Cisco ASA Guía de inicio rápido

Cisco ASA Firepower Module

Easy Setup Guide

1 Preconfiguring

2 Configuring Security Policy

3 Updating Database

4 Reporting & Monitoring

You can easily set up your ASA Firepower Module

in this step-by-step guide

This guide provides information about basic configuration of security policies (ac-

cess control policies) on the Cisco ASA Firepower module, using the Cisco Adap-

tive Security Device Manager (ASDM). Before proceeding, make sure that you have

completed the initial configuration of the Cisco ASA with Firepower Services, refer

to the separate "Cisco ASA with Firepower Services Easy Setup Guide" and so on.

Some configurations in this guide require having optional licenses installed. In those

cases, "MEMO" or "Caution" columns specify the necessary licenses.

The Cisco ASA with Firepower Services ship with a base license for Application

Visibility and Control (AVC). Optional subscriptions for Next-Generation IPS

（N-

GIPS）

, Cisco Advanced Malware Protection

（AMP）

, and URL Filtering (URL) can

be added to the base configuration for advanced functionality.

●AVC

：

Supports more than 3,000 application-layer and risk-based controls that

can launch tailored intrusion prevention system (IPS) threat detection policies to

optimize security effectiveness.

●NGIPS

：

Provides highly effective threat prevention and full contextual awareness

of users, infrastructure, applications, and content to detect multivector threats

and automate defense response.

●AMP

：

Delivers inline network protection against sophisticated malware and Cisco

Threat Grid sandboxing.

●URL

：

Adds the capability to filter more than 280 million top-level domains by risk

level and more than 82 categories.

Redirect traffic to the ASA Firepower module by creating a service policy on the

ASA that identifies specific traffic that you want to send.

Preconfiguring

1-1 Before You Begin

1-2 Configuring Service Policy

11Click [Configuration].

2Click [Firewall].

Optional Licenses

Characters

Included

in SKU

NGIPS AMP URL

NGIPS License TA ●- -

AMP License AMP - ●-

URL License URL - - ●

NGIPS & AMP License TAM ● ● -

NGIPS & URL License TAC ●-●

NGIPS & AMP & URL License TAMC ●●●

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

8Click [ASA FirePOWER

Inspection].

5Click [Next].

Use the default [Global - applies

to all interfaces]. This option ap-

plies the service policy globally

to all interfaces.

3Click [Service Policy

Rules].

4Click [Add Service Policy

Rule] from the [Add] menu

bar.

6Click [Use class-default as

the traffic class].

7Click [Next].

9Click [Enable ASA Fire-

POWER for this traffic

flow].

10 Click [Permit traffic] or

[Close traffic].

The [Permit traffic] sets the

ASA to allow all traffic through,

uninspected, if the module is

unavailable. The [Close traffic]

sets the ASA to block all traffic if

the module is unavailable.

11 Click [Finish].

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

Create file policies to configure the system to perform malware protection and file

control as part of your overall access control configuration. The file policies that

you create here will be used in ”2-2 Configuring Access Control Policy: Visual-

ization”.

Configuring Security Policy

2-1 Configuring File Policy: Blocking Malware

1Click [ASA FirePOWER

Configuration].

2Click [Policies].

3Click [Files].

4Click [New File Policy].

The [New File Policy] pop-up

window appears.

5Enter a name for your new

policy in the [Name] field.

6Click [Store ASA Fire-

POWER Changes].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

7Click [Add File Rule].

The [Add File Rule] pop-up win-

dow appears.

8Click [Block Malware]

from the [Action] drop-

down list.

9Select one or more [File

Types].

10 Click [Add].

You can select one or more [File

Type Categories] and search for

a file type by its name or de-

scription.

11 Click [Store ASA Fire-

POWER Changes].

12 Click [Store ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

Caution

At step ❽, the rule actions [Malware Cloud Lookup].and

[Block Malware] require the NGIPS License or the AMP

License. If you donʼt have these licenses, select the rule

actions [Detect Files].or [Block Files].

●Detect Files rules allow you to log the detection of

specific file types while still allowing their transmis-

sion.

●Block File rules allow you to block specific file types.

●Malware Cloud Lookup rules allow you to log the

malware disposition of files traversing your network

based on a cloud lookup, while still allowing their

transmission.

●Block Malware rules allow you to calculate the SHA-

256 hash value of specific file types, then use a cloud

lookup process to first determine if files traversing

your network contain malware, then block files that

represent threats.

MEMO

You can set separate rules within a file policy to take different actions for different file types,

application protocols, or directions of transfer. If you want to do so, repeat the steps ❼to ⓫.

By editing the [Default Allow All Traffic] policy that the system provides by default,

configure access control rules to exert granular control over network traffic logging

and handling (visualization).

2-2 Configuring Access Control Policy: Visualization

1Click [Access Control

Policy].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Click the edit icon ( )

next to the [Default Allow

All Traffic] policy.

3Click [Add Rule].

The [Add Rule] pop-up window

appears.

4Enter a name for your new

rule in the [Name] field.

5Click [Inspection].

9Click [Log at End of Con-

nection].

10 Click [Add].

11 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

12 Click [Apply All].

6Select [Connectivity Over

Security] from the [Intru-

sion Policy] drop-down

list.

7Select the policy name of

the step 2-1 ❺from the

[File Policy] drop-down

list.

8Click [Logging].

Caution

At step ❻, the intrusion policies [Connectivity Over Security] and so on require the NGIPS Li-

cense. If you donʼt have this license, select the [None].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Enter a name for your new

rule in the [Name] field.

3Select [Block] from the

[Action] drop-down list.

4Select [above rule] from

the [Insert] drop-down

list.

5Click [Applications].

6Select one or more [Avail-

able Applications].

7Click [Add to Rule].

You can select one or more

[Application Filters] and search

for a application by its name or

description.

8Click [URL].

910

9Select one or more

[Categories and URLs].

10 Select one [Reputations].

11 Click [Add to Rule].

If you do not specify a reputa-

tion level, the system defaults to

[Any], meaning all levels.

12 Click [Logging].

1Click [Add Rule].

The [Add Rule] pop-up window

appears.

Because the [Default Allow All Traffic] allows all traffic through, configure access

control rules to block specific traffic, for example, application or web traffic that is

high risk or has low business relevance.

2-3 Configuring Access Control Policy: Blocking

13 Click [Log at Beginning

and End of Connection].

14 Click [Add].

Caution

At step ❿, the URL reputation requires the URL License. And you can only select one reputa-

tion level. Selecting a reputation level also selects all reputations more severe than that level.

For example, if you configure a rule to block [Suspicious sites] (level 2), it also automatically

blocks [High Risk] (level 1) sites.

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

15 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

16 Click [Apply All].

As new vulnerabilities become known, Cisco releases rule updates that you can

first import onto your ASA Firepower module, then implement by applying affected

access control, network analysis, and intrusion policies.

Rule updates are cumulative, and Cisco recommends you always import the latest

update.

1Click [Updates].

2Click [Rule Updates].

Updating Database

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

3Select [Download new

Rule Update from the

Support Site] and click

two options below.

4Click [Import].

The system installs the rule up-

date.

5Click [Enable Recurring

Rule Update Imports].

The page expands to display

options for configuring recurring

imports.

6Select import frequency

and click two options be-

low.

We recommend [Daily].

7Click [Save].

8Click [Geolocation Up-

dates].

9Click [Download and install

geolocation update from

the Support Site].

10 Click [Import].

The update process begins.

The average duration of update

installation is 30 to 40 minutes.

11 Click [Enable Recurring

Weekly Updates].

The page expands to display

options for configuring recurring

imports.

12 Specify the time and day of

the week when you want

weekly GeoDB updates to

occur.

13 Click [Save].

13 12

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

The Cisco Adaptive Security Device Manager (ASDM) provides many useful report-

ing and monitoring features to assist you in the daily administration of your system.

Reporting & Monitoring

4-2 Monitoring the System

1Click [Monitoring].

2Click [ASA FirePOWER

Monitoring].

4 -1 Viewing Reports

1Click [Home].

2Click [ASA FirePOWER

Reporting].

3Click individual items to get

more detailed information.

4Click individual items to get

more detailed information.

3Click [Real Time Eventing].

Cisco ASA Firepower Module Easy Setup Guide

4Reporting & Monitoring

Tabla de contenidos

Otros manuales de Hardware de red de Cisco

Cisco

Cisco Secure Network Server 3700 Series Manual

Cisco

Cisco linksys PLTK300 Manual de usuario

Cisco

Cisco ASR 5500 Manual de instrucciones

Cisco

Cisco ONS 15454 Manual de usuario

Cisco

Cisco Nexus 93180LC-EX Manual de usuario

Cisco

Cisco OL-7822-06 Manual de usuario

Cisco

Cisco SCE8000 GBE Manual de usuario

Cisco

Cisco ATM Cable Interface Processor ACIP-SM(=) Manual del operador

Cisco

Cisco 5400 Series Manual de instrucciones

Cisco

Cisco WAVE-574-K9 - Wide Area Virtualization Engine... Manual

Cisco

Cisco 15530-LCMB-0200 - ESCON Multiplexing Line Card... Manual

Cisco

Cisco CVPN3015-NR - VPN Concentrator 3015 Manual de usuario

Cisco

Cisco CiscoWorks Wireless LAN Solution Engine Manual del operador

Cisco

Cisco Network Storage System NSS3000 Series Manual de usuario

Cisco

Cisco Aironet 340 Series Manual de usuario

Cisco

Cisco IAD1101 Manual de usuario

Cisco

Cisco IPS 7.1 Manual de usuario

Cisco

Cisco ATA 191 Manual de usuario

Cisco

Cisco Secure Firewall Management Center 1700 Manual de usuario

Cisco

Cisco 2600 Series Documento técnico

Cisco

Cisco WBPN Manual de usuario

Cisco

Cisco Edge Concentrator MGX 8220 Manual de referencia

Cisco

Cisco NM-1A-T3 - 1port Ds3 Atm Network Module Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual de usuario

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario