Cisco Sourcefire Defense Center 750 User manual

Cisco Systems, Inc. www.cisco.com
Cisco Firepower Management Center Getting Started Guide 1
Cisco Firepower Management Center
Getting Started Guide for Models 750,
1500, 2000, 3500, and 4000
Updated: January 19, 2017
This guide is organized as follows:
Package Contents
License Requirements
Installing the Firepower Management Center
Restoring a Firepower Management Center to Factory Defaults
Preconfiguring Firepower Management Centers
Scrubbing the Hard Drive
Related Documentation
Package Contents
This section lists the items included with each model. Note that contents are subject to change, and your exact contents
might contain additional or fewer items.
Chassis Models
Firepower Management Center 750 (1U model). The following illustration of the rear of the chassis indicates
the location of the management interface on a MC750.
Figure 1 MC750 Chassis and Management Interface
1Management interface
373420
1

Package Contents
Cisco Firepower Management Center Getting Started Guide 2
Firepower Management Center 1500 (1U model). The following illustration of the rear of the chassis indicates
the location of the management interface on a MC1500.
Figure 2 MC1500 Chassis and Management Interface
Firepower Management Center 3500 (1U model). The following illustration of the rear of the chassis indicates
the location of the management interface on a MC3500.
Figure 3 MC3500 Chassis and Management Interface
Firepower Management Center 2000/4000 (1U model). The following illustration of the rear of the chassis
indicates the location of the management interface.
Figure 4 MC2000 and MC4000
Included Items
One power cord per power supply.
One straight-through Cat 5e Ethernet cables per chassis.
One rack-mounting kit per chassis.
1Management interface
1Management interface
1Management interface
373421
1
373422
1
PSU1PSU1 PSU2PSU2
373749
1

License Requirements
Cisco Firepower Management Center Getting Started Guide 3
License Requirements
You can license a variety of features to create an optimal Firepower System deployment for your organization. You
use the Firepower Management Center to manage licenses for itself and the devices it manages. The license types
offered by the Firepower System depend upon the type of device you want to manage:
Classic Licenses
For 7000 and 8000 Series, ASA FirePOWER, and NGIPSv devices, you must use Classic Licenses. Devices that
use Classic Licenses are sometimes referred to as Classic devices.
Cisco recommends that you use the initial setup page to add the licenses your organization has purchased; see
License Settings, page 8. If you do not add licenses now, any devices you register during initial setup are added
to the Management Center as unlicensed; you must license each of them individually after the initial setup process
is over. Note that if you are setting up a reimaged appliance and you kept your license settings as part of the restore
process, this section may be prepopulated.
Smart Licenses
For Firepower Threat Defense physical and virtual devices, you must use Smart Licenses.
Cisco Smart Licensing lets you purchase and manage a pool of licenses centrally. Unlike product authorization key
(PAK) licenses, smart licenses are not tied to a specific serial number or license key. Smart licensing lets you
assess your license usage and needs at a glance.
Refer to the Firepower Management Center Configuration Guide for information about Classic Licenses and Smart
Licenses, the types of licenses for each class, and how to manage the licenses across your deployment.
Installing the Firepower Management Center
When you install an appliance, make sure that you can access the appliance’s console for initial setup. You can
access the console for initial setup using a keyboard and monitor with KVM, or using an Ethernet connection to
the management interface.
Note: The management interface is preconfigured with a default IPv4 address. However, you can reconfigure the
management interface with an IPv6 address as part of the setup process.
Keyboard and Monitor/KVM
You can connect a USB keyboard and VGA monitor to the appliance, which is useful for rack-mounted appliances
connected to a keyboard, video, and mouse (KVM) switch.
Ethernet Connection to Management Interface
Configure a local computer, which must not be connected to the internet, with the following network settings:
IP address: 192.168.45.2
netmask: 255.255.255.0
default gateway: 192.168.45.1
Using an Ethernet cable, connect the network interface on the local computer to the management interface on the
appliance. Note that the management interface is preconfigured with a default IPv4 address. However, you can
reconfigure the management interface with an IPv6 address as part of the setup process.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 4
Management Center Initial Setup
After you deploy and install a Firepower Management Center, you must complete a setup process that allows the
new appliance to communicate on your trusted management network. You must also change the administrator
password and accept the end user license agreement (EULA).
The setup process also allows you to perform many initial administrative-level tasks, such as setting the time,
registering and licensing devices, and scheduling updates. The options you choose during setup and registration
determine the default interfaces, inline sets, zones, and policies that the system creates and applies to managed
devices.
Before you begin the setup, make sure that you can meet the following conditions:
Access
To set up a new appliance, you must connect using either keyboard and monitor/KVM (keyboard, video, and
mouse) or a direct Ethernet connection to the appliance’s management interface. After initial setup, you can
configure the appliance for serial access. For more information, see the Cisco Firepower Management Center
750, 1500, 2000, 3500, and 4000 Hardware Installation Guide.
Note: Do not use a KVM console with USB mass storage to access the appliance for the initial setup because
the appliance may attempt to use the mass storage device as a boot device.
Network and Deployment Information
You have, at minimum, the information needed to allow the appliance to communicate on your management
network: an IPv4 or IPv6 management IP address, a netmask or prefix length, and a default gateway.
If you know how the appliance is deployed, the setup process is also a good time to perform many initial
administrative-level tasks, including registration and licensing.
Note: If you are deploying multiple appliances, set up your devices first, then their managing Firepower
Management Center. The initial setup process for a device allows you to preregister it to a Management
Center; the setup process for a Management Center allows you to add and license preregistered managed
devices.
After you complete setup, you will use the Firepower Management Center‘s web interface to perform most
management and analysis tasks for your deployment. Note that Firepower devices have a restricted web interface
that you can use only to perform basic administration. For more information, see Next Steps, page 10.
Note: If you are setting up an appliance after restoring it to factory defaults (see Restoring a Firepower
Management Center to Factory Defaults, page 12) and you did not delete the appliance’s license and network
settings, you can use a computer on your management network to browse directly to the appliance’s web interface
to perform the setup. Skip to Initial Setup Page: Management Centers, page 6.
The following diagram illustrates the choices you can make when setting up Management Centers:
Procedure
1. Mount the appliance in your rack using the mounting kit and its supplied instructions.
2. Attach the power cord to the appliance and plug into a power source.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 5
If your appliance has redundant power supplies, attach power cords to both power supplies and plug them
into separate power sources.
3. Turn on the appliance.
What to Do Next
If you are connecting a computer directly to the appliance’s physical management interface to set up the
appliance, continue to Management Center Setup Using the Management Interface, page 5.
If you are using a keyboard and monitor to set up the appliance, continue to Management Center Setup Using
a Keyboard and Monitor (KVM), page 5.
Management Center Setup Using the Management Interface
Procedure
1. Using the supplied Ethernet cable, connect the network interface on the preconfigured computer directly to
the management interface on the appliance.
Confirm that the link LED is on for both the network interface on the local computer and the management
interface on the appliance.
2. Use a web browser to navigate to the appliance’s default IP address:
https:// 192.168.45.45
The login page appears.
3. Log in using admin as the username and Admin123 as the password.
What to Do Next
Complete the setup process using the procedures in Initial Setup Page: Management Centers, page 6.
Management Center Setup Using a Keyboard and Monitor (KVM)
Procedure
1. Using the supplied Ethernet cable, connect the management interface on the back of the appliance to a
protected management network.
2. Connect the monitor to the VGA port and the keyboard to one of the USB ports.
3. Log into the command line interface using admin as the username and Admin123 as the password. Note that
the password is case-sensitive.
4. Run the following script:
sudo /usr/local/sf/bin/configure-network
The following prompt (appended with the current value) appears:
Management IP address?
5. Enter the IP address you want to assign to the management interface or press Enter to accept the current
value. For example:
10.2.2.20
The following prompt (appended with the current value) appears:
Management netmask?

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 6
6. Enter the netmask for the interface’s IP address or press Enter to accept the current value. For example:
255.255.255.0
The following prompt (appended with the current value) appears:
Management gateway?
7. Enter the gateway for the interface’s IP address or press Enter to accept the current value. For example:
10.2.1.1
The following prompt appears:
Are these settings correct: (y or n)?
8. If the settings are correct, type y and press Enter to accept the settings and continue.
If the settings are incorrect, type n and press Enter. You are prompted to enter the information again.
9. After you have accepted the settings, log out of the shell.
What to Do Next
Complete the setup process using the procedures in Initial Setup Page: Management Centers, page 6.
Initial Setup Page: Management Centers
For all Management Centers, you must complete the setup process by logging into the Management Center’s web
interface and specifying initial configuration options on a setup page. You must change the administrator
password, specify network settings if you haven’t already, and accept the EULA.
The setup process also allows you to register and license devices. Before you can register a device, you must
complete the setup process on the device itself, as well as add the Management Center as a remote manager, or
the registration will fail.
Procedure
1. Direct your browser to https://mgmt_ip/, where mgmt_ip is the IP address of the Management Center’s
management interface:
—For a Management Center connected to a computer with an Ethernet cable, direct the browser on that
computer to the default management interface IPv4 address: https://192.168.45.45/.
—For a Management Center where network settings are already configured, use a computer on your
management network to browse to the IP address of the Management Center’s management interface.
2. Log in using admin as the username and Admin123 as the password.
See the following sections for information on completing the setup:
—Change Password, page 7
—Network Settings, page 7
—Time Settings, page 7
—Recurring Rule Update Imports, page 8
—Recurring Geolocation Updates, page 8
—Automatic Backups, page 8
—License Settings, page 8
—Device Registration, page 9

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 7
—End User License Agreement, page 10
3. When you are finished, click Apply.
The Management Center is configured according to your selections. You are logged into the web interface as
the admin user, which has the Administrator role.
Note: If you connected directly to the device using an Ethernet cable, disconnect the computer and connect
the Management Center’s management interface to the management network. Use a browser on a computer
on the management network to access the Management Center at the IP address or host name that you just
configured, and complete the rest of the procedures in this guide.
4. Use the Task Status page (System > Monitoring > Task Status) to verify that the initial setup was successful.
The page auto-refreshes every ten seconds. Monitor the page until it lists a status of Completed for the initial
device registration and policy apply tasks. If, as part of setup, you configured an intrusion rule or geolocation
update, you can also monitor those tasks.
The Management Center is ready to use. See the Firepower Management Center Configuration Guide for more
information on configuring your deployment.
What to Do Next
Continue with Next Steps, page 10.
Setup Options
Change Password
You must change the password for the admin account. This account has Administrator privileges and cannot be
deleted.
Cisco recommends that you use a strong password that is at least eight alphanumeric characters of mixed case
and includes at least one numeric character. Avoid using words that appear in a dictionary.
Network Settings
A Management Center’s network settings allow it to communicate on your management network. If you already
configured the network settings, this section of the page may be prepopulated.
The Firepower System provides a dual stack implementation for both IPv4 and IPv6 management environments.
You must specify the management network protocol (IPv4, IPv6, or Both). Depending on your choice, the setup page
displays various fields where you must set the IPv4 or IPv6 management IP address, netmask or prefix length, and
default gateway:
For IPv4, you must set the address and netmask in dotted decimal form (for example: a netmask of
255.255.0.0).
For IPv6 networks, you can select the Assign the IPv6 address using router autoconfiguration check box to
automatically assign IPv6 network settings. Otherwise, you must set the address in colon-separated
hexadecimal form and the number of bits in the prefix (for example: a prefix length of 112).
You can also specify up to three DNS servers, as well as the host name and domain for the device.
Time Settings
You can set the time for a Management Center either manually or via network time protocol (NTP) from an NTP
server.
You can also specify the time zone used on the local web interface for the admin account. Click the current time
zone to change it using a pop-up window.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 8
Recurring Rule Update Imports
As new vulnerabilities become known, the Vulnerability Research Team (VRT) releases intrusion rule updates. Rule
updates provide new and updated intrusion rules and preprocessor rules, modified states for existing rules, and
modified default intrusion policy settings. Rule updates may also delete rules and provide new rule categories and
system variables.
If you plan to perform intrusion detection and prevention in your deployment, Cisco recommends that you Enable
Recurring Rule Update Imports from the Support Site.
You can specify the Import Frequency, as well as configure the system to perform an intrusion Policy Reapply after each
rule update. To perform a rule update as part of the initial configuration process, select Install Now.
Rule updates may contain new binaries. Make sure your process for downloading and installing rule updates
complies with your security policies. In addition, rule updates may be large, so make sure to import rules during
periods of low network use.
Recurring Geolocation Updates
Firepower Management Centers can display geographical information about the routed IP addresses associated
with events generated by the system, as well as monitor geolocation statistics in the dashboard and Context
Explorer.
The Management Center’s geolocation database (GeoDB) contains information such as an IP address’s associated
Internet service provider (ISP), connection type, proxy information, and exact location. Enabling regular GeoDB
updates ensures that the system uses up-to-date geolocation information. If you plan to perform
geolocation-related analysis in your deployment, Cisco recommends that you Enable Recurring Weekly Updates from
the Support Site.
You can specify the weekly update frequency for the GeoDB. Click the time zone to change it using a pop-up
window. To download the database as part of the initial configuration process, select Install Now.
GeoDB updates may be large and may take up to 45 minutes to install after download. You should update the
GeoDB during periods of low network use.
Automatic Backups
The Firepower Management Center provides a mechanism for archiving data so configurations can be restored in
case of failure. As part of the initial setup, you can Enable Automatic Backups.
Enabling this setting creates a scheduled task that creates a weekly backup of the configurations on the
Management Center.
License Settings
You use the Firepower Management Center to manage licenses for itself and the devices it manages. The license
types offered by the Firepower System depend upon the type of device you want to manage:
For 7000 and 8000 Series, ASA FirePOWER, and NGIPSv devices, you must use Classic Licenses. Devices
that use Classic Licenses are sometimes referred to as Classic devices.
For Firepower Threat Defense physical and virtual devices, you must use Smart Licenses.
Before you add a classic license to the Firepower Management Center, make sure you have the PAK provided by
Cisco when you purchased the license. If you have a legacy, pre-Cisco license, contact Support.
Note: You must enable Classic Licenses on your managed devices before you can use licensed features. You can
enable a license during the initial setup of the Firepower Management Center, when you add a device to the
Firepower Management Center, or by editing the device’s general properties after you add the device.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 9
Procedure
1. Obtain the License Key for your chassis during the initial setup from the License Settings section of the initial
setup page.
The License Key is clearly labeled; for example, 66:18:E7:6E:D9:93:35.
Note: You can find the License Key on a Firepower Management Center at any time when you click the Add
New License button from the System>Licenses>Classic Licenses page.
2. To obtain your license, navigate to https://www.cisco.com/go/license/ where you will be prompted for the
license key (66:18:E7:6E:D9:93:35) and the Product Authorization Key (PAK).
Note: If you ordered additional licenses, you can enter the PAKs separated commas for those licenses at the
same time.
3. Follow the on-screen instructions to generate a license or licenses, which will be emailed to you.
4. Paste the license or licenses in the validation box click Add/Verify.
What to Do Next
Continue with initial setup.
Note: If you have devices that use Cisco Smart Licensing, you use the System>Licenses>Smart Licenses page
to add and verify licenses. Refer to the product documentation for those devices for information on how to add
Smart Licenses to the Firepower Management Center. The Firepower Management Center Configuration Guide
provides more information about Classic Licenses and Smart Licenses, the types of licenses for each class, and
how to manage the licenses across your deployment.
Device Registration
A Firepower Management Center can manage any device, physical or virtual, currently supported by the Firepower
System.
You must configure remote management on the device before you can register the device to a Management
Center.
If you are using Firepower System Version 6.0 or greater, see the device management information in the Firepower
Management Center Configuration Guide for instructions on registering your devices.
If you are using a Firepower System Version previous to 6.0, you can add most pre-registered devices to the
Management Center during the initial setup process. However, if a device and the Management Center are
separated by a NAT device, you must add it after the setup process completes; see the Firepower 7000 and 8000
Series Installation Guide.
You must configure both traffic channels to use the same management interface when you use a non-default
management interface to connect your Management Center and managed device and those appliances are
separated by a NAT device. See “Deploying on a Management Network” in the Firepower 7000 and 8000 Series
Installation Guide for more information.
When you register a managed device to a Management Center, leave the Apply Default Access Control Policies check
box enabled if you want to automatically apply access control policies to devices upon registration. Note that you
cannot choose which policy the Management Center applies to each device, only whether to apply them. The
policy that is applied to each device depends on the detection mode (see Setting Up Firepower Managed Devices
in the Firepower 7000 and 8000 Series Installation Guide) you chose when configuring the device, as listed in the
following table.

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 10
An exception occurs if you previously managed a device with a Management Center and you changed the device’s
initial interface configuration. In this case, the policy applied by this new Management Center page depends on
the changed (current) configuration of the device. If there are interfaces configured, the Management Center
applies the Default Intrusion Prevention policy. Otherwise, the Management Center applies the Default Access
Control policy.
If a device is incompatible with an access control policy, the policy apply fails. This incompatibility could occur for
multiple reasons, including licensing mismatches, model restrictions, passive vs inline issues, and other
misconfigurations. If the initial access control policy apply fails, the initial network discovery policy apply also fails.
After you resolve the issue that caused the failure, you must manually apply access control and network discovery
policies to the device. For more information about issues that could cause access control policy apply to fail, see
the Firepower Management Center Configuration Guide.
To add a device, type its Hostname or IP Address, as well as the Registration Key you specified when you registered
the device. Remember this is a simple key that you specified, up to 37 characters in length, and is not the same
as a license key.
Then, use the check boxes to add licensed capabilities to the device. You can only select licenses you have already
added to the Management Center; see License Settings, page 8.
Not all licenses are supported on all managed devices. However, the setup page does not prevent you from
enabling unsupported licenses on managed devices, or enabling a capability for which you do not have a
model-specific license. This is because the Management Center does not determine the device model until later.
The system cannot enable an invalid license, and attempting to enable an invalid license does not decrement your
available license count.
After you enable licenses, click Add to save the device’s registration settings and, optionally, add more devices. If
you selected the wrong options or mis-typed a device name, click Delete to remove it. You can then re-add the
device.
End User License Agreement
Read the EULA carefully and, if you agree to abide by its provisions, select the check box. Make sure that all
the information you provided is correct, and click Apply.
The Management Center is configured according to your selections. You are logged into the web interface as
the admin user, which has the Administrator role. Continue with step 3. in Initial Setup Page: Management
Centers, page 6 to complete the initial setup of the Management Center.
Next Steps
After you complete the initial setup process for an appliance and verify its success, Cisco recommends that you
complete various administrative tasks that make your deployment easier to manage. You should also complete any
tasks you skipped during the initial setup, such as device registration and licensing. For detailed information on
any the tasks described in the following sections, as well as information on how you can begin to configure your
deployment, see the Firepower Management Center Configuration Guide.
Table 1 Default Access Control Policy Applied Per Detection Mode
Detection Mode Default Access Control Policy
Inline Default Intrusion Prevention
Passive Default Intrusion Prevention
Access Control Default Access Control
Network Discovery Default Network Discovery

Installing the Firepower Management Center
Cisco Firepower Management Center Getting Started Guide 11
Individual User Accounts
After you complete the initial setup, the only user on the system is the admin user, which has the Administrator
role and access. Users with that role have full menu and configuration access to the system, including via the
shell or CLI. Cisco recommends that you limit the use of the admin account (and the Administrator role) for
security and auditing reasons.
Creating a separate account for each person who will use the system allows your organization not only to audit
actions and changes made by each user, but also to limit each person’s associated user access role or roles.
This is especially important on the Management Center, where you perform most of your configuration and
analysis tasks. For example, an analyst needs access to event data to analyze the security of your network,
but may not require access to administrative functions for the deployment.
The system includes ten predefined user roles designed for a variety of administrators and analysts. You can
also create custom user roles with specialized access privileges.
Health and System Policies
By default, all appliances have an initial system policy applied. The system policy governs settings that are
likely to be similar for multiple appliances in a deployment, such as mail relay host preferences and time
synchronization settings. Cisco recommends that you use the Management Center to apply the same system
policy to itself and all the devices it manages.
By default, the Management Center also has a health policy applied. A health policy, as part of the health
monitoring feature, provides the criteria for the system continuously monitoring the performance of the
appliances in your deployment. Cisco recommends that you use the Management Center to apply a health
policy to all the devices it manages.
Software and Database Updates
You should update the system software on your appliances before you begin any deployment. Cisco
recommends that all the appliances in your deployment run the most recent version of the Firepower System.
If you are using them in your deployment, you should also install the latest intrusion rule updates, VDB, and
GeoDB.
Caution: Before you update any part of the Firepower System, you must read the release notes or advisory
text that accompanies the update. The release notes provide important information, including supported
platforms, compatibility, prerequisites, warnings, and specific installation and uninstallation instructions.
Redirecting Console Output
By default, Management Centers direct initialization status, or init, messages to the VGA port. If you want to use
the physical serial port or SOL to access the console, Cisco recommends you redirect console output to the serial
port after you complete the initial setup.
To redirect console output using the shell, you run a script from the appliance’s shell.
Using the Shell to Redirect the Console Output
Procedure
1. Using your keyboard/monitor or serial connection, log into the appliance’s shell using an account with
Administrator privileges. The password is the same as the password for the appliance’s web interface.
The prompt for the appliance appears.
2. At the prompt, set the console output by typing one of the following commands:
—To access the appliance using the VGA port:

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 12
sudo /usr/local/sf/bin/configure_console.sh vga
—To access the appliance using the physical serial port:
sudo /usr/local/sf/bin/configure_console.sh serial
—To access the appliance using LOM via SOL:
sudo /usr/local/sf/bin/configure_console.sh sol
3. To implement your changes, reboot the appliance by typing sudo reboot.
The appliance reboots.
Using the Web Interface to Redirect the Console Output
Procedure
1. Select System > Configuration.
2. Select Console Configuration.
3. Select a remote console access option:
—Select VGA to use the appliance's VGA port. This is the default option.
—Select Physical Serial Port to use the appliance's serial port, or to use LOM/SOL on a Management Center.
If you selected Physical Serial Port, the LOM settings appear.
4. To configure LOM via SOL, enter the appropriate settings:
—DHCP Configuration for the appliance (DHCP or Static).
—IP Address to be used for LOM. The LOM IP address must be different from the management interface IP
address of the appliance.
—Netmask for the appliance.
—Default Gateway for the appliance.
5. Click Save.
Remote console configuration for the appliance is saved. If you configured Lights-Out Management, you must
enable it for at least one user; see Enabling LOM and LOM Users, page 25.
Restoring a Firepower Management Center to Factory
Defaults
Cisco provides ISO images on its Support Site for restoring, or reimaging, Firepower Management Centers to their
original factory settings.
For more information, see the following sections:
Before You Begin, page 13
Understanding the Restore Process, page 13
Obtaining the Restore ISO and Update Files, page 14
Beginning the Restore Process, page 15
Using the Interactive Menu to Restore an Appliance, page 17
Next Steps, page 23

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 13
Setting Up Lights-Out Management, page 24
Before You Begin
Before you begin restoring your appliances to factory defaults, you should familiarize yourself with the expected
behavior of the system during the restore process.
Configuration and Event Backup Guidelines
Before you begin the restore process, Cisco recommends that you delete or move any backup files that reside on
your appliance, then back up current event and configuration data to an external location.
Restoring your appliance to factory defaults results in the loss of almost all configuration and event data on the
appliance. Although the restore utility can retain the appliance’s license, network, console, and Lights-Out
Management (LOM) settings, you must perform all other setup tasks after the restore process completes.
Traffic Flow During the Restore Process
To avoid disruptions in traffic flow on your network, Cisco recommends restoring your appliances during a
maintenance window or at a time when the interruption will have the least impact on your deployment.
Restoring a Firepower device that is deployed inline resets the device to a non-bypass (fail closed) configuration,
disrupting traffic on your network. Traffic is blocked until you configure bypass-enabled inline sets on the device.
For more information about editing your device configuration to configure bypass, see the Managing Devices
chapter of the Firepower Management Center Configuration Guide.
Understanding the Restore Process
To restore a Firepower device, you boot from the appliance’s internal flash drive and use an interactive menu to
download and install the ISO image on the appliance. For your convenience, you can install system software and
intrusion rule updates as part of the restore process.
Only reimage your appliances during a maintenance window. Reimaging resets appliances in bypass mode to a
non-bypass configuration and disrupts traffic on your network until you reconfigure bypass mode. For more
information, see Traffic Flow During the Restore Process, page 13.
Note that you cannot restore an appliance using its web interface. To restore an appliance, you must connect to
it in one of the following ways:
Keyboard and Monitor/KVM
You can connect a USB keyboard and VGA monitor to the appliance, which is useful for rack-mounted
appliances connected to a KVM (keyboard, video, and mouse) switch. If you have a KVM that is
remote-accessible, you can restore appliances without having physical access.
Serial Connection/Laptop
You can use a rollover serial cable (also known as a NULL modem cable or a Cisco console cable) to connect
a computer to the appliance. See the hardware specifications for your appliance to locate the serial port. To
interact with the appliance, use terminal emulation software such as HyperTerminal or XModem.
Lights-Out Management Using Serial over LAN
You can perform a limited set of actions on Management Centers and Firepower devices using Lights-Out
Management (LOM) with a Serial over LAN (SOL) connection. If you do not have physical access to an
appliance, you can use LOM to perform the restore process. After you connect to an appliance using LOM,
you issue commands to the restore utility as if you were using a physical serial connection. Note that you can

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 14
use Lights-Out Management on the default (eth0) management interface only. For more information, see
Setting Up Lights-Out Management, page 24.
Before You Begin
Obtain the restore ISO image for the appliance from the Support Site. See Obtaining the Restore ISO and
Update Files, page 14.
Reimaging a Firepower Management Center could cause an Out of Compliance (OOC) state with the Cisco
License Authority. As a best practice, when reimaging a Firepower Management Center, first deregister the
Firepower Management Center from the Cisco Smart Software Manager. Choose System > Licenses > Smart
Licenses and click the deregister icon.
To restore a Firepower device:
1. Copy the image to an appropriate storage medium.
2. Connect to the appliance.
3. Reboot the appliance and invoke the restore utility.
What to Do Next
Install the ISO image using the procedure in Beginning the Restore Process, page 15.
Obtaining the Restore ISO and Update Files
Cisco provides ISO images for restoring appliances to their original factory settings. Before you restore an
appliance, obtain the correct ISO image from the Support Site.
The ISO image you should use to restore an appliance depends on when Cisco introduced support for that
appliance model. Unless the ISO image was released with a minor version to accommodate a new appliance
model, ISO images are usually associated with major versions of the system software (for example, 5.2 or 5.3).
To avoid installing an incompatible version of the system, Cisco recommends that you always use the most recent
ISO image available for your appliance.
Firepower devices use an internal flash drive to boot the appliance so you can run the restore utility.
Cisco also recommends that you always run the latest version of the system software supported by your appliance.
After you restore an appliance to the latest supported major version, you should update its system software,
intrusion rules, and Vulnerability Database (VDB). For more information, see the release notes for the update you
want to apply, as well as the Firepower Management Center Configuration Guide.
For your convenience, you can install system software and intrusion rule updates as part of the restore process.
For example, you could restore a device to Version 6.0, and also update the device to Version 6.0.0.1 as part of
that process. Keep in mind that only Management Centers require rule updates.
To obtain the restore ISO and other update files:
1. Using the user name and password for your support account, log into the Support Site
(https://sso.cisco.com/autho/forms/CDClogin.html).
2. Browse to the software download section (https://software.cisco.com/download/navigator.html).
3. Enter a search string in the Find area on the page that appears for the system software you want to download
and install.
For example, to find software downloads for Firepower, you would enter Firepower.
4. Find the image (ISO image) that you want to download.

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 15
You can click one of the links on the left side of the page to view the appropriate section of the page. For
example, you would click 5.4.1 Images to view the images and release notes for Version 5.4.1 of the Firepower
System.
5. Click the ISO image you want to download.
The file begins downloading.
6. Copy the files to an HTTP (web) server, FTP server, or SCP-enabled host that the appliance can access on its
management network.
Caution: Do not transfer ISO or update files via email; the files can become corrupted. Also, do not change
the names of the files; the restore utility requires that they be named as they are on the Support Site.
Beginning the Restore Process
Begin the restore process by booting the appliance from an internal flash drive.
After you make sure that you have the appropriate level of access and connection to an appliance, as well the
correct ISO image, use one of the following procedures to restore your appliance:
Starting the Restore Utility Using KVM or Physical Serial Port, page 15 explains how to start the restore
process for an appliance where you do not have LOM access.
Starting the Restore Utility Using Lights-Out Management, page 16 explains how use LOM to start the restore
process via an SOL connection.
Caution: The procedures in this chapter explain how to restore an appliance without powering it down.
However, if you need to power down for any reason, use the appliance’s web interface, the system shutdown
command from the CLI on a Firepower device, or the shutdown -h now command from an appliance’s shell
(sometimes called expert mode).
Starting the Restore Utility Using KVM or Physical Serial Port
For Firepower devices, Cisco provides a restore utility on an internal flash drive.
Note: Do not use a KVM console with USB mass storage to access the appliance for the initial setup because the
appliance may attempt to use the mass storage device as a boot device.
If you need to restore an appliance to factory defaults and do not have physical access, you can use LOM to
perform the restore process; see Starting the Restore Utility Using Lights-Out Management, page 16.
To start the restore utility:
1. Using your keyboard/monitor or serial connection, log into the appliance using an account with Administrator
privileges. The password is the same as the password for the appliance’s web interface.
2. Reboot the appliance. On a Firepower device, type system reboot.
The appliance reboots.
3. Monitor the reboot status:
—If the system is performing a database check, you may see the following message: The system is not
operational yet. Checking and repairing database are in progress. This may take a long time to
finish.
—For a keyboard and monitor connection, quickly press one of the arrow keys to prevent the appliance from
booting the currently installed version of the system.

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 16
—For a serial connection, when you see the BIOS boot options, press Tab slowly and repeatedly (to prevent
the appliance from booting the currently installed version of the system). The LILO boot prompt appears.
For example:
LILO 22.8 boot:
System-5.4 System_Restore
4. Indicate that you want to restore the system:
—For a keyboard and monitor connection, use the arrow keys to select System_Restore and press Enter.
—For a serial connection, type System_Restore at the prompt and press Enter.
The boot prompt appears after the following choices:
0. Load with standard console
1. Load with serial console
5. Select a display mode for the restore utility’s interactive menu:
—For a keyboard and monitor connection, type 0and press Enter.
—For a serial connection, type 1and press Enter.
If you do not select a display mode, the restore utility defaults to the standard console after 30 seconds.
Unless this is the first time you have restored the appliance to this major version, the utility automatically loads
the last restore configuration you used. To continue, confirm the settings in a series of pages.
6. Press Enter to confirm the copyright notice.
What to Do Next
Continue with Using the Interactive Menu to Restore an Appliance, page 17.
Starting the Restore Utility Using Lights-Out Management
If you need to restore an appliance to factory defaults and do not have physical access to the appliance, you can
use LOM to perform the restore process. Note that if you want to use LOM to configure the initial setup, you must
preserve the network settings during the initial setup. Note also that you can use Lights-Out Management on the
default (eth0) management interface only.
Note: Before you can restore an appliance using LOM, you must enable the feature; see Setting Up Lights-Out
Management, page 24.
To start the restore utility using Lights-Out Management:
1. At your computer’s command prompt, enter the IPMI command to start the SOL session:
For IPMItool, type:
sudo ipmitool -I lanplus -H IP_address -U username sol activate
For ipmiutil, type:
sudo ipmiutil sol -a -V4 -J3 -N IP_address -U username -P password
Where IP_address is the IP address of the management interface on the appliance, username is user name of an
authorized LOM account, and password is the password for that account. Note that IPMItool prompts you for the
password after you issue the sol activate command.
If you are using a Firepower device, type expert to display the shell prompt.
1. Reboot the appliance as root user. For a Firepower device, type system reboot.
The appliance reboots.

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 17
2. Monitor the reboot status.
If the system is performing a database check, you may see the following message: The system is not
operational yet. Checking and repairing database are in progress. This may take a long time to finish.
When you see the BIOS boot options, press Tab slowly and repeatedly (to prevent the appliance from booting
the currently installed version of the system) until the LILO boot prompt appears. For example:
LILO 22.8 boot:
System-5.4 System_Restore
3. At the boot prompt, start the restore utility by typing System_Restore.
The boot prompt appears after the following choices:
0. Load with standard console
1. Load with serial console
4. Type 1and press Enter to load the interactive restore menu via the appliance’s serial connection.
Note: If you do not select a display mode, the restore utility defaults to the standard console after 30 seconds.
Unless this is the first time you have restored the appliance to this major version, the utility automatically loads
the last restore configuration you used. To continue, confirm the settings in a series of pages.
5. Press Enter to confirm the copyright notice.
What to Do Next
Continue with Using the Interactive Menu to Restore an Appliance, page 17.
Using the Interactive Menu to Restore an Appliance
The restore utility for Firepower devices uses an interactive menu to guide you through the restoration.
Note: Only reimage your appliances during a maintenance window. Reimaging resets appliances in bypass mode
to a non-bypass configuration and disrupts traffic on your network until you reconfigure bypass mode. For more
information, see Traffic Flow During the Restore Process, page 13.
The menu displays the options listed in the following table.
Table 2 Restore Menu Options
Option Description For more information, see...
1 IP Configuration Specify network information about the
management interface on the appliance you
want to restore, so that the appliance can
communicate with the server where you placed
the ISO and any update files.
Identifying the Appliance’s
Management Interface, page 18
2 Choose the transport
protocol
Specify the location of the ISO image you will use
to restore the appliance, as well as any
credentials the appliance needs to download the
file.
Specifying ISO Image Location and
Transport Method, page 19
3 Select Patches/Rule
Updates
Specify a system software and intrusion rules
update to be applied after the appliance is
restored to the base version in the ISO image.
Updating System Software and
Intrusion Rules During Restore,
page 20
4 Download and Mount
ISO
Download the appropriate ISO image and any
system software or intrusion rule updates. Mount
the ISO image.
Downloading the ISO and Update Files
and Mounting the Image, page 20

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 18
Navigate the menu using your arrow keys. To select a menu option, use the up and down arrows. Use the right
and left arrow keys to toggle between the OK and Cancel buttons at the bottom of the page.
The menu presents two different kinds of options:
To select a numbered option, first highlight the correct option using the up and down arrows, then press Enter
while the OK button at the bottom of the page is highlighted.
To select a multiple-choice (radio button) option, first highlight the correct option using the up and down keys,
then press the space bar to mark that option with an X. To accept your selection, press Enter while the OK
button is highlighted.
In most cases, complete menu options 1, 2, 4, and 5, in order. Optionally, add menu option 3to install system
software and intrusion rule updates during the restore process.
If you are restoring an appliance to a different major version from the version currently installed on the appliance,
a two-pass restore process is required. The first pass updates the operating system, and the second pass installs
the new version of the system software.
If this is your second pass, or if the restore utility automatically loaded the restore configuration you want to use,
you can start with menu option 4: Downloading the ISO and Update Files and Mounting the Image, page 20.
However, Cisco recommends you double-check the settings in the restore configuration before proceeding.
Note: To use a previously saved configuration, start with menu option 6: Saving and Loading Restore
Configurations, page 23. After you load the configuration, skip to menu option 4: Downloading the ISO and Update
Files and Mounting the Image, page 20.
To restore an appliance using the interactive menu, use the following steps:
1. 1 IP Configuration — see Identifying the Appliance’s Management Interface, page 18.
2. 2 Choose the transport protocol — see Specifying ISO Image Location and Transport Method, page 19.
3. 3 Select Patches/Rule Updates (optional) — Updating System Software and Intrusion Rules During Restore,
page 20.
4. 4 Download and Mount ISO — see Downloading the ISO and Update Files and Mounting the Image, page 20.
5. 5 Run the Install — see Invoking the Restore Process, page 21.
Identifying the Appliance’s Management Interface
The first step in running the restore utility is to identify the management interface on the appliance you want to
restore, so that the appliance can communicate with the server where you copied the ISO and any update files. If
you are using LOM, remember that the management IP address for the appliance is not the LOM IP address.
To identify the appliance’s management interface:
1. From the restore utility main menu, select 1 IP Configuration.
5 Run the Install Invoke the restore process. Invoking the Restore Process, page 21
6 Save Configuration
7 Load Configuration
Save any set of restore configurations for later
use, or load a saved set.
Saving and Loading Restore
Configurations, page 23
8 Wipe Contents of Disk Securely scrub the hard drive to ensure that its
contents can no longer be accessed.
Scrubbing the Hard Drive, page 29
Table 2 Restore Menu Options (continued)
Option Description For more information, see...

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 19
2. Select the appliance’s management interface (generally eth0).
3. Select the protocol you are using for your management network: IPv4 or IPv6.
Options for assigning an IP address to the management interface appear.
4. Select a method to assign an IP address to the management interface: Static or DHCP:
—If you select Static, a series of pages prompts you to manually enter the IP address, network mask or prefix
length, and default gateway for the management interface.
—If you select DHCP, the appliance automatically detects the IP address, network mask or prefix length, and
default gateway for the management interface, then displays the IP address.
5. When prompted, confirm your settings.
If prompted, confirm the IP address assigned to the appliance’s management interface.
What to Do Next
Continue with the next section, Specifying ISO Image Location and Transport Method.
Specifying ISO Image Location and Transport Method
After you configure the management IP address that the restore process will use to download files it needs, you
must identify which ISO image you will use to restore the appliance. This is the ISO image that you downloaded
from the Support Site (see Obtaining the Restore ISO and Update Files, page 14), and stored on a web server, FTP
server, or SCP-enabled host.
The interactive menu prompts you to enter any necessary information to complete the download, as listed in the
following table.
Note that the restore utility will also look for update files in the ISO image directory.
To specify the restore files’ location and transport method:
1. From the restore utility main menu, select 2 Choose the transport protocol.
2. On the page that appears, select either HTTP, FTP, or SCP.
Table 3 Information Needed to Download Restore Files
To use... You must provide...
HTTP IP address for the web server
full path to the ISO image directory (for example, /downloads/ISOs/)
FTP IP address for the FTP server
path to the ISO image directory, relative to the home directory of the user whose
credentials you want to use (for example, mydownloads/ISOs/)
authorized user name and password for the FTP server
SCP IP address for the SCP server
authorized user name for the SCP server
full path to the ISO image directory
password for the user name you entered earlier
Note that before you enter your password, the appliance may ask you to add the SCP
server to its list of trusted hosts. You must accept to continue.

Restoring a Firepower Management Center to Factory Defaults
Cisco Firepower Management Center Getting Started Guide 20
3. Use the series of pages presented by the restore utility to provide the necessary information for the protocol
you chose, as described in Table 3 on page -19.
If your information was correct, the appliance connects to the server and displays a list of the Cisco ISO
images in the location you specified.
4. Select the ISO image you want to use.
5. When prompted, confirm your settings.
6. Do you want to install a system software or intrusion rule update as a part of the restore process?
—If yes, continue with the next section, Updating System Software and Intrusion Rules During Restore.
—If no, continue with Downloading the ISO and Update Files and Mounting the Image, page 20. Note that
you can use the system’s web interface to manually install updates after the restore process completes.
Updating System Software and Intrusion Rules During Restore
Optionally, you can use the restore utility to update the system software and intrusion rules after the appliance is
restored to the base version in the ISO image. Note that only Management Centers require rule updates.
The restore utility can only use one system software update and one rule update. However, system updates are
cumulative back to the last major version; rule updates are also cumulative. Cisco recommends that you obtain
the latest updates available for your appliance; see Obtaining the Restore ISO and Update Files, page 14.
If you choose not to update the appliance during the restore process, you can update later using the system’s web
interface. For more information, see the release notes for the update you want to install, as well as the Updating
System Software chapter in the Firepower Management Center Configuration Guide.
To install updates as part of the restore process:
1. From the restore utility main menu, select 3 Select Patches/Rule Updates.
The restore utility uses the protocol and location you specified in the previous procedure (see Specifying ISO
Image Location and Transport Method, page 19) to retrieve and display a list of any system software update
files in that location. If you are using SCP, enter your password when prompted to display the list of update
files.
2. Select the system software update, if any, you want to use.
You do not have to select an update; press Enter without selecting an update to continue. If there are no
system software updates in the appropriate location, the system prompts you to press Enter to continue.
The restore utility retrieves and displays a list of rule update files. If you are using SCP, enter your password
when prompted to display the list.
3. Select the rule update, if any, you want to use.
You do not have to select an update; press Enter without selecting an update to continue. If there are no rule
updates in the appropriate location, the system prompts you to press Enter to continue.
What to Do Next
Continue with the next section, Downloading the ISO and Update Files and Mounting the Image.
Downloading the ISO and Update Files and Mounting the Image
The final step before you invoke the restore process is to download the necessary files and mount the ISO image.