Cisco TelePresence Server 7010 Manual de usuario

Cisco Systems, Inc.

www.cisco.com

Cisco has more than 200 offices worldwide.

Addresses, phone numbers, and fax numbers

are listed on the Cisco website at

www.cisco.com/go/offices.

Firepower 7000 and 8000 Series

Installation Guide

Ver sion 6.0

November 5, 2015

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this

URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1721R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display

output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in

illustrative content is unintentional and coincidental.

Firepower 7000 and 8000 Series Installation Guide

CONTENTS

Introduction to the Firepower System 1-1

Firepower System Appliances 1-2

7000 and 8000 Series Appliances 1-3

Virtual Appliances 1-3

Cisco ASA with FirePOWER Services 1-3

Appliances Delivered with Version 6.0 1-4

Supported Capabilities by Firepower Management Center Model 1-5

Supported Capabilities by Managed Device Model 1-7

7000 and 8000 Series Device Chassis Designations 1-8

Firepower System Components 1-9

Licensing the Firepower System 1-11

Security, Internet Access, and Communication Ports 1-13

Internet Access Requirements 1-13

Communication Ports Requirements 1-14

Preconfiguring Appliances 1-16

Deploying on a Management Network 2-1

Management Deployment Considerations 2-1

Understanding Management Interfaces 2-2

Single Management Interface 2-2

Multiple Management Interfaces 2-2

Deployment Options 2-3

Deploying with Traffic Channels 2-3

Deploying with Network Routes 2-4

Security Considerations 2-5

Special Case: Connecting 8000 Series Devices 2-5

Deploying Firepower Managed Devices 3-1

Sensing Deployment Considerations 3-1

Understanding Sensing Interfaces 3-2

Passive Interfaces 3-2

Inline Interfaces 3-2

Switched Interfaces 3-3

Contents

Firepower 7000 and 8000 Series Installation Guide

Routed Interfaces 3-3

Hybrid Interfaces 3-4

Connecting Devices to Your Network 3-4

Using a Hub 3-4

Using a Span Port 3-5

Using a Network Tap 3-5

Cabling Inline Deployments on Copper Interfaces 3-5

Special Case: Connecting Firepower 8000 Series Devices 3-6

Deployment Options 3-7

Deploying with a Virtual Switch 3-7

Deploying with a Virtual Router 3-8

Deploying with Hybrid Interfaces 3-9

Deploying a Gateway VPN 3-10

Deploying with Policy-Based NAT 3-11

Deploying with Access Control 3-11

Using Multiple Sensing Interfaces on a Managed Device 3-16

Complex Network Deployments 3-18

Integrating with VPNs 3-18

Detecting Intrusions on Other Points of Entry 3-19

Deploying in Multi-Site Environments 3-20

Integrating Multiple Management Interfaces within a Complex Network 3-22

Integrating Managed Devices within Complex Networks 3-23

Installing a Firepower Managed Device 4-1

Included Items 4-1

Security Considerations 4-1

Identifying the Management Interfaces 4-2

Firepower 7000 Series 4-2

Firepower 8000 Series 4-2

Identifying the Sensing Interfaces 4-3

Firepower 7000 Series 4-3

Firepower 8000 Series 4-7

Using Devices in a Stacked Configuration 4-13

Connecting the Firepower 8140 4-14

Connecting the Firepower 82xx Family and Firepower and AMP 83xx Family 4-15

Using the 8000 Series Stacking Cable 4-18

Managing Stacked Devices 4-19

Rack-Mounting a Firepower Device 4-20

Redirecting Console Output 4-22

Contents

Firepower 7000 and 8000 Series Installation Guide

Using the Shell 4-22

Using the Web Interface 4-23

Testing an Inline Bypass Interface Installation 4-24

Setting Up Firepower Managed Devices 5-1

Understanding the Setup Process 5-2

Beginning the Setup 5-2

Performing Initial Setup on a Firepower Device Using the CLI 5-3

Registering a Firepower Device to a Management Center Using the CLI 5-4

Initial Setup Page: Firepower Devices 5-5

Next Steps 5-9

Using the LCD Panel on a Firepower Device 6-1

Understanding LCD Panel Components 6-2

Using the LCD Multi-Function Keys 6-3

Idle Display Mode 6-4

Network Configuration Mode 6-4

Allowing Network Reconfiguration Using the LCD Panel 6-6

System Status Mode 6-7

Information Mode 6-8

Error Alert Mode 6-9

Hardware Specifications 7-1

Rack and Cabinet Mounting Options 7-1

Firepower 7000 Series Devices 7-1

Firepower 7010, 7020, 7030, and 7050 7-1

Firepower 7110 and 7120 7-6

Firepower 7115, 7125, and AMP7150 7-13

Firepower 8000 Series Devices 7-21

Firepower 8000 Series Chassis Front View 7-22

Firepower 8000 Series Chassis Rear View 7-26

Firepower 8000 Series Physical and Environmental Parameters 7-29

Firepower 8000 Series Modules 7-32

Restoring a Firepower System Appliance to Factory Defaults 8-1

Before You Begin 8-1

Configuration and Event Backup Guidelines 8-1

Traffic Flow During the Restore Process 8-1

Understanding the Restore Process 8-2

Contents

Firepower 7000 and 8000 Series Installation Guide

Obtaining the Restore ISO and Update Files 8-3

Beginning the Restore Process 8-4

Starting the Restore Utility Using KVM or Physical Serial Port 8-4

Starting the Restore Utility Using Lights-Out Management 8-5

Using the Interactive Menu to Restore an Appliance 8-6

Identifying the Appliance’s Management Interface 8-8

Specifying ISO Image Location and Transport Method 8-8

Updating System Software and Intrusion Rules During Restore 8-10

Downloading the ISO and Update Files and Mounting the Image 8-10

Invoking the Restore Process 8-11

Saving and Loading Restore Configurations 8-13

Next Steps 8-14

Setting Up Lights-Out Management 8-14

Enabling LOM and LOM Users 8-16

Installing an IPMI Utility 8-17

Power Requirements for Firepower Devices A-1

Warnings and Cautions A-1

Static Control A-1

Firepower 70xx Family Appliances A-1

Installation A-2

Grounding/Earthing Requirements A-2

Firepower 71xx Family Appliances A-3

Installation A-4

Grounding/Earthing Requirements A-5

Firepower 81xx Family Appliances A-5

AC Installation A-6

DC Installation A-7

Grounding/Earthing Requirements A-8

Firepower 82xx Family Appliances A-9

AC Installation A-10

DC Installation A-11

Grounding/Earthing Requirements A-12

Firepower and AMP 83xx Family Appliances A-13

AC Installation A-14

DC Installation A-15

Grounding/Earthing Requirements A-16

Contents

Firepower 7000 and 8000 Series Installation Guide

Using SFP Transceivers in 3D71x5

and AMP7150 Devices B-1

3D71x5 and AMP7150 SFP Sockets and Transceivers B-1

Inserting an SFP Transceiver B-2

To insert an SFP transceiver: B-2

Removing an SFP Transceiver B-3

Inserting and Removing Firepower 8000 Series Modules C-1

Module Slots on the Firepower 8000 Series Devices C-1

Firepower 81xx Family C-1

Firepower 82xx Family and 83xx Family C-2

Included Items C-2

Identifying the Module Parts C-3

Before You Begin C-4

Removing a Module or Slot Cover C-5

Inserting a Module or Slot Cover C-6

Scrubbing the Hard Drive D-1

Scrubbing the Contents of the Hard Drive D-1

Preconfiguring Firepower Managed Devices E-1

Before You Begin E-1

Required Preconfiguration Information E-1

Optional Preconfiguration Information E-2

Preconfiguring Time Management E-2

Installing the System E-3

Registering a Device E-3

Preparing the Appliance for Shipment E-4

Deleting Devices from a Management Center E-4

Deleting a License from a Management Center E-5

Powering Down the Appliance E-5

Shipping Considerations E-5

Troubleshooting the Appliance Preconfiguration E-6

Contents

Firepower 7000 and 8000 Series Installation Guide

CHAPTER

1-1

Firepower 7000 and 8000 Series Installation Guide

Introduction to the Firepower System

The Cisco Firepower System combines the security of an industry-leading network intrusion protection

system with the power to control access to your network based on detected applications, users, and

URLs. You can also use Firepower System appliances to serve in a switched, routed, or hybrid (switched

and routed) environment; to perform network address translation (NAT); and to build secure virtual

private network (VPN) tunnels between the virtual routers of Firepower managed devices.

The Cisco Firepower Management Center provides a centralized management console and database

repository for the Firepower System. Managed devices installed on network segments monitor traffic for

analysis.

Devices in a passive deployment monitor traffic flowing across a network, for example, using a switch

SPAN, virtual switch, or mirror port. Passive sensing interfaces receive all traffic unconditionally and no

traffic received on these interfaces is retransmitted.

Devices in an inline deployment allow you to protect your network from attacks that might affect the

availability, integrity, or confidentiality of hosts on the network. Inline interfaces receive all traffic

unconditionally, and traffic received on these interfaces is retransmitted unless explicitly dropped by

some configuration in your deployment. Inline devices can be deployed as a simple intrusion prevention

system. You can also configure inline devices to perform access control as well as manage network

traffic in other ways.

This installation guide provides information about deploying, installing, and setting up Firepower

System appliances (devices and Management Centers). It also contains hardware specifications and

safety and regulatory information for Firepower System appliances.

Tip You can host virtual Firepower Management Centers and devices, which can manage and be managed

by physical appliances. However, virtual appliances do not support any of the system’s hardware-based

features: redundancy, switching, routing, and so on. See the Firepower NGIPSv for VMware Quick Start

Guide for more information.

The topics that follow introduce you to the Firepower System and describe its key components:

•Firepower System Appliances, page 1-2

•Firepower System Components, page 1-9

•Licensing the Firepower System, page 1-11

•Security, Internet Access, and Communication Ports, page 1-13

•Preconfiguring Appliances, page 1-16

1-2

Firepower 7000 and 8000 Series Installation Guide

Chapter 1 Introduction to the Firepower System

Firepower System Appliances

A Firepower System appliance is either a traffic-sensing managed device or a managing Firepower

Management Center:

Physical devices are fault-tolerant, purpose-built network appliances available with a range of

throughputs and capabilities. Firepower Management Centers serve as central management points for

these devices, and automatically aggregate and correlate the events they generate. There are several

models of each physical appliance type; these models are further grouped into series and family. Many

Firepower System capabilities are appliance dependent.

Firepower Management Centers

A Firepower Management Center provides a centralized management point and event database for your

Firepower System deployment. Firepower Management Centers aggregate and correlate intrusion, file,

malware, discovery, connection, and performance data, assessing the impact of events on particular hosts

and tagging hosts with indications of compromise. This allows you to monitor the information that your

devices report in relation to one another, and to assess and control the overall activity that occurs on your

network.

Key features of the Firepower Management Center include:

•device, license, and policy management

•display of event and contextual information using tables, graphs, and charts

•health and performance monitoring

•external notification and alerting

•correlation, indications of compromise, and remediation features for real-time threat response

•custom and template-based reporting

Managed Devices

Devices deployed on network segments within your organization monitor traffic for analysis. Devices

deployed passively help you gain insight into your network traffic. Deployed inline, you can use

Firepower devices to affect the flow of traffic based on multiple criteria. Depending on model and

license, devices:

•gather detailed information about your organization’s hosts, operating systems, applications, users,

files, networks, and vulnerabilities

•block or allow network traffic based on various network-based criteria, as well as other criteria

including applications, users, URLs, IP address reputations, and the results of intrusion or malware

inspections

•have switching, routing, DHCP, NAT, and VPN capabilities, as well as configurable bypass

interfaces, fast-path rules, and strict TCP enforcement

•have high availability (redundancy) to help you ensure continuity of operations, and stacking to

combine resources from multiple devices

Yo u must manage Firepower devices with a Firepower Management Center.

Appliance Types

The Firepower System can run on fault-tolerant, purpose-built physical network appliances available

from Cisco. There are several models of each Firepower Management Center and managed device; these

models are further grouped into series and family.

Otros manuales para TelePresence Server 7010

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Cortafuegos de Cisco

Cisco

Cisco PIX-525-UR-BUN - PIX 525 Unrestricted Bundle Manual de usuario

Cisco

Cisco PIX 501 - Security Appliance Manual de usuario

Cisco

Cisco ASA 5506-X Guía de inicio rápido

Cisco

Cisco ASA 5506-X Manual de usuario

Cisco

Cisco Small Business RV220W Manual de instrucciones

Cisco

Cisco RV110W Manual de usuario

Cisco

Cisco ASA 5506-X Manual de usuario

Cisco

Cisco RV120W Manual de instrucciones

Cisco

Cisco RV110W Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual de usuario

Cisco

Cisco ASA 5555-X Manual de usuario

Cisco

Cisco IronPort M1070 Manual de usuario

Cisco

Cisco M195 Manual

Cisco

Cisco Firepower 4100 Series Manual de instalación y operación

Cisco

Cisco Firepower 7010, Firepower 7020, Firepower 7030, Firepower 7050, Firepower 7110, Firepower 7120, Firepower 7115, Firepower... Manual de usuario

Cisco

Cisco 515E - PIX Restricted Bundle Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Cisco

Cisco LightStream 1010 Manual de usuario

Cisco

Cisco Firepower 1010 Manual

Cisco

Cisco ASA 5550 Series Manual de usuario

Cisco

Cisco FirePOWER 7000 Manual de usuario

Cisco

Cisco ASA 5508-X Manual de usuario

Cisco

Cisco ASA 5580 Manual de usuario

Manuales populares de Cortafuegos de otras marcas

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario

Trend Micro

Trend Micro Deep Edge Manual de usuario