Cisco Firepower 1010 User manual

Getting Started
The following topics explain how to get started configuring the Firepower Threat Defense (FTD) .
•Is This Guide for You?, on page 1
•New Features in FDM/FTD Version 7.1.0, on page 2
•Logging Into the System, on page 7
•Setting Up the System, on page 11
•Configuration Basics, on page 32
Is This Guide for You?
This guide explains how to configure Firepower Threat Defense using the Firepower Device Manager (FDM)
web-based configuration interface included on the Firepower Threat Defense devices.
The FDM lets you configure the basic features of the software that are most commonly used for small or
mid-size networks. It is especially designed for networks that include a single device or just a few, where you
do not want to use a high-powered multiple-device manager to control a large network containing many
Firepower Threat Defense devices.
If you are managing large numbers of devices, or if you want to use the more complex features and
configurations that Firepower Threat Defense allows, use the Firepower Management Center (FMC) to
configure your devices instead of the integrated FDM.
You can use the FDM on the following devices.
Table 1: FDM Supported Models
Minimum FTD Software VersionDevice Model
6.4Firepower 1010, 1120, 1140
6.5Firepower 1150
6.2.1Firepower 2110, 2120, 2130, 2140
7.1Secure Firewall 3110, 3120, 3130, 3140
6.5Firepower 4110, 4115, 4120, 4125, 4140, 4145, 4150
6.6Firepower 4112
Getting Started
1

Minimum FTD Software VersionDevice Model
6.5Firepower 9300
6.2.2FTDv (FTDv)for VMware
6.2.3FTDv for Kernel-based Virtual Machine (KVM) hypervisor
6.5FTDv for the Microsoft Azure Cloud
6.6FTDv for the Amazon Web Services (AWS) Cloud
6.1ASA 5508-X, 5516-X
Support for these models ends with 7.0 being the last
allowed version. You cannot install version 7.1 or later on
these models.
Note
6.2.3ISA 3000 (Cisco 3000 Series Industrial Security Appliances)
New Features in FDM/FTD Version 7.1.0
Released: December 1, 2021
The following table lists the new features available in Firepower Threat Defense 7.1.0 when configured using
FDM.
DescriptionFeature
Platform Features
We introduced the Secure Firewall 3110, 3120, 3130, and 3140.
You can hot swap a network module of the same type while the firewall
is powered up without having to reboot; making other module changes
requires a reboot. Secure Firewall 3100 25 Gbps interfaces support
Forward Error Correction as well as speed detection based on the SFP
installed. The SSDs are self-encrypting drives (SEDs), and if you have
2 SSDs, they form a software RAID.
Note that the Version 7.1 device manager does not include online help
for these devices. See the documentation posted on Cisco.com.
New/Modified screens: Device >Interfaces
New/Modified Firepower Threat Defense commands: configurenetwork
speed, configure raid, show raid, show ssd
Secure Firewall 3100
Getting Started
2
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
FTDv for AWS adds support for these instances:
• c5a.xlarge, c5a.2xlarge, c5a.4xlarge
• c5ad.xlarge, c5ad.2xlarge, c5ad.4xlarge
• c5d.xlarge, c5d.2xlarge, c5d.4xlarge
• c5n.xlarge, c5n.2xlarge, c5n.4xlarge
• i3en.xlarge, i3en.2xlarge, i3en.3xlarge
• inf1.xlarge, inf1.2xlarge
• m5.xlarge, m5.2xlarge, m5.4xlarge
• m5a.xlarge, m5a.2xlarge, m5a.4xlarge
• m5ad.xlarge, m5ad.2xlarge, m5ad.4xlarge
• m5d.xlarge, m5d.2xlarge, m5d.4xlarge
• m5dn.xlarge, m5dn.2xlarge, m5dn.4xlarge
• m5n.xlarge, m5n.2xlarge, m5n.4xlarge
• m5zn.xlarge, m5zn.2xlarge, m5zn.3xlarge
• r5.xlarge, r5.2xlarge, r5.4xlarge
• r5a.xlarge, r5a.2xlarge, r5a.4xlarge
• r5ad.xlarge, r5ad.2xlarge, r5ad.4xlarge
• r5b.xlarge, r5b.2xlarge, r5b.4xlarge
• r5d.xlarge, r5d.2xlarge, r5d.4xlarge
• r5dn.xlarge, r5dn.2xlarge, r5dn.4xlarge
• r5n.xlarge, r5n.2xlarge, r5n.4xlarge
• z1d.xlarge, z1d.2xlarge, z1d.3xlarge
FTDv for AWS instances.
FTDv for Azure adds support for these instances:
• Standard_D8s_v3
• Standard_D16s_v3
• Standard_F8s_v2
• Standard_F16s_v2
FTDv for Azure instances.
You cannot install Firepower Threat DefenseFirepower Threat Defense
7.1 on an ASA 5508-X or 5516-X. The last supported release for these
models is Firepower Threat Defense 7.0.
Support ends for the ASA 5508-X
and 5516-X. The last supported
release is Firepower Threat Defense
7.0.
Getting Started
3
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
Firewall and IPS Features
You can use FDM to configure the Network Analysis Policy (NAP)
when running Snort 3. Network analysis policies control traffic
preprocessing inspection. Inspectors prepare traffic to be further
inspected by normalizing traffic and identifying protocol anomalies.
You can select which NAP is used for all traffic, and customize the
settings to work best with the traffic in your network. You cannot
configure the NAP when running Snort 2.
We added the Network Analysis Policy to the Policies >Intrusion
settings dialog box, with an embedded JSON editor to allow direct
changes, and other features to let you upload overrides, or download
the ones you create.
Network Analysis Policy (NAP)
configuration for Snort 3.
You can use an FQDN network object, such as one specifying
www.example.com, as the translated destination address in manual NAT
rules. The system configures the rule based on the IP address returned
from the DNS server.
Manual NAT support for
fully-qualified domain name
(FQDN) objects as the translated
destination.
You can configure active authentication for identity policy rules to
redirect the user’s authentication to a fully-qualified domain name
(FQDN) rather than the IP address of the interface through which the
user’s connection enters the device. The FQDN must resolve to the IP
address of one of the interfaces on the device. By using an FQDN, you
can assign a certificate for active authentication that the client will
recognize, thus avoiding the untrusted certificate warning users get when
being redirected to an IP address. The certificate can specify the FQDN,
a wildcard FQDN, or multiple FQDNs in the Subject Alternate Names
(SAN) in the certificate.
We added the Redirect to Host Name option in the identity policy
settings.
Improved active authentication for
identity rules.
VPN Features
You can configure a site-to-site VPN connection to include remote
backup peers. If the primary remote peer is unavailable, the system will
try to re-establish the VPN connection using one of the backup peers.
You can configure separate pre-shared keys or certificates for each
backup peer. Backup peers are supported for policy-based connections
only, and are not available for route-based (virtual tunnel interface)
connections.
We updated the site-to-site VPN wizard to include backup peer
configuration.
Backup remote peers for site-to-site
VPN.
Getting Started
4
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
You can enable password management for remote access VPN. This
allows AnyConnect to prompt the user to change an expired password.
Without password management, users must change expired passwords
directly with the AAA server, and AnyConnect does not prompt the user
to change passwords. For LDAP servers, you can also set a warning
period to notify users of upcoming password expiration.
We added the Enable Password Management option to the authentication
settings for remote access VPN connection profiles.
Password management for remote
access VPN (MSCHAPv2).
When you use SAML as the primary authentication method for a remote
access VPN connection profile, you can elect to have the AnyConnect
client use the client’s local browser instead of the AnyConnect embedded
browser to perform the web authentication. This option enables single
sign-on (SSO) between your VPN authentication and other corporate
logins. Also choose this option if you want to support web authentication
methods, such as biometric authentication, that cannot be performed in
the embedded browser.
We updated the remote access VPN connection profile wizard to allow
you to configure the SAML Login Experience.
AnyConnect VPN SAML External
Browser
Administrative and Troubleshooting Features
You can configure DDNS for the interfaces on the system to send
dynamic updates to DNS servers. This helps ensure that FQDNs defined
for the interfaces resolve to the correct address, making it easier for
users to access the system using a hostname rather than an IP address.
This is especially useful for interfaces that get their addresses using
DHCP, but it is also useful for statically-addressed interfaces.
After upgrade, if you had used FlexConfig to configure DDNS, you
must redo your configuration using FDM or the Firepower Threat
Defense API, and remove the DDNS FlexConfig object from the
FlexConfig policy, before you can deploy changes again.
If you configure DDNS using FDM, then switch to FMC management,
the DDNS configuration is retained so that FMC can find the system
using the DNS name.
In FDM, we added the System Settings >DDNS Service page. In the
Firepower Threat Defense API, we added the DDNSService and
DDNSInterfaceSettings resources.
Dynamic Domain Name System
(DDNS) support for updating
fully-qualified domain name
(FQDN) to IP address mappings for
system interfaces.
To look up the IP address of a fully-qualified domain name (FQDN) in
the device CLI, use the digcommand. The nslookup command has been
removed.
The dig command replaces the
nslookup command in the device
CLI.
Getting Started
5
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
You can use FDM to configure DHCP relay. Using DHCP relay on an
interface, you can direct DHCP requests to a DHCP server that is
accessible through the other interface. You can configure DHCP relay
on physical interfaces, subinterfaces, EtherChannels, and VLAN
interfaces. You cannot configure DHCP relay if you configure a DHCP
server on any interface.
We added the System Settings >DHCP >DHCP Relay page, and
moved DHCP Server under the new DHCP heading.
DHCP relay configuration using
FDM.
You can specify the key type and size when generating new self-signed
internal and internal CA certificates in FDM. Key types include RSA,
ECDSA, and EDDSA. The allowed sizes differ by key type. We now
warn you if you upload a certificate whose key size is smaller than the
minimum recommended length. There is also a weak key pre-defined
search filter to help you find weak certificates, which you should replace
if possible.
Key type and size for self-signed
certificates in FDM.
You can specify whether a trusted CA certificate can be used to validate
certain types of connections. You can allow, or prevent, validation for
SSL server (used by dynamic DNS), SSL client (used by remote access
VPN), IPsec client (used by site-to-site VPN), or other features that are
not managed by the Snort inspection engine, such as LDAPS. The
primary purpose of these options is to let you prevent VPN connections
from getting established because they can be validated against a
particular certificate.
We added Validation Usage as a property for trusted CA certificates.
Usage validation restrictions for
trusted CA certificates.
During initial system configuration in FDM, or when you change the
admin password through FDM, you can now click a button to generate
a random 16 character password.
Generating the admin password in
FDM.
The show version command now includes information on how long it
took to start (boot) up the system. Note that the larger the configuration,
the longer it takes to boot up the system.
The new show asp rule-engine command shows status on tmatch
compilation. Tmatch compilation is used for an access list that is used
as an access group, the NAT table, and some other items. It is an internal
process that can consume CPU resources and impact performance while
in progress, if you have very large ACLs and NAT tables. Compilation
time depends on the size of the access list, NAT table, and so forth.
Startup time and tmatch
compilation status.
The output of the show access-list element-count command has been
enhanced. When used with object-group search enabled, the output
includes details about the number of object groups in the element count.
In addition, the show tech-support output now includes the output from
show access-list element-count and show asp rule-engine.
Enhancements to show access-list
element-count output.
Getting Started
6
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
When you perform initial setup using FDM, all interface configuration
completed in FDM is retained when you switch to FMC for management,
in addition to the Management and FMC access settings. Note that other
default configuration settings, such as the access control policy or
security zones, are not retained. When you use the Firepower Threat
Defense CLI, only the Management and FMC access settings are retained
(for example, the default inside interface configuration is not retained).
After you switch to FMC, you can no longer use FDM to manage the
Firepower Threat Defense.
New/Modified screens: System Settings >Management Center
Use FDM to configure the
Firepower Threat Defense for
management by a FMC.
The local CA bundle contains certificates to access several Cisco
services. The system now automatically queries Cisco for new CA
certificates at a daily system-defined time. Previously, you had to
upgrade the software to update CA certificates. You can use the CLI to
disable this feature.
This feature is not supported in Version 7.0.0–7.0.4,
7.1.0–7.1.0.2, or 7.2.0–7.2.3. If you upgrade from a
supported version to an unsupported version, the feature
is temporarily disabled and the system stops contacting
Cisco.
Note
New/modified CLI commands: configure cert-update auto-update,
configure cert-update run-now,configure cert-update test,show
cert-update
For more information, see the Cisco Secure Firewall Threat Defense
Command Reference.
Automatically update CA bundles
The Firepower Threat Defense REST API for software version 7.1 is
version 6.2. You can use v6 in the API URLs, or preferentially, use
/latest/ to signify you are using the most recent API version that is
supported on the device. Note that the URL version path element for
6.2 is the same as 6.0/1: v6.
Please re-evaluate all existing calls, as changes might have been mode
to the resource models you are using. To open the API Explorer, where
you can view the resources, log into FDM, then click the more options
button ( ) and choose API Explorer.
FTD REST API version 6.2 (v6).
Logging Into the System
There are two interfaces to the Firepower Threat Defense device:
FDM Web Interface
The FDM runs in your web browser. You use this interface to configure, manage, and monitor the system.
Getting Started
7
Getting Started
Logging Into the System

Command Line Interface (CLI, Console)
Use the CLI for troubleshooting. You can also use it for initial setup instead of the FDM.
The following topics explain how to log into these interfaces and manage your user account.
Your User Role Controls What You Can See and Do
Your username is assigned a role, and your role determines what you can do or what you can see in the FDM.
The locally-defined admin user has all privileges, but if you log in using a different account, you might have
fewer privileges.
The upper-right corner of the FDM window shows your username and privilege level.
The privileges are:
•Administrator—You can see and use all features.
•Read-Write User—You can do everything a read-only user can do, and you can also edit and deploy
the configuration. The only restrictions are for system-critical actions, which include installing upgrades,
creating and restoring backups, viewing the audit log, and ending the sessions of other FDM users.
•Read-Only User—You can view dashboards and the configuration, but you cannot make any changes.
If you try to make a change, the error message explains that this is due to lack of permission.
These privileges are not related to those available for CLI users.
Logging Into the FDM
Use the FDM to configure, manage, and monitor the system. The features that you can configure through the
browser are not configurable through the command-line interface (CLI); you must use the web interface to
implement your security policies.
Use a current version of the following browsers: Firefox, Chrome, Safari, Edge.
If you type in the wrong password and fail to log in on 3 consecutive attempts, your account is locked for 5
minutes. You must wait before trying to log in again.
Note
Before you begin
Initially, you can log into the FDM using the admin username only. However, you can then configure
authorization for additional users defined in an external AAA server, as described in Managing FDM and
FTD User Access.
There can be up to 5 active logins at one time. This includes users logged into the device manager and active
API sessions, which are represented by non-expired API tokens. If you exceed this limit, the oldest session,
either the device manager login or API token, is expired to allow the new session. These limits do not apply
to SSH sessions.
Getting Started
8
Getting Started
Your User Role Controls What You Can See and Do

Procedure
Step 1 Using a browser, open the home page of the system, for example, https://ftd.example.com.
You can use any of the following addresses. You can use the IPv4 or IPv6 address or the DNS name, if you
have configured one.
• The management address. By default (on most platforms), the Management interface is a DHCP client,
so the IP address depends on your DHCP server.
• The address of a data interface that you have opened for HTTPS access. By default (on most platforms),
the “inside” interface allows HTTPS access, so you can connect to the default inside address 192.168.95.1.
See Default Configuration Prior to Initial Setup, on page 26 for details about your model's inside IP
address.
If you changed the HTTPS data port, you must include the custom port in the URL. For example, if you
changed the port to 4443: https://ftd.example.com:4443
If your browser is not configured to recognize the server certificate, you will see a warning about
an untrusted certificate. Accept the certificate as an exception, or in your trusted root certificate
store.
Tip
Step 2 Enter your username and password defined for the device, then click Login.
You can use the admin username, which is a pre-defined user. The default admin password is Admin123. On
AWS, the default admin password is the AWS Instance ID, unless you define a default password with user
data (Advanced Details >User Data) during the initial deployment.
Your session will expire after 30 minutes of inactivity, and you will be prompted to log in again. You can log
out by selecting Log Out from the user icon drop-down menu in the upper right of the page.
Logging Into the Command Line Interface (CLI)
Use the command-line interface (CLI) to set up the system and do basic system troubleshooting. You cannot
configure policies through a CLI session.
To log into the CLI, do one of the following:
•Use the console cable included with the device to connect your PC to the console using a terminal emulator
set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. See the hardware guide for your
device for more information about the console cable.
Getting Started
9
Getting Started
Logging Into the Command Line Interface (CLI)

On the Firepower and Secure Firewall device models, the CLI on the Console
port is the Firepower eXtensible Operating System (FXOS). For the Firepower
1000/2100, you can get to the Firepower Threat Defense CLI using the connect
ftd command. For the Firepower 4100/9300, see Connect to the Console of the
Application. Use the FXOS CLI for chassis-level troubleshooting only. Use the
Firepower Threat Defense CLI for basic configuration, monitoring, and normal
system troubleshooting. See the FXOS documentation for information on FXOS
commands.
Note
• For the FTDv, open the virtual console.
• Use an SSH client to make a connection to the management IP address. You can also connect to the
address on a data interface if you open the interface for SSH connections (see Configuring the Management
Access List). SSH access to data interfaces is disabled by default. Log in using the admin username or
another CLI user account. The default admin password is Admin123. On AWS, the default admin
password for the FTDv is the AWS Instance ID, unless you define a default password with user data
(Advanced Details >User Data) during the initial deployment.
Tips
• After logging in, for information on the commands available in the CLI, enter help or ?. For usage
information, see Cisco Firepower Threat Defense Command Reference at http://www.cisco.com/c/en/
us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense.html.
• You can create local user accounts that can log into the CLI using the configure user add command.
However, these users can log into the CLI only. They cannot log into the FDM web interface.
• You can create user accounts for SSH access in an external server. For information about configuring
external authentication for SSH access, see Configuring External Authorization (AAA) for the FTD CLI
(SSH) Users.
Changing Your Password
You should periodically change your password. The following procedure explains how to change the password
while logged into FDM.
If you are logged into the CLI, you can change your password using the configure password command. You
can change the password for a different CLI user with the configure user password username command.
Note
Before you begin
This procedure applies to local users only. If your user account is defined on an external AAA server, you
must change your password with that server.
Getting Started
10
Getting Started
Changing Your Password

Procedure
Step 1 Select Profile from the user icon drop-down list in the upper right of the menu.
Step 2 Click the Password tab.
Step 3 Enter your current password.
Step 4 Enter your new password and then confirm it.
You can click Generate to have a random 16 character password generated for you. Click the Show Password
( ) button to see the passwords unmasked. Then, click the Copy To Clipboard link so you can paste the
password in the confirmation field.
Step 5 Click Change.
Setting User Profile Preferences
You can set preferences for the user interface and change your password.
Procedure
Step 1 Select Profile from the user icon drop-down list in the upper right of the menu.
Step 2 On the Profile tab, configure the following and click Save.
•Time Zone for Scheduling Tasks—Select the time zone you want to use for scheduling tasks such as
backups and updates. The browser time zone is used for dashboards and events, if you set a different
zone.
•Color Theme—Select the color theme you want to use in the user interface.
Step 3 On the Password tab, you can enter a new password and click Change.
Setting Up the System
You must complete an initial configuration to make the system function correctly in your network. Successful
deployment includes attaching cables correctly and configuring the addresses needed to insert the device into
your network and connect it to the Internet or other upstream router. The following procedure explains the
process.
Getting Started
11
Getting Started
Setting User Profile Preferences

Before you begin
Before you start the initial setup, the device includes some default settings. For details, see Default Configuration
Prior to Initial Setup, on page 26.
Procedure
Step 1 Connect the Interfaces, on page 12
Step 2 Complete the Initial Configuration Using the Setup Wizard, on page 23
For details about the resulting configuration, see Configuration After Initial Setup, on page 29.
Connect the Interfaces
The default configuration assumes that certain interfaces are used for the inside and outside networks. Initial
configuration will be easier to complete if you connect network cables to the interfaces based on these
expectations.
The default configuration for most models is designed to let you attach your management computer to the
inside interface. Alternatively, you can also directly attach your workstation to the Management port. The
interfaces are on different networks, so do not try to connect any of the inside interfaces and the Management
port to the same network.
Do not connect any of the inside interfaces to a network that has an active DHCP server. This will conflict
with the DHCP server already running on the inside interface . If you want to use a different DHCP server
for the network, disable the unwanted DHCP server after initial setup.
The following topics show how to cable the system for this topology when using the inside interfaces to
configure the device.
Getting Started
12
Getting Started
Connect the Interfaces

Cabling for the Firepower 1010
Figure 1: Cabling the Firepower 1010
• Connect your management computer to one of the following interfaces:
• Ethernet 1/2 through 1/8—Connect your management computer directly to one of the inside switch
ports (Ethernet 1/2 through 1/8). inside has a default IP address (192.168.95.1) and also runs a
DHCP server to provide IP addresses to clients (including the management computer), so make sure
these settings do not conflict with any existing inside network settings.
• Management 1/1—Connect your management computer to the management network. The
Management 1/1 interface obtains an IP address from DHCP, so make sure your network includes
a DHCP server.
If you need to change the Management 1/1 IP address from the default to configure a static IP
address, you must also cable your management computer to the console port. See (Optional) Change
Management Network Settings at the CLI, on page 21.
You can later configure management access from other interfaces.
• Connect the outside network to the Ethernet 1/1 interface.
By default, the IP address is obtained using IPv4 DHCP and IPv6 autoconfiguration, but you can set a
static address during initial configuration.
• Connect inside devices to the remaining switch ports, Ethernet 1/2 through 1/8.
Ethernet 1/7 and 1/8 are Power over Ethernet+ (PoE+) ports.
Getting Started
13
Getting Started
Cabling for the Firepower 1010

Cabling for the Firepower 1100
Figure 2: Cabling the Firepower 1100
• Connect your management computer to either of the following interfaces:
•Ethernet 1/2—Connect your management computer directly to Ethernet 1/2 for initial configuration,
or connect Ethernet 1/2 to your inside network. Ethernet 1/2 has a default IP address (192.168.95.1)
and also runs a DHCP server to provide IP addresses to clients (including the management computer),
so make sure these settings do not conflict with any existing inside network settings.
• Management 1/1 (labeled MGMT)—Connect your management computer to the management
network. The Management 1/1 interface obtains an IP address from DHCP, so make sure your
network includes a DHCP server.
If you need to change the Management 1/1 IP address from the default to configure a static IP
address, you must also cable your management computer to the console port. See (Optional) Change
Management Network Settings at the CLI, on page 21.
You can later configure management access from other interfaces.
• Connect the outside network to the Ethernet1/1 interface (labeled WAN).
By default, the IP address is obtained using IPv4 DHCP and IPv6 autoconfiguration, but you can set a
static address during initial configuration.
• Connect other networks to the remaining interfaces.
Getting Started
14
Getting Started
Cabling for the Firepower 1100

Cabling for the Firepower 2100
Figure 3: Cabling the Firepower 2100
• Connect your management computer to either of the following interfaces:
•Ethernet 1/2—Connect your management computer directly to Ethernet 1/2 for initial configuration,
or connect Ethernet 1/2 to your inside network. Ethernet 1/2 has a default IP address (192.168.95.1)
and also runs a DHCP server to provide IP addresses to clients (including the management computer),
so make sure these settings do not conflict with any existing inside network settings
• Management 1/1 (labeled MGMT)—Connect your management computer to the management
network. The Management 1/1 interface obtains an IP address from DHCP, so make sure your
network includes a DHCP server.
If you need to change the Management 1/1 IP address from the default to configure a static IP
address, you must also cable your management computer to the console port. See (Optional) Change
Management Network Settings at the CLI, on page 21.
You can later configure management access from other interfaces.
• Connect the outside network to the Ethernet1/1 interface (labeled WAN).
By default, the IP address is obtained using IPv4 DHCP and IPv6 autoconfiguration, but you can set a
static address during initial configuration.
• Connect other networks to the remaining interfaces.
Getting Started
15
Getting Started
Cabling for the Firepower 2100

Cabling for the Secure Firewall 3100
Figure 4: Cabling the Secure Firewall 3100
Manage the FTD device on either Management 1/1 or Ethernet 1/2. The default configuration also configures
Ethernet1/1 as outside.
• Connect your management computer to either of the following interfaces:
•Ethernet 1/2—Connect your management computer directly to Ethernet 1/2 for initial configuration,
or connect Ethernet 1/2 to your inside network. Ethernet 1/2 has a default IP address (192.168.95.1)
and also runs a DHCP server to provide IP addresses to clients (including the management computer),
so make sure these settings do not conflict with any existing inside network settings.
• Management 1/1—Connect Management 1/1 to your management network, and make sure your
management computer is on—or has access to—the management network. Management 1/1 obtains
an IP address from a DHCP server on your management network; if you use this interface, you must
determine the IP address assigned to the firewall so that you can connect to the IP address from
your management computer.
If you need to change the Management 1/1 IP address from the default to configure a static IP
address, you must also cable your management computer to the console port. See (Optional) Change
Management Network Settings at the CLI, on page 21.
Management 1/1 is a 10-Gb fiber interface that requires an SFP module.
Note
• Connect the outside network to the Ethernet1/1 interface.
By default, the IP address is obtained using IPv4 DHCP and IPv6 autoconfiguration, but you can set a
static address during initial configuration.
• Connect other networks to the remaining interfaces.
Getting Started
16
Getting Started
Cabling for the Secure Firewall 3100

Cabling for the Firepower 4100
Perform the initial Firepower Threat Defense configuration on the logical device Management interface. You
can later enable management from any data interface. The Firepower Threat Defense device requires internet
access for licensing and updates, and the default behavior is to route management traffic to the gateway IP
address you specified when you deployed the device. If you want to route management traffic over the
backplane to the data interfaces instead, you can configure that setting in the FDM later.
Cable the following interfaces for initial chassis setup, continued monitoring, and logical device use.
• Console port—Connect your management computer to the console port to perform initial setup of the
chassis. The Firepower 4100 includes an RS-232–to–RJ-45 serial console cable. You might need to use
a third party serial-to-USB cable to make the connection.
• Chassis Management port—Connect the chassis management port to your management network for
configuration and ongoing chassis management.
•FTD Logical device Management interface—You can choose any interface on the chassis for this purpose
other than the chassis management port, which is reserved for FXOS management.
• Data interfaces—Connect the data interfaces to your logical device data networks. You can configure
physical interfaces, EtherChannels, and breakout ports to divide up high-capacity interfaces.
For High Availability, use a Data interface for the failover/state link.
All interfaces other than the console port require SFP/SFP+/QSFP transceivers. See the hardware installation
guide for supported transceivers.
Note
Getting Started
17
Getting Started
Cabling for the Firepower 4100

Cabling for the Firepower 9300
Perform the initial Firepower Threat Defense configuration on the logical device Management interface. You
can later enable management from any data interface. The Firepower Threat Defense device requires internet
access for licensing and updates, and the default behavior is to route management traffic to the gateway IP
address you specified when you deployed the device. If you want to route management traffic over the
backplane to the data interfaces instead, you can configure that setting in the FDM later.
Cable the following interfaces for initial chassis setup, continued monitoring, and logical device use.
• Console port—Connect your management computer to the console port to perform initial setup of the
chassis. The Firepower 9300 includes an RS-232–to–RJ-45 serial console cable. You might need to use
a third party serial-to-USB cable to make the connection.
• Chassis Management port—Connect the chassis management port to your management network for
configuration and ongoing chassis management.
• Logical device Management interface—Use one or more interfaces to manage logical devices. You can
choose any interfaces on the chassis for this purpose other than the chassis management port, which is
reserved for FXOS management. Management interfaces can be shared among logical devices, or you
can use a separate interface per logical device. Typically, you share a management interface with all
logical devices, or if you use separate interfaces, put them on a single management network. But your
exact network requirements may vary.
• Data interfaces—Connect the data interfaces to your logical device data networks. You can configure
physical interfaces, EtherChannels, and breakout ports to divide up high-capacity interfaces. You can
cable multiple logical devices to the same networks or to different networks, as your network needs
dictate. All traffic must exit the chassis on one interface and return on another interface to reach another
logical device.
For High Availability, use a Data interface for the failover/state link.
Getting Started
18
Getting Started
Cabling for the Firepower 9300

All interfaces other than the console port require SFP/SFP+/QSFP transceivers. See the hardware installation
guide for supported transceivers.
Note
Virtual Cabling for the FTDv
To install the FTDv, see the quick start guide for your virtual platform at http://www.cisco.com/c/en/us/support/
security/firepower-ngfw-virtual/products-installation-guides-list.html. The FDM is supported on the following
virtual platforms: VMware, KVM, Microsoft Azure, Amazon Web Services (AWS).
The FTDv default configuration puts the management interface and inside interface on the same subnet. You
must have Internet connectivity on the management interface in order to use Smart Licensing and to obtain
updates to system databases.
Thus, the default configuration is designed so that you can connect both the Management0/0 and
GigabitEthernet0/1 (inside) to the same network on the virtual switch. The default management address uses
the inside IP address as the gateway. Thus, the management interface routes through the inside interface, then
through the outside interface, to get to the Internet.
You also have the option of attaching Management0/0 to a different subnet than the one used for the inside
interface, as long as you use a network that has access to the Internet. Ensure that you configure the management
interface IP address and gateway appropriately for the network.
Note that the management interface IP configuration is defined on Device >System Settings >Management
Interface. It is not the same as the IP address for the Management0/0 (diagnostic) interface listed on Device >
Interfaces >View Configuration.
How VMware Network Adapters and Interfaces Map to the FTD Physical Interfaces
You can configure up to 10 interfaces for a VMware FTDv device. You must configure a minimum of 4
interfaces.
Ensure that the Management0-0 source network is associated to a VM network that can access the Internet.
This is required so that the system can contact the Cisco Smart Software Manager and also to download system
database updates.
You assign the networks when you install the OVF. As long as you configure an interface, you can later
change the virtual network through the VMware Client. However, if you need to add a new interface, be sure
to add an interface at the end of the list; if you add or remove an interface anywhere else, then the hypervisor
will renumber your interfaces, causing the interface IDs in your configuration to line up with the wrong
interfaces.
The following table explains how the VMware network adapter and source interface map to the FTDv physical
interface names. For additional interfaces, the naming follows the same pattern, increasing the relevant numbers
by one. All additional interfaces are data interfaces. For more information on assigning virtual networks to
virtual machines, see the VMware online help.
Table 2: Source to Destination Network Mapping
Function
Destination Network
(Physical Interface Name)Source NetworkNetwork Adapter
ManagementManagement0/0Management0-0Network adapter 1
Getting Started
19
Getting Started
Virtual Cabling for the FTDv

Function
Destination Network
(Physical Interface Name)Source NetworkNetwork Adapter
DiagnosticDiagnostic0/0Diagnostic0-0Network adapter 2
Outside dataGigabitEthernet0/0GigabitEthernet0-0Network adapter 3
Inside dataGigabitEthernet0/1GigabitEthernet0-1Network adapter 4
Data trafficGigabitEthernet0/2GigabitEthernet0-2Network adapter 5
Data trafficGigabitEthernet0/3GigabitEthernet0-3Network adapter 6
Data trafficGigabitEthernet0/4GigabitEthernet0-4Network adapter 7
Data trafficGigabitEthernet0/5GigabitEthernet0-5Network adapter 8
Data trafficGigabitEthernet0/6GigabitEthernet0-6Network adapter 9
Data trafficGigabitEthernet0/7GigabitEthernet0-7Network adapter 10
Cabling for ISA 3000
Figure 5: ISA 3000
• Connect GigabitEthernet 1/1 to an outside router, and GigabitEthernet 1/2 to an inside router.
Getting Started
20
Getting Started
Cabling for ISA 3000