. For the analytics
functionality, you can use either Secure Cloud Analytics in the cloud or an on-prem
management center.
• Device manager mode with a simplified user experience. This mode is not covered
in this guide.
Because CDO is cloud-based, there is no overhead of running CDO on your own servers.
CDO also manages other security devices, such as ASAs, so you can use a single manager
for all of your security devices.
To get started with CDO provisioning, see Threat Defense Deployment with CDO, on
page 109.
Cisco Defense Orchestrator (CDO)
The threat defense REST API lets you automate direct configuration of the threat defense.
This API is compatible with the device manager and CDO use because they can both
discover the configuration on the firewall. You cannot use this API if you are managing
the threat defense using the management center.
The threat defense REST API is not covered in this guide. For more information, see
the Cisco Secure Firewall Threat Defense REST API Guide.
Secure Firewall Threat Defense REST API
The management center REST API lets you automate configuration of management
center policies that can then be applied to managed threat defenses. This API does not
manage the threat defense directly.
The management center REST API is not covered in this guide. For more information,
see the Secure Firewall Management Center REST API Quick Start Guide.
Secure Firewall Management Center REST
API
ASA Managers
Table 2: ASA Managers
DescriptionManager
ASDM is a Java-based, on-device manager that provides full ASA functionality. You
should use ASDM if you prefer using a GUI over the CLI, and you only need to manage
a small number of ASAs. ASDM can discover the configuration on the firewall, so you
can also use the CLI, CDO, or CSM with ASDM.
To get started with ASDM, see ASA Deployment with ASDM, on page 157.
Adaptive Security Device Manager
(ASDM)
You should use the ASA CLI if you prefer CLIs over GUIs.
The CLI is not covered in this guide. For more information, see the ASA configuration
guides.
CLI
Cisco Firepower 1100 Getting Started Guide
3
Which Operating System and Manager is Right for You?
ASA Managers

DescriptionManager
CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some
ASA features are not supported using CDO. You should use CDO if you want a
multi-device manager that offers a simplified management experience. And because
CDO is cloud-based, there is no overhead of running CDO on your own servers. CDO
also manages other security devices, such as threat defenses, so you can use a single
manager for all of your security devices. CDO can discover the configuration on the
firewall, so you can also use the CLI or ASDM.
CDO is not covered in this guide. To get started with CDO, see the CDO home page.
CDO
CSM is a powerful, multi-device manager that runs on its own server hardware. You
should use CSM if you need to manage large numbers of ASAs. CSM can discover the
configuration on the firewall, so you can also use the CLI or ASDM. CSM does not
support managing the threat defenses.
CSM is not covered in this guide. For more information, see the CSM user guide.
Cisco Security Manager (CSM)
The ASA REST API lets you automate ASA configuration. However, the API does not
include all ASA features, and is no longer being enhanced.
The ASA REST API is not covered in this guide. For more information, see the Cisco
ASA Secure Firewall REST API Quick Start Guide.
ASA REST API
Cisco Firepower 1100 Getting Started Guide
4
Which Operating System and Manager is Right for You?
ASA Managers

CHAPTER 2
Threat Defense Deployment with the
Management Center
Is This Chapter for You?
To see all available operating systems and managers, see Which Operating System and Manager is Right for
You?, on page 1. This chapter applies to the threat defense with the management center.
This chapter explains how to complete the initial configuration of your threat defense and how to register the
firewall to the management center located on your management network. For remote branch deployment,
where the management center resides at a central headquarters, see Threat Defense Deployment with a Remote
Management Center, on page 41.
In a typical deployment on a large network, you install multiple managed devices on network segments. Each
device controls, inspects, monitors, and analyzes traffic, and then reports to a managing management center.
The management center provides a centralized management console with a web interface that you can use to
perform administrative, management, analysis, and reporting tasks in service to securing your local network.
About the Firewall
The hardware can run either threat defense software or ASA software. Switching between threat defense and
ASA requires you to reimage the device. You should also reimage if you need a different software version
than is currently installed. See Reimage the Cisco ASA or Firepower Threat Defense Device.
The firewall runs an underlying operating system called the Secure Firewall eXtensible Operating System
(FXOS). The firewall does not support the FXOS Secure Firewall chassis manager; only a limited CLI is
supported for troubleshooting purposes. See the Cisco FXOS Troubleshooting Guide for the Firepower
1000/2100 Series Running Firepower Threat Defense for more information.
Privacy Collection Statement—The firewall does not require or actively collect personally-identifiable
information. However, you can use personally-identifiable information in the configuration, for example for
usernames. In this case, an administrator might be able to see this information when working with the
configuration or when using SNMP.
•Before You Start, on page 6
•End-to-End Procedure, on page 6
•Review the Network Deployment, on page 8
•Cable the Firewall, on page 10
•Power on the Firewall, on page 12
•(Optional) Check the Software and Install a New Version, on page 13
•Complete the Threat Defense Initial Configuration, on page 15
Cisco Firepower 1100 Getting Started Guide
5

•Log Into the Management Center, on page 22
•Obtain Licenses for the Management Center, on page 23
•Register the Threat Defense with the Management Center, on page 24
•Configure a Basic Security Policy, on page 27
•Access the Threat Defense and FXOS CLI, on page 38
•Power Off the Firewall, on page 39
•What's Next?, on page 40
Before You Start
Deploy and perform initial configuration of the management center. See the Cisco Firepower Management
Center 1600, 2600, and 4600 Hardware Installation Guide or Cisco Secure Firewall Management Center
Virtual Getting Started Guide.
End-to-End Procedure
See the following tasks to deploy the threat defense with the management center on your chassis.
Cisco Firepower 1100 Getting Started Guide
6
Threat Defense Deployment with the Management Center
Before You Start

Install the firewall. See the hardware installation guide.Pre-Configuration
Review the Network Deployment, on page 8.Pre-Configuration
Cable the Firewall, on page 10.Pre-Configuration
Power on the Firewall, on page 12.Pre-Configuration
(Optional) Check the Software and Install a New Version, on page 13CLI
Cisco Firepower 1100 Getting Started Guide
7
Threat Defense Deployment with the Management Center
End-to-End Procedure

Complete the Threat Defense Initial Configuration, on page 15.CLI or Device
Manager
Log Into the Management Center, on page 22.Management Center
Obtain Licenses for the Management Center, on page 23: Buy feature licenses.Cisco Commerce
Workspace
Obtain Licenses for the Management Center, on page 23: Generate a license
token for the management center.
Smart Software
Manager
Obtain Licenses for the Management Center, on page 23: Register the
management center with the Smart Licensing server.
Management Center
Register the Threat Defense with the Management Center, on page 24.Management Center
Configure a Basic Security Policy, on page 27.Management Center
Review the Network Deployment
The dedicated Management 1/1 interface is a special interface with its own network settings. By default, the
Management 1/1 interface is enabled and configured as a DHCP client. If your network does not include a
DHCP server, you can set the Management interface to use a static IP address during initial setup at the console
port. You can configure other interfaces after you connect the threat defense to the management center.
In 6.5 and earlier, the Management interface is configured with an IP address (192.168.45.45).
Note
See the following sample network deployments for ideas on how to place your threat defense device in your
network.
Separate Management Network
Both the management center and threat defense require internet access from Management for licensing and
updates.
The following figure shows a possible network deployment for the Firepower 1100 where the management
center and management computer connect to the management network. The management network has a path
to the internet for licensing and updates.
Cisco Firepower 1100 Getting Started Guide
8
Threat Defense Deployment with the Management Center
Review the Network Deployment