Cisco Firepower 8120 User manual

Cisco Systems, Inc. www.cisco.com
Firepower 8000 Series Getting Started Guide 1
Cisco Firepower 8000 Series Getting
Started Guide
For the 81xx, 82xx, and 83xx Firepower and AMP models
Updated: February 15, 2016
This guide is organized as follows:
Package Contents
Deploying the Appliance
Cabling the Device
Installing the Firepower 8000 Series Device
Initial Device Setup
Restoring a Device to Factory Defaults
Scrubbing the Hard Drive
Related Documentation
Package Contents
This section lists the items included with each model. Note that contents are subject to change, and your exact contents
might contain additional or fewer items.
Chassis Models
A Firepower 8000 Series device can be delivered on a variety of chassis:
The Firepower 8120/8130/8140 and the AMP8050/AMP8150 are available as 1U appliances and can contain
up to three sensing modules. The following illustration of the rear of the chassis indicates the location of the
management interface.
Figure 1 Firepower 81xx and AMP 8xxx Series Chassis and Management Interface
Firepower 8130 (1U model), this chassis and can contain up to three sensing modules.
1Management interface
1
373425

Package Contents
Firepower 8000 Series Getting Started Guide 2
Note: Firepower 8120/8130/8140 and the AMP8050/AMP8150 models have identical chassis. If you are not
sure which model you have, see your packing list.
Note: You can add a stacking kit to the Firepower 8140 for a total 2U configuration.
The Firepower 8250 is available as a 2U appliance. The following illustration of the rear of the chassis indicates
the location of the management interface for each 2U appliance.
Figure 2 Firepower 82xx Series Chassis and Management Interface
The Firepower 8250 (2U model) chassis can contain up to seven modules. You can add up to three stacking
kits for a total 8U configuration:
—Firepower 8260 (4U model), the 40g primary chassis contains one stacking module and up to six sensing
modules. The secondary chassis contains one stacking module. You can add up to two stacking kits for a
total 8U configuration.
—Firepower 8270 (6U stacked model), the 40G primary chassis contains two stacking modules and up to
five sensing modules. Two secondary chassis contains one stacking module. You can add one stacking kit
for a total 8U configuration.
—Firepower 8290 (8U stacked model), the 40G primary chassis contains three stacking modules and up to
four sensing modules. Three secondary chassis contains one stacking module. This model is fully
configured and does not accept a stacking kit.
The Firepower and AMP 8350 are available as 2U appliances. The following illustration of the rear of the
chassis indicates the location of the management interface for each 2U appliance.
Figure 3 Firepower and AMP 83xx Series Chassis and Management Interface
The Firepower 8350 and AMP8350 (2U models) chassis can contain up to seven modules. You can add up to
three stacking kits for a total 8U configuration:
1Management interface
1Management interface
373426
1
1
373427

Package Contents
Firepower 8000 Series Getting Started Guide 3
—Firepower 8360 and AMP8360 (4U stacked models), the 40G primary chassis contains one stacking
module and up to six sensing modules. One secondary chassis contains one stacking module. You can add
up to two stacking kits for a total 8U configuration.
—Firepower 8370 and AMP8370 (6U stacked models), includes a 40G primary chassis with two stacking
modules and up to five sensing modules. Two secondary chassis contains one stacking module. You can
add one stacking kit for a total 8U configuration.
—Firepower 8390 and AMP8390 (8U stacked models), includes a 40G primary chassis with three stacking
modules and up to four sensing modules. Three secondary chassis contains one stacking module. This
model is fully configured and does not accept a stacking kit.
Included Items
Two power cords per chassis.
Two straight-through Cat 5e Ethernet cables per chassis.
One rack-mounting kit per chassis.
A combination of Network Modules (NetMods), as described in the following section.
Network Modules
The sensing interfaces for the Firepower 8000 Series appliances can be delivered with copper or fiber interfaces.
Caution: Modules are not hot-swappable. See the Firepower 8000 Series Hardware Installation Guide for
more information.
Configurable Bypass
The following modules contain configurable bypass sensing interfaces:
Quad-Port 1000BASE-T Copper Configurable Bypass
NetMod
Cable: standard copper
Passive configurations: 1, 2, 3, or 4
Inline configurations: 1 or 2 (left pair or right pair)
Quad-Port 1000BASE-SX Fiber Configurable Bypass
NetMod
Cable: Local Connector (LC) optical transceivers
Passive configurations: 1, 2, 3, or 4
Inline configurations: 1 or 2 (left pair or right pair)

Package Contents
Firepower 8000 Series Getting Started Guide 4
Non-bypass
The following modules contain non-bypass sensing interfaces:
Stacking Module
A stacking module connects two like devices to increase the power of the primary device. Stacking module(s) are
optional for Firepower 8140/ 8250/ 8350 and AMP8350; included for Firepower 8260/8270/8290, Firepower
8360/8370/8390, and AMP8360/8370/8390.
Dual-Port 10GBASE Fiber Configurable Bypass
NetMod
Cable: Local Connector (LC) optical transceivers,
either MMSR or SMLR
Passive configurations: 1 or 2
Inline configurations: 1
Dual-Port 40GBASE-SR4 Fiber Configurable Bypass
NetMod
For use only with Firepower 8270/8290, 8370/8390,
AMP8370/8390 or 40G-capable Firepower
8250/8260, 8350/8360, or AMP8350/8360
Cable: Multiple-Fiber Push On (MPO) connector
optical transceivers
Passive configurations: 1 or 2
Inline configurations: 1
Quad-Port 1000BASE-T Copper Non-Bypass
NetMod
Cable: standard copper
Passive configurations: 1, 2, 3, or 4
Inline configurations: 1 or 2 (left pair or right pair)
Quad-Port 1000BASE-SX Fiber Non-Bypass NetMod
Cable: Local Connector (LC) optical transceivers
Passive configurations: 1, 2, 3, or 4
Inline configurations: 1 or 2 (left pair or right pair)
Quad-Port 10GBASE-SR or LR Fiber Non-Bypass
NetMod
Cable: Local Connector (LC) optical transceivers
Passive configurations: 1, 2, 3, or 4
Inline configurations: 1 or 2 (left pair or right pair)

Package Contents
Firepower 8000 Series Getting Started Guide 5
Note: You cannot connect devices with different configurations; for example, do not connect a Firepower 8250 to
a Firepower 8350. For more information, see the Firepower 8000 Series Hardware Installation Guide.
Device Stacks
You can stack devices in t h e following configurations:
Two Firepower 8140s (not available for Firepower 8120/8130, AMP8050/AMP8150)
Up to four Firepower 8250s, up to four Firepower 8350s, or up to four AMP8350s
A Firepower 8260 (a 10G-capable primary device and a secondary device)
A Firepower 8360/AMP8360 (a 40G-capable primary device and a secondary device)
A Firepower 8270 or Firepower 8370/AMP8370 (a 40G-capable primary device and two secondary devices)
A Firepower 8290 or Firepower 8390/AMP8390 (a 40G-capable primary device and three secondary devices)
One device is designated as the primary device and is connected to the network segments. All other devices are
designated secondary devices, and are used to provide additional resources to the primary device.
Connect the primary device to the network segments you want to analyze in the same way that you would connect
a single Firepower 8140, Firepower 8250, or Firepower 8350/AMP8350. Connect the secondary devices to the
primary device as indicated in the stack cabling diagram. If a secondary device contains sensing interfaces, those
interfaces are not used.
After the devices are physically connected to the network segments and to each other, use a Firepower
Management Center to establish and manage the stack. See the Firepower 8000 Series Hardware Installation
Guide for complete information about using devices in stacked configurations.
Using the 8000 Series Stacking Cable
Install the devices within reach of the three-foot (one-meter) 8000 Series stacking cable to create the physical
connection between the primary and secondary devices. Stacking two Firepower 8140s requires one cable.
Stacking the Firepower 8250/8260/8270/8290, Firepower 8350/8360/8370/8390, or
AMP8350/8360/8370/8390 requires two cables per connection. Devices do not need to be powered down to
insert or remove the stacking cable.
Stacking Module
Cable: 8000 Series stacking cable
Firepower 8140: one per connection; up to two
8140 appliances
Firepower 8250/8260/8270/8290: two per
connection on up to four 8250 appliances
Firepower 8350/8360/8370/8390: two per
connection on up to four 8350 appliances
AMP8350/8360/8370/8390: two per connection on
up to four AMP8350 appliances

Package Contents
Firepower 8000 Series Getting Started Guide 6
To use the 8000 Series stacking cable:
To insert the cable, hold the cable end with release tab facing up, then insert the keyed end into the port on
the stacking module until you hear the latch click into place.
To remove the cable, pull on the release tab to release the latch, then remove the cable end.
Cabling Diagrams

Deploying the Appliance
Firepower 8000 Series Getting Started Guide 7
Deploying the Appliance
Cabling the Device
You can cable your device to configure passive or inline interfaces, depending on your deployment needs.
Use passive cabling if you want to:
monitor traffic
collect information about hosts, operating systems, applications, users, files, networks, and vulnerabilities
Use inline cabling if you want to use the same features as a passive deployment, plus:
configure a virtual switch, virtual router, or hybrid interface
perform network address translation (NAT)
use policies to block traffic based on access control features such as application control, user control, security
intelligence, URL dispositions, file control, malware detection, or intrusion prevention
Your device is typically deployed inside a firewall,
where it is connected to your trusted management
network and the various network segments you
want to monitor.
In a simple deployment scenario, you connect the
management interface on your device to your
trusted management network using an Ethernet
cable, then connect the sensing interfaces to the
network segments you want to monitor using the
appropriate cables (copper or fiber) in either a
passive or inline cabling configuration.
The trusted management network (a restricted
network protected from unauthorized access) may
have a single secure connection to the Internet for
security updates and similar functions, but is
separate from the rest of your network and is not
accessible to hosts used in daily business
operations.
You can connect sensing interfaces to different
network segments dedicated to particular
components of your business that have distinct
security requirements to target policies based on
the needs for specific segments. These segments
can include the DMZ (outward-facing servers, such
as mail, ftp, and web hosts), your internal network (hosts used in daily operation and similar applications), and
the core (hosts reserved for critical business assets), and can also include segments dedicated to remote
locations, mobile access, or other functions.
How you cable your sensing interfaces determines your configuration options. If you use passive cabling, you
can configure passive sensing interfaces. If you use inline cabling, you can create passive, inline, inline with
fail-open, virtual switch, virtual router, or hybrid sensing interfaces on your device. For more information on
deployment options and interface configurations and how they affect product features, see the Firepower
Firepower Management Center Configuration Guide and the Firepower 8000 Series Hardware Installation Guide.

Cabling the Device
Firepower 8000 Series Getting Started Guide 8
Use the appropriate cables (as indicated by your interface) and cabling diagram for the interface you want to
configure, then use the web interface on the Firepower Management Center to configure the interfaces. See
Connecting the Sensing Interfaces, page 8.
Connecting the Sensing Interfaces
This section describes the physical connection of the sensing interfaces. After you cable the interfaces, use the
web interface on the Firepower Management Center that manages the device to confi gure the device’s sensing
interfaces as passive, inline, inline with fail-open, switched, routed, or hybrid. Use only the interfaces on the front
of the device as sensing interfaces.
See the Firepower 8000 Series Hardware Installation Guide for detailed information on planning your deployment.
After you have selected a deployment model, cable the sensing interfaces as needed for your configuration.
Passive Interface Cabling
For each network segment you
want to monitor passively, connect
the appropriate cables (either
fiber or copper) to one sensing
interface.
Use this cabling when you want to
configure passive interfaces.

Installing the Firepower 8000 Series Device
Firepower 8000 Series Getting Started Guide 9
Inline Interface Cabling
Installing the Firepower 8000 Series Device
When you install an appliance, make sure that you can access the appliance’s console for initial setup. You can
access the console for initial setup using a keyboard and monitor with KVM, a serial connection, or using an
Ethernet connection to the management interface.
Note: The management interface is pre-configured with a default IPv4 address. However, you can reconfigure the
management interface with an IPv6 address as part of the setup process.
Keyboard and Monitor/KVM
You can connect a USB keyboard and VGA monitor to the appliance, which is useful for rack-mounted appliances
connected to a keyboard, video, and mouse (KVM) switch.
Serial Connection
You can connect a computer to any 8000 Series appliance using the physical serial port. Connect the appropriate
rollover serial cable (also known as a NULL modem cable or Cisco console cable) at any time, then configure the
remote management console to redirect the default VGA output to the serial port. To interact with the appliance,
use terminal emulation software such as HyperTerminal or XModem. The settings for this software are 9600 baud,
8 data bits, no parity checking, 1 stop bit, and no flow control. Firepower 8000 Series and AMP8000 Series
devices use an RJ-45 connection.
Ethernet Connection to Management Interface
Configure a local computer, which must not be connected to the internet, with the following network settings:
IP address: 192.168.45.2
netmask: 255.255.255.0
For each network segment you
want to monitor inline, connect
the appropriate cables (either
fiber or copper) sequentially to
pairs of sensing interfaces.
Use this cabling when you want
to configure inline, inline with
fail-open, switched, routed, or
hybrid interfaces.
If you want to take advantage of
the device’s configurable
fail-open capability, cable the
interfaces, then use the web
interface on the Firepower
Management Center that
manages the device to configure
the interface as inline with
fail-open.

Installing the Firepower 8000 Series Device
Firepower 8000 Series Getting Started Guide 10
default gateway: 192.168.45.1
Using an Ethernet cable, connect the network interface on the local computer to the management interface on the
appliance. Note that the management interface is preconfigured with a default IPv4 address. However, you can
reconfigure the management interface with an IPv6 address as part of the setup process.
To install the appliance:
1. Mount the appliance in your rack using the mounting kit and its supplied instructions.
2. Connect to the appliance using either a keyboard and monitor or an Ethernet connection.
—If you are using a keyboard and monitor to set up the appliance, use an Ethernet cable now to connect the
management interface to a protected network segment.
—If you plan to perform the initial setup process by connecting a computer directly to the appliance’s
physical management interface, you will connect the management interface to the protected network when
you finish setup.
3. Connect the sensing interfaces to the network segments you want to analyze using the appropriate cables for
your interfaces:
—Copper Sensing Interfaces: If your device includes copper sensing interfaces, make sure you use the
appropriate cables to connect them to your network; see Cabling Inline Deployments on Copper Interfaces
in the Firepower 8000 Series Hardware Installation Guide.
—Fiber Adapter Card: For devices with a fiber adapter card, connect the LC connectors on the optional
multimode fiber cable to two ports on the adapter card in any order. Connect the SC plug to the network
segment you want to analyze.
—Fiber Tap: If you are deploying the device with an optional fiber optic tap, connect the SC plug on the
optional multimode fiber cable to the “analyzer” port on the tap. Connect the tap to the network segment
you want to analyze.
—Copper Tap: If you are deploying the device with an optional copper tap, connect the A and B ports on the
left of the tap to the network segment you want to analyze. Connect the A and B ports on the right of the
tap (the “analyzer” ports) to two copper ports on the adapter card.
For more information about options for deploying the managed device, see Deploying Managed Devices in the
Firepower 8000 Series Hardware Installation Guide.
Note that if you are deploying a device with bypass interfaces, you are taking advantage of your device’s ability
to maintain network connectivity even if the device fails. See Testing an Inline Bypass Interface Installation in
the Firepower 8000 Series Hardware Installation Guide for information on installation and latency testing.
4. Attach the power cord to the appliance and plug into a power source.
If your appliance has redundant power supplies, attach power cords to both power supplies and plug them
into separate power sources.
5. Turn on the appliance.
6. If you are using a direct Ethernet connection to set up the appliance, confirm that the link LED is on for both
the network interface on the local computer and the management interface on the appliance.
If the management interface and network interface LEDs are not lit, try using a crossover cable. For more
information, see Cabling Inline Deployments on Copper Interfaces in the Firepower 8000 Series Hardware
Installation Guide.
What to Do Next
Complete the setup process using the procedures in Initial Device Setup, page 11.