Cisco Firepower 1010 Manual de usuario

Cisco Firepower 1010 Getting Started Guide

First Published: 2019-06-13

Last Modified: 2022-02-28

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CHAPTER 1

Which Operating System and Manager is Right

for You?

Your hardware platform can run one of two operating systems. For each operating system, you have a choice

of managers. This chapter explains the operating system and manager choices.

•Operating Systems, on page 1

•Managers, on page 1

Operating Systems

You can use either the Secure Firewall ASA or the Secure Firewall Threat Defense (formerly Firepower Threat

Defense) operating system on your hardware platform:

• ASA—The ASA is a traditional, advanced stateful firewall and VPN concentrator.

You may want to use the ASA if you do not need the advanced capabilities of the threat defense, or if

you need an ASA-only feature that is not yet available on the threat defense. Cisco provides ASA-to-threat

defense migration tools to help you convert your ASA to the threat defense if you start with ASA and

later reimage to threat defense.

• Threat Defense—The threat defense is a next-generation firewall that combines an advanced stateful

firewall, VPN concentrator, and next generation IPS. In other words, the threat defense takes the best of

ASA functionality and combines it with the best next-generation firewall and IPS functionality.

We recommend using the threat defense over the ASA because it contains most of the major functionality

of the ASA, plus additional next generation firewall and IPS functionality.

To reimage between the ASA and the threat defense, see the Cisco Secure Firewall ASA and Threat Defense

Reimage Guide.

Managers

The threat defense and ASA support multiple managers.

Cisco Firepower 1010 Getting Started Guide

Threat Defense Managers

Table 1: Threat Defense Managers

DescriptionManager

The management center is a powerful, web-based, multi-device manager that runs on

its own server hardware, or as a virtual device on a hypervisor. You should use the

management center if you want a multi-device manager, and you require all features

on the threat defense. The management center also provides powerful analysis and

monitoring of traffic and events.

In 6.7 and later, the management center can manage the threat defenses from the outside

(or other data) interface instead of from the standard Management interface. This feature

is useful for remote branch deployments.

The management center is not compatible with other managers because the

management center owns the threat defense configuration, and you are not

allowed to configure the threat defense directly, bypassing the management

center.

Note

To get started with the management center on the Management network, see Threat

Defense Deployment with the Management Center, on page 5.

To get started with the management center on a remote network, see Threat Defense

Deployment with a Remote Management Center, on page 47.

Secure Firewall Management Center

(formerly Firepower Management Center)

The device manager is a web-based, simplified, on-device manager. Because it is

simplified, some threat defense features are not supported using the device manager.

You should use the device manager if you are only managing a small number of devices

and don't need a multi-device manager.

Both the device manager and CDO in FDM mode can discover the

configuration on the firewall, so you can use the device manager and CDO

to manage the same firewall. The management center is not compatible with

other managers.

Note

To get started with the device manager, see Threat Defense Deployment with the Device

Manager, on page 89.

Secure Firewall Device Manager (formerly

Firepower Device Manager)

Cisco Firepower 1010 Getting Started Guide

Which Operating System and Manager is Right for You?

Threat Defense Managers

DescriptionManager

CDO offers two management modes:

• (7.2 and later) Cloud-delivered management center mode with all of the

configuration functionality of an on-premises management center. For the analytics

functionality, you can use either Secure Cloud Analytics in the cloud or an on-prem

management center.

• Device manager mode with a simplified user experience. This mode is not covered

in this guide.

Because CDO is cloud-based, there is no overhead of running CDO on your own servers.

CDO also manages other security devices, such as ASAs, so you can use a single manager

for all of your security devices.

To get started with CDO provisioning, see Threat Defense Deployment with CDO, on

page 117.

Cisco Defense Orchestrator (CDO)

The threat defense REST API lets you automate direct configuration of the threat defense.

This API is compatible with the device manager and CDO use because they can both

discover the configuration on the firewall. You cannot use this API if you are managing

the threat defense using the management center.

The threat defense REST API is not covered in this guide. For more information, see

the Cisco Secure Firewall Threat Defense REST API Guide.

Secure Firewall Threat Defense REST API

The management center REST API lets you automate configuration of management

center policies that can then be applied to managed threat defenses. This API does not

manage the threat defense directly.

The management center REST API is not covered in this guide. For more information,

see the Secure Firewall Management Center REST API Quick Start Guide.

Secure Firewall Management Center REST

API

ASA Managers

Table 2: ASA Managers

DescriptionManager

ASDM is a Java-based, on-device manager that provides full ASA functionality. You

should use ASDM if you prefer using a GUI over the CLI, and you only need to manage

a small number of ASAs. ASDM can discover the configuration on the firewall, so you

can also use the CLI, CDO, or CSM with ASDM.

To get started with ASDM, see ASA Deployment with ASDM, on page 167.

Adaptive Security Device Manager

(ASDM)

You should use the ASA CLI if you prefer CLIs over GUIs.

The CLI is not covered in this guide. For more information, see the ASA configuration

guides.

CLI

Cisco Firepower 1010 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

DescriptionManager

CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some

ASA features are not supported using CDO. You should use CDO if you want a

multi-device manager that offers a simplified management experience. And because

CDO is cloud-based, there is no overhead of running CDO on your own servers. CDO

also manages other security devices, such as threat defenses, so you can use a single

manager for all of your security devices. CDO can discover the configuration on the

firewall, so you can also use the CLI or ASDM.

CDO is not covered in this guide. To get started with CDO, see the CDO home page.

CDO

CSM is a powerful, multi-device manager that runs on its own server hardware. You

should use CSM if you need to manage large numbers of ASAs. CSM can discover the

configuration on the firewall, so you can also use the CLI or ASDM. CSM does not

support managing the threat defenses.

CSM is not covered in this guide. For more information, see the CSM user guide.

Cisco Security Manager (CSM)

The ASA REST API lets you automate ASA configuration. However, the API does not

include all ASA features, and is no longer being enhanced.

The ASA REST API is not covered in this guide. For more information, see the Cisco

ASA Secure Firewall REST API Quick Start Guide.

ASA REST API

Cisco Firepower 1010 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

CHAPTER 2

Threat Defense Deployment with the

Management Center

Is This Chapter for You?

To see all available operating systems and managers, see Which Operating System and Manager is Right for

You?, on page 1. This chapter applies to the threat defense with the management center.

This chapter explains how to complete the initial configuration of your threat defense and how to register the

firewall to the management center located on your management network. For remote branch deployment,

where the management center resides at a central headquarters, see Threat Defense Deployment with a Remote

Management Center, on page 47.

In a typical deployment on a large network, you install multiple managed devices on network segments. Each

device controls, inspects, monitors, and analyzes traffic, and then reports to a managing management center.

The management center provides a centralized management console with a web interface that you can use to

perform administrative, management, analysis, and reporting tasks in service to securing your local network.

About the Firewall

The hardware can run either threat defense software or ASA software. Switching between threat defense and

ASA requires you to reimage the device. You should also reimage if you need a different software version

than is currently installed. See Reimage the Cisco ASA or Firepower Threat Defense Device.

The firewall runs an underlying operating system called the Secure Firewall eXtensible Operating System

(FXOS). The firewall does not support the FXOS Secure Firewall chassis manager; only a limited CLI is

supported for troubleshooting purposes. See the Cisco FXOS Troubleshooting Guide for the Firepower

1000/2100 Series Running Firepower Threat Defense for more information.

Privacy Collection Statement—The firewall does not require or actively collect personally-identifiable

information. However, you can use personally-identifiable information in the configuration, for example for

usernames. In this case, an administrator might be able to see this information when working with the

configuration or when using SNMP.

•Before You Start, on page 6

•End-to-End Procedure, on page 6

•Review the Network Deployment, on page 8

•Cable the Device (6.5 and Later), on page 10

•Cable the Device (6.4), on page 12

•Power On the Firewall, on page 13

•(Optional) Check the Software and Install a New Version, on page 13

Cisco Firepower 1010 Getting Started Guide

•Complete the Threat Defense Initial Configuration, on page 15

•Log Into the Management Center, on page 23

•Obtain Licenses for the Management Center, on page 24

•Register the Threat Defense with the Management Center, on page 25

•Configure a Basic Security Policy, on page 28

•Access the Threat Defense and FXOS CLI, on page 43

•Power Off the Firewall, on page 44

•What's Next?, on page 45

Before You Start

Deploy and perform initial configuration of the management center. See the Cisco Firepower Management

Center 1600, 2600, and 4600 Hardware Installation Guide or Cisco Secure Firewall Management Center

Virtual Getting Started Guide.

End-to-End Procedure

See the following tasks to deploy the threat defense with management center on your chassis.

Cisco Firepower 1010 Getting Started Guide

Threat Defense Deployment with the Management Center

Before You Start

Install the firewall. See the hardware installation guide.Pre-Configuration

Review the Network Deployment, on page 8.Pre-Configuration

Cable the Device (6.5 and Later), on page 10

Cable the Device (6.4), on page 12.

Pre-Configuration

Power On the Firewall, on page 13.Pre-Configuration

(Optional) Check the Software and Install a New Version, on page 13CLI

Cisco Firepower 1010 Getting Started Guide

Threat Defense Deployment with the Management Center

End-to-End Procedure

Complete the Threat Defense Initial Configuration, on page 15.CLI or Device

Manager

Log Into the Management Center, on page 23.Management Center

Obtain Licenses for the Management Center, on page 24: Buy feature licenses.Cisco Commerce

Workspace

Obtain Licenses for the Management Center, on page 24: Generate a license

token for the management center.

Smart Software

Manager

Obtain Licenses for the Management Center, on page 24: Register the

management center with the Smart Licensing server.

Management Center

Configure a Basic Security Policy, on page 28Management Center

Review the Network Deployment

6.5 and Later Deployment

The dedicated Management 1/1 interface is a special interface with its own network settings. By default, the

Management 1/1 interface is enabled and configured as a DHCP client. If your network does not include a

DHCP server, you can set the Management interface to use a static IP address during initial setup at the console

port. You can configure other interfaces after you connect the threat defense to the management center. Note

that Ethernet1/2 through 1/8 are enabled as switch ports by default.

In 6.5 and earlier, the Management interface is configured with an IP address (192.168.45.45).

Note

The following figure shows the recommended network deployment for the Firepower 1010.

The management center can only communicate with the threat defense on the Management interface. Moreover,

both the management center and the threat defense require internet access from management for licensing

and updates.

In the following diagram, the Firepower 1010 acts as the internet gateway for the Management interface and

the management center by connecting Management 1/1 directly to an inside switch port, and by connecting

the management center and management computer to other inside switch ports. (This direct connection is

allowed because the Management interface is separate from the other interfaces on the threat defense.)

Cisco Firepower 1010 Getting Started Guide

Threat Defense Deployment with the Management Center

Review the Network Deployment

Otros manuales para Firepower 1010

Tabla de contenidos

Otros manuales de Cortafuegos de Cisco

Cisco

Cisco Spam Manual de usuario

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Cisco

Cisco C690 Manual de usuario

Cisco

Cisco PIX 506 - Firewall Manual de usuario

Cisco

Cisco FMC 1600 Manual

Cisco

Cisco Firepower 7010, Firepower 7020, Firepower 7030, Firepower 7050, Firepower 7110, Firepower 7120, Firepower 7115, Firepower... Manual de usuario

Cisco

Cisco RV110W Manual de usuario

Cisco

Cisco TelePresence Server 7010 Manual de usuario

Cisco

Cisco RV110W Manual de usuario

Cisco

Cisco Small Business RV220W Manual de instrucciones

Cisco

Cisco Cisco ASA Series Instrucciones de instalación

Cisco

Cisco ASA 5580 Manual de usuario

Cisco

Cisco LightStream 1010 Manual de usuario

Cisco

Cisco Meraki MX64 Manual de usuario

Cisco

Cisco ISA3000-4C-K9 Manual

Cisco

Cisco Small Business RV220W Manual de instrucciones

Cisco

Cisco Firepower 2120 Manual

Cisco

Cisco RV110W Manual de instrucciones

Cisco

Cisco M190 Manual de usuario

Cisco

Cisco 881W - Integrated Services Router Wireless Manual de instrucciones

Cisco

Cisco Firepower 4100 Series Manual

Cisco

Cisco PIX 501 Manual de usuario

Cisco

Cisco ASA 5512-X Manual de usuario

Cisco

Cisco ASA 5512-X Manual

Manuales populares de Cortafuegos de otras marcas

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario

Trend Micro

Trend Micro Deep Edge Manual de usuario