Cisco Sourcefire Defense Center 750 User manual

Cisco Systems, Inc. www.cisco.com
Cisco Firepower Management Center Getting Started Guide 1
Cisco Firepower Management Center
Getting Started Guide for Models 750,
1500, 2000, 3500, and 4000
Updated: January 19, 2017
This guide is organized as follows:
Package Contents
License Requirements
Installing the Firepower Management Center
Restoring a Firepower Management Center to Factory Defaults
Preconfiguring Firepower Management Centers
Scrubbing the Hard Drive
Related Documentation
Package Contents
This section lists the items included with each model. Note that contents are subject to change, and your exact contents
might contain additional or fewer items.
Chassis Models
Firepower Management Center 750 (1U model). The following illustration of the rear of the chassis indicates
the location of the management interface on a MC750.
Figure 1 MC750 Chassis and Management Interface
1Management interface
373420
1

Package Contents
Cisco Firepower Management Center Getting Started Guide 2
Firepower Management Center 1500 (1U model). The following illustration of the rear of the chassis indicates
the location of the management interface on a MC1500.
Figure 2 MC1500 Chassis and Management Interface
Firepower Management Center 3500 (1U model). The following illustration of the rear of the chassis indicates
the location of the management interface on a MC3500.
Figure 3 MC3500 Chassis and Management Interface
Firepower Management Center 2000/4000 (1U model). The following illustration of the rear of the chassis
indicates the location of the management interface.
Figure 4 MC2000 and MC4000
Included Items
One power cord per power supply.
One straight-through Cat 5e Ethernet cables per chassis.
One rack-mounting kit per chassis.
1Management interface
1Management interface
1Management interface
373421
1
373422
1
PSU1PSU1 PSU2PSU2
373749
1

License Requirements
Cisco Firepower Management Center Getting Started Guide 3
License Requirements
You can license a variety of features to create an optimal Firepower System deployment for your organization. You
use the Firepower Management Center to manage licenses for itself and the devices it manages. The license types
offered by the Firepower System depend upon the type of device you want to manage:
Classic Licenses
For 7000 and 8000 Series, ASA FirePOWER, and NGIPSv devices, you must use Classic Licenses. Devices that
use Classic Licenses are sometimes referred to as Classic devices.
Cisco recommends that you use the initial setup page to add the licenses your organization has purchased; see
License Settings, page 8. If you do not add licenses now, any devices you register during initial setup are added
to the Management Center as unlicensed; you must license each of them individually after the initial setup process
is over. Note that if you are setting up a reimaged appliance and you kept your license settings as part of the restore
process, this section may be prepopulated.
Smart Licenses
For Firepower Threat Defense physical and virtual devices, you must use Smart Licenses.
Cisco Smart Licensing lets you purchase and manage a pool of licenses centrally. Unlike product authorization key
(PAK) licenses, smart licenses are not tied to a specific serial number or license key. Smart licensing lets you
assess your license usage and needs at a glance.
Refer to the Firepower Management Center Configuration Guide for information about Classic Licenses and Smart
Licenses, the types of licenses for each class, and how to manage the licenses across your deployment.
Installing the Firepower Management Center
When you install an appliance, make sure that you can access the appliance’s console for initial setup. You can
access the console for initial setup using a keyboard and monitor with KVM, or using an Ethernet connection to
the management interface.
Note: The management interface is preconfigured with a default IPv4 address. However, you can reconfigure the
management interface with an IPv6 address as part of the setup process.
Keyboard and Monitor/KVM
You can connect a USB keyboard and VGA monitor to the appliance, which is useful for rack-mounted appliances
connected to a keyboard, video, and mouse (KVM) switch.
Ethernet Connection to Management Interface
Configure a local computer, which must not be connected to the internet, with the following network settings:
IP address: 192.168.45.2
netmask: 255.255.255.0
default gateway: 192.168.45.1
Using an Ethernet cable, connect the network interface on the local computer to the management interface on the
appliance. Note that the management interface is preconfigured with a default IPv4 address. However, you can
reconfigure the management interface with an IPv6 address as part of the setup process.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 4
Management Center Initial Setup
After you deploy and install a Firepower Management Center, you must complete a setup process that allows the
new appliance to communicate on your trusted management network. You must also change the administrator
password and accept the end user license agreement (EULA).
The setup process also allows you to perform many initial administrative-level tasks, such as setting the time,
registering and licensing devices, and scheduling updates. The options you choose during setup and registration
determine the default interfaces, inline sets, zones, and policies that the system creates and applies to managed
devices.
Before you begin the setup, make sure that you can meet the following conditions:
Access
To set up a new appliance, you must connect using either keyboard and monitor/KVM (keyboard, video, and
mouse) or a direct Ethernet connection to the appliance’s management interface. After initial setup, you can
configure the appliance for serial access. For more information, see the Cisco Firepower Management Center
750, 1500, 2000, 3500, and 4000 Hardware Installation Guide.
Note: Do not use a KVM console with USB mass storage to access the appliance for the initial setup because
the appliance may attempt to use the mass storage device as a boot device.
Network and Deployment Information
You have, at minimum, the information needed to allow the appliance to communicate on your management
network: an IPv4 or IPv6 management IP address, a netmask or prefix length, and a default gateway.
If you know how the appliance is deployed, the setup process is also a good time to perform many initial
administrative-level tasks, including registration and licensing.
Note: If you are deploying multiple appliances, set up your devices first, then their managing Firepower
Management Center. The initial setup process for a device allows you to preregister it to a Management
Center; the setup process for a Management Center allows you to add and license preregistered managed
devices.
After you complete setup, you will use the Firepower Management Center‘s web interface to perform most
management and analysis tasks for your deployment. Note that Firepower devices have a restricted web interface
that you can use only to perform basic administration. For more information, see Next Steps, page 10.
Note: If you are setting up an appliance after restoring it to factory defaults (see Restoring a Firepower
Management Center to Factory Defaults, page 12) and you did not delete the appliance’s license and network
settings, you can use a computer on your management network to browse directly to the appliance’s web interface
to perform the setup. Skip to Initial Setup Page: Management Centers, page 6.
The following diagram illustrates the choices you can make when setting up Management Centers:
Procedure
1. Mount the appliance in your rack using the mounting kit and its supplied instructions.
2. Attach the power cord to the appliance and plug into a power source.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 5
If your appliance has redundant power supplies, attach power cords to both power supplies and plug them
into separate power sources.
3. Turn on the appliance.
What to Do Next
If you are connecting a computer directly to the appliance’s physical management interface to set up the
appliance, continue to Management Center Setup Using the Management Interface, page 5.
If you are using a keyboard and monitor to set up the appliance, continue to Management Center Setup Using
a Keyboard and Monitor (KVM), page 5.
Management Center Setup Using the Management Interface
Procedure
1. Using the supplied Ethernet cable, connect the network interface on the preconfigured computer directly to
the management interface on the appliance.
Confirm that the link LED is on for both the network interface on the local computer and the management
interface on the appliance.
2. Use a web browser to navigate to the appliance’s default IP address:
https:// 192.168.45.45
The login page appears.
3. Log in using admin as the username and Admin123 as the password.
What to Do Next
Complete the setup process using the procedures in Initial Setup Page: Management Centers, page 6.
Management Center Setup Using a Keyboard and Monitor (KVM)
Procedure
1. Using the supplied Ethernet cable, connect the management interface on the back of the appliance to a
protected management network.
2. Connect the monitor to the VGA port and the keyboard to one of the USB ports.
3. Log into the command line interface using admin as the username and Admin123 as the password. Note that
the password is case-sensitive.
4. Run the following script:
sudo /usr/local/sf/bin/configure-network
The following prompt (appended with the current value) appears:
Management IP address?
5. Enter the IP address you want to assign to the management interface or press Enter to accept the current
value. For example:
10.2.2.20
The following prompt (appended with the current value) appears:
Management netmask?

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 6
6. Enter the netmask for the interface’s IP address or press Enter to accept the current value. For example:
255.255.255.0
The following prompt (appended with the current value) appears:
Management gateway?
7. Enter the gateway for the interface’s IP address or press Enter to accept the current value. For example:
10.2.1.1
The following prompt appears:
Are these settings correct: (y or n)?
8. If the settings are correct, type y and press Enter to accept the settings and continue.
If the settings are incorrect, type n and press Enter. You are prompted to enter the information again.
9. After you have accepted the settings, log out of the shell.
What to Do Next
Complete the setup process using the procedures in Initial Setup Page: Management Centers, page 6.
Initial Setup Page: Management Centers
For all Management Centers, you must complete the setup process by logging into the Management Center’s web
interface and specifying initial configuration options on a setup page. You must change the administrator
password, specify network settings if you haven’t already, and accept the EULA.
The setup process also allows you to register and license devices. Before you can register a device, you must
complete the setup process on the device itself, as well as add the Management Center as a remote manager, or
the registration will fail.
Procedure
1. Direct your browser to https://mgmt_ip/, where mgmt_ip is the IP address of the Management Center’s
management interface:
—For a Management Center connected to a computer with an Ethernet cable, direct the browser on that
computer to the default management interface IPv4 address: https://192.168.45.45/.
—For a Management Center where network settings are already configured, use a computer on your
management network to browse to the IP address of the Management Center’s management interface.
2. Log in using admin as the username and Admin123 as the password.
See the following sections for information on completing the setup:
—Change Password, page 7
—Network Settings, page 7
—Time Settings, page 7
—Recurring Rule Update Imports, page 8
—Recurring Geolocation Updates, page 8
—Automatic Backups, page 8
—License Settings, page 8
—Device Registration, page 9

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 7
—End User License Agreement, page 10
3. When you are finished, click Apply.
The Management Center is configured according to your selections. You are logged into the web interface as
the admin user, which has the Administrator role.
Note: If you connected directly to the device using an Ethernet cable, disconnect the computer and connect
the Management Center’s management interface to the management network. Use a browser on a computer
on the management network to access the Management Center at the IP address or host name that you just
configured, and complete the rest of the procedures in this guide.
4. Use the Task Status page (System > Monitoring > Task Status) to verify that the initial setup was successful.
The page auto-refreshes every ten seconds. Monitor the page until it lists a status of Completed for the initial
device registration and policy apply tasks. If, as part of setup, you configured an intrusion rule or geolocation
update, you can also monitor those tasks.
The Management Center is ready to use. See the Firepower Management Center Configuration Guide for more
information on configuring your deployment.
What to Do Next
Continue with Next Steps, page 10.
Setup Options
Change Password
You must change the password for the admin account. This account has Administrator privileges and cannot be
deleted.
Cisco recommends that you use a strong password that is at least eight alphanumeric characters of mixed case
and includes at least one numeric character. Avoid using words that appear in a dictionary.
Network Settings
A Management Center’s network settings allow it to communicate on your management network. If you already
configured the network settings, this section of the page may be prepopulated.
The Firepower System provides a dual stack implementation for both IPv4 and IPv6 management environments.
You must specify the management network protocol (IPv4, IPv6, or Both). Depending on your choice, the setup page
displays various fields where you must set the IPv4 or IPv6 management IP address, netmask or prefix length, and
default gateway:
For IPv4, you must set the address and netmask in dotted decimal form (for example: a netmask of
255.255.0.0).
For IPv6 networks, you can select the Assign the IPv6 address using router autoconfiguration check box to
automatically assign IPv6 network settings. Otherwise, you must set the address in colon-separated
hexadecimal form and the number of bits in the prefix (for example: a prefix length of 112).
You can also specify up to three DNS servers, as well as the host name and domain for the device.
Time Settings
You can set the time for a Management Center either manually or via network time protocol (NTP) from an NTP
server.
You can also specify the time zone used on the local web interface for the admin account. Click the current time
zone to change it using a pop-up window.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 8
Recurring Rule Update Imports
As new vulnerabilities become known, the Vulnerability Research Team (VRT) releases intrusion rule updates. Rule
updates provide new and updated intrusion rules and preprocessor rules, modified states for existing rules, and
modified default intrusion policy settings. Rule updates may also delete rules and provide new rule categories and
system variables.
If you plan to perform intrusion detection and prevention in your deployment, Cisco recommends that you Enable
Recurring Rule Update Imports from the Support Site.
You can specify the Import Frequency, as well as configure the system to perform an intrusion Policy Reapply after each
rule update. To perform a rule update as part of the initial configuration process, select Install Now.
Rule updates may contain new binaries. Make sure your process for downloading and installing rule updates
complies with your security policies. In addition, rule updates may be large, so make sure to import rules during
periods of low network use.
Recurring Geolocation Updates
Firepower Management Centers can display geographical information about the routed IP addresses associated
with events generated by the system, as well as monitor geolocation statistics in the dashboard and Context
Explorer.
The Management Center’s geolocation database (GeoDB) contains information such as an IP address’s associated
Internet service provider (ISP), connection type, proxy information, and exact location. Enabling regular GeoDB
updates ensures that the system uses up-to-date geolocation information. If you plan to perform
geolocation-related analysis in your deployment, Cisco recommends that you Enable Recurring Weekly Updates from
the Support Site.
You can specify the weekly update frequency for the GeoDB. Click the time zone to change it using a pop-up
window. To download the database as part of the initial configuration process, select Install Now.
GeoDB updates may be large and may take up to 45 minutes to install after download. You should update the
GeoDB during periods of low network use.
Automatic Backups
The Firepower Management Center provides a mechanism for archiving data so configurations can be restored in
case of failure. As part of the initial setup, you can Enable Automatic Backups.
Enabling this setting creates a scheduled task that creates a weekly backup of the configurations on the
Management Center.
License Settings
You use the Firepower Management Center to manage licenses for itself and the devices it manages. The license
types offered by the Firepower System depend upon the type of device you want to manage:
For 7000 and 8000 Series, ASA FirePOWER, and NGIPSv devices, you must use Classic Licenses. Devices
that use Classic Licenses are sometimes referred to as Classic devices.
For Firepower Threat Defense physical and virtual devices, you must use Smart Licenses.
Before you add a classic license to the Firepower Management Center, make sure you have the PAK provided by
Cisco when you purchased the license. If you have a legacy, pre-Cisco license, contact Support.
Note: You must enable Classic Licenses on your managed devices before you can use licensed features. You can
enable a license during the initial setup of the Firepower Management Center, when you add a device to the
Firepower Management Center, or by editing the device’s general properties after you add the device.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 9
Procedure
1. Obtain the License Key for your chassis during the initial setup from the License Settings section of the initial
setup page.
The License Key is clearly labeled; for example, 66:18:E7:6E:D9:93:35.
Note: You can find the License Key on a Firepower Management Center at any time when you click the Add
New License button from the System>Licenses>Classic Licenses page.
2. To obtain your license, navigate to https://www.cisco.com/go/license/ where you will be prompted for the
license key (66:18:E7:6E:D9:93:35) and the Product Authorization Key (PAK).
Note: If you ordered additional licenses, you can enter the PAKs separated commas for those licenses at the
same time.
3. Follow the on-screen instructions to generate a license or licenses, which will be emailed to you.
4. Paste the license or licenses in the validation box click Add/Verify.
What to Do Next
Continue with initial setup.
Note: If you have devices that use Cisco Smart Licensing, you use the System>Licenses>Smart Licenses page
to add and verify licenses. Refer to the product documentation for those devices for information on how to add
Smart Licenses to the Firepower Management Center. The Firepower Management Center Configuration Guide
provides more information about Classic Licenses and Smart Licenses, the types of licenses for each class, and
how to manage the licenses across your deployment.
Device Registration
A Firepower Management Center can manage any device, physical or virtual, currently supported by the Firepower
System.
You must configure remote management on the device before you can register the device to a Management
Center.
If you are using Firepower System Version 6.0 or greater, see the device management information in the Firepower
Management Center Configuration Guide for instructions on registering your devices.
If you are using a Firepower System Version previous to 6.0, you can add most pre-registered devices to the
Management Center during the initial setup process. However, if a device and the Management Center are
separated by a NAT device, you must add it after the setup process completes; see the Firepower 7000 and 8000
Series Installation Guide.
You must configure both traffic channels to use the same management interface when you use a non-default
management interface to connect your Management Center and managed device and those appliances are
separated by a NAT device. See “Deploying on a Management Network” in the Firepower 7000 and 8000 Series
Installation Guide for more information.
When you register a managed device to a Management Center, leave the Apply Default Access Control Policies check
box enabled if you want to automatically apply access control policies to devices upon registration. Note that you
cannot choose which policy the Management Center applies to each device, only whether to apply them. The
policy that is applied to each device depends on the detection mode (see Setting Up Firepower Managed Devices
in the Firepower 7000 and 8000 Series Installation Guide) you chose when configuring the device, as listed in the
following table.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 10
An exception occurs if you previously managed a device with a Management Center and you changed the device’s
initial interface configuration. In this case, the policy applied by this new Management Center page depends on
the changed (current) configuration of the device. If there are interfaces configured, the Management Center
applies the Default Intrusion Prevention policy. Otherwise, the Management Center applies the Default Access
Control policy.
If a device is incompatible with an access control policy, the policy apply fails. This incompatibility could occur for
multiple reasons, including licensing mismatches, model restrictions, passive vs inline issues, and other
misconfigurations. If the initial access control policy apply fails, the initial network discovery policy apply also fails.
After you resolve the issue that caused the failure, you must manually apply access control and network discovery
policies to the device. For more information about issues that could cause access control policy apply to fail, see
the Firepower Management Center Configuration Guide.
To add a device, type its Hostname or IP Address, as well as the Registration Key you specified when you registered
the device. Remember this is a simple key that you specified, up to 37 characters in length, and is not the same
as a license key.
Then, use the check boxes to add licensed capabilities to the device. You can only select licenses you have already
added to the Management Center; see License Settings, page 8.
Not all licenses are supported on all managed devices. However, the setup page does not prevent you from
enabling unsupported licenses on managed devices, or enabling a capability for which you do not have a
model-specific license. This is because the Management Center does not determine the device model until later.
The system cannot enable an invalid license, and attempting to enable an invalid license does not decrement your
available license count.
After you enable licenses, click Add to save the device’s registration settings and, optionally, add more devices. If
you selected the wrong options or mis-typed a device name, click Delete to remove it. You can then re-add the
device.
End User License Agreement
Read the EULA carefully and, if you agree to abide by its provisions, select the check box. Make sure that all
the information you provided is correct, and click Apply.
The Management Center is configured according to your selections. You are logged into the web interface as
the admin user, which has the Administrator role. Continue with step 3. in Initial Setup Page: Management
Centers, page 6 to complete the initial setup of the Management Center.
Next Steps
After you complete the initial setup process for an appliance and verify its success, Cisco recommends that you
complete various administrative tasks that make your deployment easier to manage. You should also complete any
tasks you skipped during the initial setup, such as device registration and licensing. For detailed information on
any the tasks described in the following sections, as well as information on how you can begin to configure your
deployment, see the Firepower Management Center Configuration Guide.
Table 1 Default Access Control Policy Applied Per Detection Mode
Detection Mode Default Access Control Policy
Inline Default Intrusion Prevention
Passive Default Intrusion Prevention
Access Control Default Access Control
Network Discovery Default Network Discovery