Cisco Firepower 1010 User manual

Getting Started
The following topics explain how to get started configuring the Firepower Threat Defense (FTD) .
•Is This Guide for You?, on page 1
•New Features in FDM/FTD Version 7.1.0, on page 2
•Logging Into the System, on page 7
•Setting Up the System, on page 11
•Configuration Basics, on page 32
Is This Guide for You?
This guide explains how to configure Firepower Threat Defense using the Firepower Device Manager (FDM)
web-based configuration interface included on the Firepower Threat Defense devices.
The FDM lets you configure the basic features of the software that are most commonly used for small or
mid-size networks. It is especially designed for networks that include a single device or just a few, where you
do not want to use a high-powered multiple-device manager to control a large network containing many
Firepower Threat Defense devices.
If you are managing large numbers of devices, or if you want to use the more complex features and
configurations that Firepower Threat Defense allows, use the Firepower Management Center (FMC) to
configure your devices instead of the integrated FDM.
You can use the FDM on the following devices.
Table 1: FDM Supported Models
Minimum FTD Software VersionDevice Model
6.4Firepower 1010, 1120, 1140
6.5Firepower 1150
6.2.1Firepower 2110, 2120, 2130, 2140
7.1Secure Firewall 3110, 3120, 3130, 3140
6.5Firepower 4110, 4115, 4120, 4125, 4140, 4145, 4150
6.6Firepower 4112
Getting Started
1

Minimum FTD Software VersionDevice Model
6.5Firepower 9300
6.2.2FTDv (FTDv)for VMware
6.2.3FTDv for Kernel-based Virtual Machine (KVM) hypervisor
6.5FTDv for the Microsoft Azure Cloud
6.6FTDv for the Amazon Web Services (AWS) Cloud
6.1ASA 5508-X, 5516-X
Support for these models ends with 7.0 being the last
allowed version. You cannot install version 7.1 or later on
these models.
Note
6.2.3ISA 3000 (Cisco 3000 Series Industrial Security Appliances)
New Features in FDM/FTD Version 7.1.0
Released: December 1, 2021
The following table lists the new features available in Firepower Threat Defense 7.1.0 when configured using
FDM.
DescriptionFeature
Platform Features
We introduced the Secure Firewall 3110, 3120, 3130, and 3140.
You can hot swap a network module of the same type while the firewall
is powered up without having to reboot; making other module changes
requires a reboot. Secure Firewall 3100 25 Gbps interfaces support
Forward Error Correction as well as speed detection based on the SFP
installed. The SSDs are self-encrypting drives (SEDs), and if you have
2 SSDs, they form a software RAID.
Note that the Version 7.1 device manager does not include online help
for these devices. See the documentation posted on Cisco.com.
New/Modified screens: Device >Interfaces
New/Modified Firepower Threat Defense commands: configurenetwork
speed, configure raid, show raid, show ssd
Secure Firewall 3100
Getting Started
2
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
FTDv for AWS adds support for these instances:
• c5a.xlarge, c5a.2xlarge, c5a.4xlarge
• c5ad.xlarge, c5ad.2xlarge, c5ad.4xlarge
• c5d.xlarge, c5d.2xlarge, c5d.4xlarge
• c5n.xlarge, c5n.2xlarge, c5n.4xlarge
• i3en.xlarge, i3en.2xlarge, i3en.3xlarge
• inf1.xlarge, inf1.2xlarge
• m5.xlarge, m5.2xlarge, m5.4xlarge
• m5a.xlarge, m5a.2xlarge, m5a.4xlarge
• m5ad.xlarge, m5ad.2xlarge, m5ad.4xlarge
• m5d.xlarge, m5d.2xlarge, m5d.4xlarge
• m5dn.xlarge, m5dn.2xlarge, m5dn.4xlarge
• m5n.xlarge, m5n.2xlarge, m5n.4xlarge
• m5zn.xlarge, m5zn.2xlarge, m5zn.3xlarge
• r5.xlarge, r5.2xlarge, r5.4xlarge
• r5a.xlarge, r5a.2xlarge, r5a.4xlarge
• r5ad.xlarge, r5ad.2xlarge, r5ad.4xlarge
• r5b.xlarge, r5b.2xlarge, r5b.4xlarge
• r5d.xlarge, r5d.2xlarge, r5d.4xlarge
• r5dn.xlarge, r5dn.2xlarge, r5dn.4xlarge
• r5n.xlarge, r5n.2xlarge, r5n.4xlarge
• z1d.xlarge, z1d.2xlarge, z1d.3xlarge
FTDv for AWS instances.
FTDv for Azure adds support for these instances:
• Standard_D8s_v3
• Standard_D16s_v3
• Standard_F8s_v2
• Standard_F16s_v2
FTDv for Azure instances.
You cannot install Firepower Threat DefenseFirepower Threat Defense
7.1 on an ASA 5508-X or 5516-X. The last supported release for these
models is Firepower Threat Defense 7.0.
Support ends for the ASA 5508-X
and 5516-X. The last supported
release is Firepower Threat Defense
7.0.
Getting Started
3
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
Firewall and IPS Features
You can use FDM to configure the Network Analysis Policy (NAP)
when running Snort 3. Network analysis policies control traffic
preprocessing inspection. Inspectors prepare traffic to be further
inspected by normalizing traffic and identifying protocol anomalies.
You can select which NAP is used for all traffic, and customize the
settings to work best with the traffic in your network. You cannot
configure the NAP when running Snort 2.
We added the Network Analysis Policy to the Policies >Intrusion
settings dialog box, with an embedded JSON editor to allow direct
changes, and other features to let you upload overrides, or download
the ones you create.
Network Analysis Policy (NAP)
configuration for Snort 3.
You can use an FQDN network object, such as one specifying
www.example.com, as the translated destination address in manual NAT
rules. The system configures the rule based on the IP address returned
from the DNS server.
Manual NAT support for
fully-qualified domain name
(FQDN) objects as the translated
destination.
You can configure active authentication for identity policy rules to
redirect the user’s authentication to a fully-qualified domain name
(FQDN) rather than the IP address of the interface through which the
user’s connection enters the device. The FQDN must resolve to the IP
address of one of the interfaces on the device. By using an FQDN, you
can assign a certificate for active authentication that the client will
recognize, thus avoiding the untrusted certificate warning users get when
being redirected to an IP address. The certificate can specify the FQDN,
a wildcard FQDN, or multiple FQDNs in the Subject Alternate Names
(SAN) in the certificate.
We added the Redirect to Host Name option in the identity policy
settings.
Improved active authentication for
identity rules.
VPN Features
You can configure a site-to-site VPN connection to include remote
backup peers. If the primary remote peer is unavailable, the system will
try to re-establish the VPN connection using one of the backup peers.
You can configure separate pre-shared keys or certificates for each
backup peer. Backup peers are supported for policy-based connections
only, and are not available for route-based (virtual tunnel interface)
connections.
We updated the site-to-site VPN wizard to include backup peer
configuration.
Backup remote peers for site-to-site
VPN.
Getting Started
4
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
You can enable password management for remote access VPN. This
allows AnyConnect to prompt the user to change an expired password.
Without password management, users must change expired passwords
directly with the AAA server, and AnyConnect does not prompt the user
to change passwords. For LDAP servers, you can also set a warning
period to notify users of upcoming password expiration.
We added the Enable Password Management option to the authentication
settings for remote access VPN connection profiles.
Password management for remote
access VPN (MSCHAPv2).
When you use SAML as the primary authentication method for a remote
access VPN connection profile, you can elect to have the AnyConnect
client use the client’s local browser instead of the AnyConnect embedded
browser to perform the web authentication. This option enables single
sign-on (SSO) between your VPN authentication and other corporate
logins. Also choose this option if you want to support web authentication
methods, such as biometric authentication, that cannot be performed in
the embedded browser.
We updated the remote access VPN connection profile wizard to allow
you to configure the SAML Login Experience.
AnyConnect VPN SAML External
Browser
Administrative and Troubleshooting Features
You can configure DDNS for the interfaces on the system to send
dynamic updates to DNS servers. This helps ensure that FQDNs defined
for the interfaces resolve to the correct address, making it easier for
users to access the system using a hostname rather than an IP address.
This is especially useful for interfaces that get their addresses using
DHCP, but it is also useful for statically-addressed interfaces.
After upgrade, if you had used FlexConfig to configure DDNS, you
must redo your configuration using FDM or the Firepower Threat
Defense API, and remove the DDNS FlexConfig object from the
FlexConfig policy, before you can deploy changes again.
If you configure DDNS using FDM, then switch to FMC management,
the DDNS configuration is retained so that FMC can find the system
using the DNS name.
In FDM, we added the System Settings >DDNS Service page. In the
Firepower Threat Defense API, we added the DDNSService and
DDNSInterfaceSettings resources.
Dynamic Domain Name System
(DDNS) support for updating
fully-qualified domain name
(FQDN) to IP address mappings for
system interfaces.
To look up the IP address of a fully-qualified domain name (FQDN) in
the device CLI, use the digcommand. The nslookup command has been
removed.
The dig command replaces the
nslookup command in the device
CLI.
Getting Started
5
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
You can use FDM to configure DHCP relay. Using DHCP relay on an
interface, you can direct DHCP requests to a DHCP server that is
accessible through the other interface. You can configure DHCP relay
on physical interfaces, subinterfaces, EtherChannels, and VLAN
interfaces. You cannot configure DHCP relay if you configure a DHCP
server on any interface.
We added the System Settings >DHCP >DHCP Relay page, and
moved DHCP Server under the new DHCP heading.
DHCP relay configuration using
FDM.
You can specify the key type and size when generating new self-signed
internal and internal CA certificates in FDM. Key types include RSA,
ECDSA, and EDDSA. The allowed sizes differ by key type. We now
warn you if you upload a certificate whose key size is smaller than the
minimum recommended length. There is also a weak key pre-defined
search filter to help you find weak certificates, which you should replace
if possible.
Key type and size for self-signed
certificates in FDM.
You can specify whether a trusted CA certificate can be used to validate
certain types of connections. You can allow, or prevent, validation for
SSL server (used by dynamic DNS), SSL client (used by remote access
VPN), IPsec client (used by site-to-site VPN), or other features that are
not managed by the Snort inspection engine, such as LDAPS. The
primary purpose of these options is to let you prevent VPN connections
from getting established because they can be validated against a
particular certificate.
We added Validation Usage as a property for trusted CA certificates.
Usage validation restrictions for
trusted CA certificates.
During initial system configuration in FDM, or when you change the
admin password through FDM, you can now click a button to generate
a random 16 character password.
Generating the admin password in
FDM.
The show version command now includes information on how long it
took to start (boot) up the system. Note that the larger the configuration,
the longer it takes to boot up the system.
The new show asp rule-engine command shows status on tmatch
compilation. Tmatch compilation is used for an access list that is used
as an access group, the NAT table, and some other items. It is an internal
process that can consume CPU resources and impact performance while
in progress, if you have very large ACLs and NAT tables. Compilation
time depends on the size of the access list, NAT table, and so forth.
Startup time and tmatch
compilation status.
The output of the show access-list element-count command has been
enhanced. When used with object-group search enabled, the output
includes details about the number of object groups in the element count.
In addition, the show tech-support output now includes the output from
show access-list element-count and show asp rule-engine.
Enhancements to show access-list
element-count output.
Getting Started
6
Getting Started
New Features in FDM/FTD Version 7.1.0

DescriptionFeature
When you perform initial setup using FDM, all interface configuration
completed in FDM is retained when you switch to FMC for management,
in addition to the Management and FMC access settings. Note that other
default configuration settings, such as the access control policy or
security zones, are not retained. When you use the Firepower Threat
Defense CLI, only the Management and FMC access settings are retained
(for example, the default inside interface configuration is not retained).
After you switch to FMC, you can no longer use FDM to manage the
Firepower Threat Defense.
New/Modified screens: System Settings >Management Center
Use FDM to configure the
Firepower Threat Defense for
management by a FMC.
The local CA bundle contains certificates to access several Cisco
services. The system now automatically queries Cisco for new CA
certificates at a daily system-defined time. Previously, you had to
upgrade the software to update CA certificates. You can use the CLI to
disable this feature.
This feature is not supported in Version 7.0.0–7.0.4,
7.1.0–7.1.0.2, or 7.2.0–7.2.3. If you upgrade from a
supported version to an unsupported version, the feature
is temporarily disabled and the system stops contacting
Cisco.
Note
New/modified CLI commands: configure cert-update auto-update,
configure cert-update run-now,configure cert-update test,show
cert-update
For more information, see the Cisco Secure Firewall Threat Defense
Command Reference.
Automatically update CA bundles
The Firepower Threat Defense REST API for software version 7.1 is
version 6.2. You can use v6 in the API URLs, or preferentially, use
/latest/ to signify you are using the most recent API version that is
supported on the device. Note that the URL version path element for
6.2 is the same as 6.0/1: v6.
Please re-evaluate all existing calls, as changes might have been mode
to the resource models you are using. To open the API Explorer, where
you can view the resources, log into FDM, then click the more options
button ( ) and choose API Explorer.
FTD REST API version 6.2 (v6).
Logging Into the System
There are two interfaces to the Firepower Threat Defense device:
FDM Web Interface
The FDM runs in your web browser. You use this interface to configure, manage, and monitor the system.
Getting Started
7
Getting Started
Logging Into the System

Command Line Interface (CLI, Console)
Use the CLI for troubleshooting. You can also use it for initial setup instead of the FDM.
The following topics explain how to log into these interfaces and manage your user account.
Your User Role Controls What You Can See and Do
Your username is assigned a role, and your role determines what you can do or what you can see in the FDM.
The locally-defined admin user has all privileges, but if you log in using a different account, you might have
fewer privileges.
The upper-right corner of the FDM window shows your username and privilege level.
The privileges are:
•Administrator—You can see and use all features.
•Read-Write User—You can do everything a read-only user can do, and you can also edit and deploy
the configuration. The only restrictions are for system-critical actions, which include installing upgrades,
creating and restoring backups, viewing the audit log, and ending the sessions of other FDM users.
•Read-Only User—You can view dashboards and the configuration, but you cannot make any changes.
If you try to make a change, the error message explains that this is due to lack of permission.
These privileges are not related to those available for CLI users.
Logging Into the FDM
Use the FDM to configure, manage, and monitor the system. The features that you can configure through the
browser are not configurable through the command-line interface (CLI); you must use the web interface to
implement your security policies.
Use a current version of the following browsers: Firefox, Chrome, Safari, Edge.
If you type in the wrong password and fail to log in on 3 consecutive attempts, your account is locked for 5
minutes. You must wait before trying to log in again.
Note
Before you begin
Initially, you can log into the FDM using the admin username only. However, you can then configure
authorization for additional users defined in an external AAA server, as described in Managing FDM and
FTD User Access.
There can be up to 5 active logins at one time. This includes users logged into the device manager and active
API sessions, which are represented by non-expired API tokens. If you exceed this limit, the oldest session,
either the device manager login or API token, is expired to allow the new session. These limits do not apply
to SSH sessions.
Getting Started
8
Getting Started
Your User Role Controls What You Can See and Do

Procedure
Step 1 Using a browser, open the home page of the system, for example, https://ftd.example.com.
You can use any of the following addresses. You can use the IPv4 or IPv6 address or the DNS name, if you
have configured one.
• The management address. By default (on most platforms), the Management interface is a DHCP client,
so the IP address depends on your DHCP server.
• The address of a data interface that you have opened for HTTPS access. By default (on most platforms),
the “inside” interface allows HTTPS access, so you can connect to the default inside address 192.168.95.1.
See Default Configuration Prior to Initial Setup, on page 26 for details about your model's inside IP
address.
If you changed the HTTPS data port, you must include the custom port in the URL. For example, if you
changed the port to 4443: https://ftd.example.com:4443
If your browser is not configured to recognize the server certificate, you will see a warning about
an untrusted certificate. Accept the certificate as an exception, or in your trusted root certificate
store.
Tip
Step 2 Enter your username and password defined for the device, then click Login.
You can use the admin username, which is a pre-defined user. The default admin password is Admin123. On
AWS, the default admin password is the AWS Instance ID, unless you define a default password with user
data (Advanced Details >User Data) during the initial deployment.
Your session will expire after 30 minutes of inactivity, and you will be prompted to log in again. You can log
out by selecting Log Out from the user icon drop-down menu in the upper right of the page.
Logging Into the Command Line Interface (CLI)
Use the command-line interface (CLI) to set up the system and do basic system troubleshooting. You cannot
configure policies through a CLI session.
To log into the CLI, do one of the following:
•Use the console cable included with the device to connect your PC to the console using a terminal emulator
set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. See the hardware guide for your
device for more information about the console cable.
Getting Started
9
Getting Started
Logging Into the Command Line Interface (CLI)

On the Firepower and Secure Firewall device models, the CLI on the Console
port is the Firepower eXtensible Operating System (FXOS). For the Firepower
1000/2100, you can get to the Firepower Threat Defense CLI using the connect
ftd command. For the Firepower 4100/9300, see Connect to the Console of the
Application. Use the FXOS CLI for chassis-level troubleshooting only. Use the
Firepower Threat Defense CLI for basic configuration, monitoring, and normal
system troubleshooting. See the FXOS documentation for information on FXOS
commands.
Note
• For the FTDv, open the virtual console.
• Use an SSH client to make a connection to the management IP address. You can also connect to the
address on a data interface if you open the interface for SSH connections (see Configuring the Management
Access List). SSH access to data interfaces is disabled by default. Log in using the admin username or
another CLI user account. The default admin password is Admin123. On AWS, the default admin
password for the FTDv is the AWS Instance ID, unless you define a default password with user data
(Advanced Details >User Data) during the initial deployment.
Tips
• After logging in, for information on the commands available in the CLI, enter help or ?. For usage
information, see Cisco Firepower Threat Defense Command Reference at http://www.cisco.com/c/en/
us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense.html.
• You can create local user accounts that can log into the CLI using the configure user add command.
However, these users can log into the CLI only. They cannot log into the FDM web interface.
• You can create user accounts for SSH access in an external server. For information about configuring
external authentication for SSH access, see Configuring External Authorization (AAA) for the FTD CLI
(SSH) Users.
Changing Your Password
You should periodically change your password. The following procedure explains how to change the password
while logged into FDM.
If you are logged into the CLI, you can change your password using the configure password command. You
can change the password for a different CLI user with the configure user password username command.
Note
Before you begin
This procedure applies to local users only. If your user account is defined on an external AAA server, you
must change your password with that server.
Getting Started
10
Getting Started
Changing Your Password