Cisco Firepower 2100 Manual de usuario

Cisco Firepower 2100 Getting Started Guide

First Published: 2019-09-25

Last Modified: 2021-05-26

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CHAPTER 1

Which Operating System and Manager is Right

for You?

Your hardware platform can run one of two operating systems. For each operating system, you have a choice

of managers. This chapter explains the operating system and manager choices.

•Operating Systems, on page 1

•Managers, on page 1

Operating Systems

You can use either ASA or Firepower Threat Defense (FTD) operating systems on your hardware platform:

• ASA—The ASA is a traditional, advanced stateful firewall and VPN concentrator.

You may want to use the ASA if you do not need the advanced capabilities of the FTD, or if you need

an ASA-only feature that is not yet available on the FTD. Cisco provides ASA-to-FTD migration tools

to help you convert your ASA to an FTD if you start with ASA and later reimage to FTD.

• FTD—FTD, also known as Firepower NGFW, is a next-generation firewall that combines an advanced

stateful firewall, VPN concentrator, and next generation IPS. In other words, the FTD takes the best of

ASA functionality and combines it with the best next-generation firewall and IPS functionality.

We recommend using the FTD over the ASA because it contains most of the major functionality of the

ASA, plus additional next generation firewall and IPS functionality.

To reimage between the ASA and the FTD, see Reimage the Cisco ASA or Firepower Threat Defense Device.

Managers

The FTD and ASA support multiple managers.

Cisco Firepower 2100 Getting Started Guide

FTD Managers

Table 1: FTD Managers

DescriptionManager

FDM is a web-based, simplified, on-device manager. Because it is simplified, some

FTD features are not supported using FDM. You should use FDM if you are only

managing a small number of devices and don't need a multi-device manager.

Both FDM and CDO can discover the configuration on the firewall, so you

can use FDM and CDO to manage the same firewall. FMC is not compatible

with other managers.

Note

To get started with FDM, see Firepower Threat Defense Deployment with FDM, on

page 5.

Firepower Device Manager (FDM)

CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some

FTD features are not supported using CDO. You should use CDO if you want a

multi-device manager that offers a simplified management experience (similar to FDM).

And because CDO is cloud-based, there is no overhead of running CDO on your own

servers. CDO also manages other security devices, such as ASAs, so you can use a

single manager for all of your security devices.

In 6.7 and later, CDO offers Low Touch Provisioning that lets branch offices plug in

their hardware and leave it alone: the firewall will automtically register with CDO.

Both FDM and CDO can discover the configuration on the firewall, so you

can use FDM and CDO to manage the same firewall. FMC is not compatible

with other managers.

Note

To get started with CDO low-touch provisioning, see Firepower Threat Defense

Deployment with CDO and Low-Touch Provisioning, on page 107.

To get started with CDO provisioning, see Firepower Threat Defense Deployment with

CDO, on page 125.

Cisco Defense Orchestrator (CDO)

FMC is a powerful, web-based, multi-device manager that runs on its own server

hardware, or as a virtual device on a hypervisor. You should use FMC if you want a

multi-device manager, and you require all features on the FTD. FMC also provides

powerful analysis and monitoring of traffic and events.

In 6.7 and later, FMC can manage FTDs from the outside (or other data) interface instead

of from the standard Management interface. This feature is useful for remote branch

deployments.

FMC is not compatible with other managers because the FMC owns the FTD

configuration, and you are not allowed to configure the FTD directly,

bypassing the FMC.

Note

To get started with FMC on the Management network, see Firepower Threat Defense

Deployment with FMC, on page 29.

To get started with FMC on a remote network, see Firepower Threat Defense Deployment

with a Remote FMC, on page 63.

Firepower Management Center (FMC)

Cisco Firepower 2100 Getting Started Guide

Which Operating System and Manager is Right for You?

FTD Managers

DescriptionManager

The FTD REST API lets you automate direct configuration of the FTD. This API is

compatible with FDM and CDO use because they can both discover the configuration

on the firewall. You cannot use this API if you are managing the FTD using FMC.

The FTD REST API is not covered in this guide. For more information, see the FTD

REST API guide.

FTD REST API

The FMC REST API lets you automate configuration of FMC policies that can then be

applied to managed FTDs. This API does not manage an FTD directly.

The FMC REST API is not covered in this guide. For more information, see the FMC

REST API guide.

FMC REST API

ASA Managers

Table 2: ASA Managers

DescriptionManager

ASDM is a Java-based, on-device manager that provides full ASA functionality. You

should use ASDM if you prefer using a GUI over the CLI, and you only need to manage

a small number of ASAs. ASDM can discover the configuration on the firewall, so you

can also use the CLI, CDO, or CSM with ASDM.

To get started with ASDM, see ASA Appliance Mode Deployment with ASDM, on

page 165. If you know you want to use the ASA in Platform mode, see ASA Platform

Mode Deployment with ASDM and Firepower Chassis Manager, on page 185

Adaptive Security Device Manager

(ASDM)

You should use the ASA CLI if you prefer CLIs over GUIs.

The CLI is not covered in this guide. For more information, see the ASA configuration

guides.

CLI

CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some

ASA features are not supported using CDO. You should use CDO if you want a

multi-device manager that offers a simplified management experience. And because

CDO is cloud-based, there is no overhead of running CDO on your own servers. CDO

also manages other security devices, such as FTDs, so you can use a single manager

for all of your security devices. CDO can discover the configuration on the firewall, so

you can also use the CLI or ASDM.

CDO is not covered in this guide. To get started with CDO, see the CDO home page.

Cisco Defense Orchestrator (CDO)

CSM is a powerful, multi-device manager that runs on its own server hardware. You

should use CSM if you need to manage large numbers of ASAs. CSM can discover the

configuration on the firewall, so you can also use the CLI or ASDM. CSM does not

support managing FTDs.

CSM is not covered in this guide. For more information, see the CSM user guide.

Cisco Security Manager (CSM)

Cisco Firepower 2100 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

DescriptionManager

The ASA REST API lets you automate ASA configuration. However, the API does not

include all ASA features, and is no longer being enhanced.

The ASA REST API is not covered in this guide. For more information, see the ASA

REST API guide.

ASA REST API

Cisco Firepower 2100 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

CHAPTER 2

Firepower Threat Defense Deployment with FDM

Is This Chapter for You?

This chapter explains how to complete the initial set up and configuration of your Firepower Threat Defense

(FTD) device using the Firepower Device Manager (FDM) web-based device setup wizard.

FDM lets you configure the basic features of the software that are most commonly used for small networks.

It is especially designed for networks that include a single device or just a few, where you do not want to use

a high-powered multiple-device manager to control a large network containing many FDM devices.

If you are managing large numbers of devices, or if you want to use the more complex features and

configurations that FTD allows, use the Firepower Management Center (FMC) instead.

The Firepower 2100 Series hardware can run either FTD software or ASA software. Switching between FTD

and ASA requires you to reimage the device. See Reimage the Cisco ASA or Firepower Threat Defense

Device.

The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System

(FXOS). The Firepower 2100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is

supported for troubleshooting purposes. See the FXOS troubleshooting guide for more information.

Privacy Collection Statement—The Firepower 2100 Series does not require or actively collect

personally-identifiable information. However, you can use personally-identifiable information in the

configuration, for example for usernames. In this case, an administrator might be able to see this information

when working with the configuration or when using SNMP.

•End-to-End Procedure, on page 6

•Review the Network Deployment and Default Configuration, on page 7

•Cable the Device, on page 10

•Power on the Device, on page 11

•(Optional) Change Management Network Settings at the CLI, on page 12

•Log Into FDM, on page 14

•Complete the Initial Configuration, on page 14

•Configure Licensing, on page 16

•Configure the Firewall in Firepower Device Manager, on page 22

•Access the FTD and FXOS CLI, on page 25

•Power Off the Firewall Using FDM, on page 27

•What's Next?, on page 27

Cisco Firepower 2100 Getting Started Guide

End-to-End Procedure

See the following tasks to deploy FTD with FDM on your chassis.

Review the Network Deployment and Default Configuration, on page 7.Pre-Configuration

Cable the Device, on page 10.Pre-Configuration

Power on the Device, on page 11.Pre-Configuration

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

End-to-End Procedure

(Optional) Change Management Network Settings at the CLI, on page 12.FTD CLI

Log Into FDM, on page 14.Firepower Device

Manager

Complete the Initial Configuration, on page 14.Firepower Device

Manager

(Optional) Obtain feature licenses (Configure Licensing, on page 16).Cisco Commerce

Workspace

Generate a license token (Configure Licensing, on page 16).Smart Software

Manager

page 16).

Firepower Device

Manager

Configure the Firewall in Firepower Device Manager, on page 22.Firepower Device

Manager

Review the Network Deployment and Default Configuration

You can manage the FTD using FDM from either the Management 1/1 interface or the inside interface. The

dedicated Management interface is a special interface with its own network settings.

The following figure shows the recommended network deployment. If you connect the outside interface

directly to a cable modem or DSL modem, we recommend that you put the modem into bridge mode so the

FTD performs all routing and NAT for your inside networks. If you need to configure PPPoE for the outside

interface to connect to your ISP, you can do so after you complete initial setup in FDM.

If you cannot use the default management IP address (for example, your management network does not include

a DHCP server), then you can connect to the console port and perform initial setup at the CLI, including

setting the Management IP address, gateway, and other basic networking settings.

If you need to change the inside IP address, you can do so after you complete initial setup in FDM. For

example, you may need to change the inside IP address in the following circumstances:

•(7.0 and later) The inside IP address is 192.168.95.1. (6.7 and earlier) The inside IP address is 192.168.1.1.

If the outside interface tries to obtain an IP address on the 192.168.1.0 network, which is a common

default network, the DHCP lease will fail, and the outside interface will not obtain an IP address. This

problem occurs because the FTD cannot have two interfaces on the same network. In this case you must

change the inside IP address to be on a new network.

• If you add the FTD to an existing inside network, you will need to change the inside IP address to be on

the existing network.

Note

The following figure shows the default network deployment for FTD using FDM with the default configuration.

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

Review the Network Deployment and Default Configuration

Figure 1: Suggested Network Deployment

For 6.7 and earlier, the Ethernet 1/2 inside IP address is 192.168.1.1.

For 6.5 and earlier, the Management 1/1 default IP address is 192.168.45.45.

Note

Default Configuration

The configuration for the f after initial setup includes the following:

•inside—Ethernet 1/2, IP address (7.0 and later) 192.168.95.1; (pre-7.0) 192.168.1.1.

•outside—Ethernet 1/1, IP address from IPv4 DHCP and IPv6 autoconfiguration

•inside→outside traffic flow

•management—Management 1/1 (management)

• (6.6 and later) IP address from DHCP

• (6.5 and earlier) IP address 192.168.45.45

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

Default Configuration

Otros manuales para Firepower 2100

Tabla de contenidos

Otros manuales de Cortafuegos de Cisco

Cisco

Cisco Spam Manual de usuario

Cisco

Cisco PIX 501 Manual

Cisco

Cisco ISA 3000 Manual de usuario

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual

Cisco

Cisco M195 Manual

Cisco

Cisco ASA 5508-X Manual de usuario

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual

Cisco

Cisco Small Business RV220W Manual de instrucciones

Cisco

Cisco FPR1010-ASA-K9 Manual de usuario

Cisco

Cisco TelePresence Server 7010 Manual de usuario

Cisco

Cisco Firepower 2100 Series Guía de referencia rápida

Cisco

Cisco FirePOWER 7000 Manual de usuario

Cisco

Cisco ASA 5506-X Guía de inicio rápido

Cisco

Cisco 3100 Series Manual

Cisco

Cisco amp threat grid Manual de usuario

Cisco

Cisco ASA 5555-X Manual de usuario

Cisco

Cisco PIX 501 Manual de usuario

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Cisco

Cisco Meraki MX64W Manual de usuario

Cisco

Cisco 515E - PIX Restricted Bundle Manual de usuario

Cisco

Cisco FMC 1600 Manual

Cisco

Cisco CSA 90 Series Manual del producto

Cisco

Cisco Firepower 4100 Series Manual

Cisco

Cisco MX400 Manual de usuario

Manuales populares de Cortafuegos de otras marcas

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario

Trend Micro

Trend Micro Deep Edge Manual de usuario