Cisco Secure Firewall Management Center 1700 Manual de usuario

Cisco Secure Firewall Management Center 1700,

2700, and 4700 Getting Started Guide

First Published: 2023-11-28

Last Modified: 2023-11-28

About the Secure Firewall Management Center 1700, 2700, and 4700

The management center provides centralized, integrated, and streamlined management of threat defense

devices. It also provides application control, intrusion prevention system (IPS), URL filtering, and malware

protection functions. In a typical deployment on a large network, you install multiple managed threat defense

devices on network segments. Each device controls, inspects, monitors, and analyzes traffic, and then reports

to a management center.

The Secure Firewall Management Center 1700, 2700, and 4700 appliances provide significant performance

and efficiency.

This doc explains how to complete the cabling and the initial configuration of the management center.

Before You Begin

Install the management center. For more information, see the Cisco Secure Firewall Management Center

1700, 2700 and 4700 Hardware Installation Guide.

For a complete list of the Cisco Secure Firewall series documentation and where to find it, see the documentation

roadmap.

End-to-End Procedure

The following flowchart illustrates the tasks to deploy and configure the management center.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

Review Network Deployment, on page 2Pre-Configuration

Cable the Management Center, on page 4Pre-Configuration

Power on the Management Center, on page 6Pre-Configuration

Perform Initial Setup of the Management Center Using the CLI, on page 8Management Center

Review Automatic Initial Configuration, on page 14Management Center

Configure Management Center Administrative Settings, on page 15Management Center

Add Managed Devices to the Management Center, on page 16Management Center

Review Network Deployment

Before you deploy the management center, you need information about the environment in which it operates.

The following figure shows a typical network deployment for a management center.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Review Network Deployment

By default, the management center connects to your local management network through its management

interface (eth0). This connection the management center communicates with a management computer, managed

devices, services such as DHCP, DNS, NTP, and the internet.

The management center requires internet access to support Smart Licensing, Secure Firewall threat intelligence

director, and malware defense services. Depending on the services provided by your local management

network, the management center may also require internet access to reach an NTP or DNS server. You can

configure your network to provide internet access to the management center directly or through a firewall

device.

You can upload updates for system software, Vulnerability Database (VDB), Geolocation Database (GeoDB),

and intrusion rules directly to the management center from an internet connection or from a local computer

that has these updates from the internet.

To establish the connection between the management center and one of its managed devices, you need the IP

address of at least one of the devices: the management center or the managed device. We recommend using

both IP addresses if available. However, you may only know one IP address. For example, managed devices

may be using private addresses behind NAT, so you only know the management center address. In this case,

you can specify the management center address on the managed device plus a one-time, unique password of

your choice called a NAT ID. On the management center, you specify the same NAT ID to identify the

managed device.

The initial setup and configuration described in this document is for a management center that has internet

access. If you deploy a management center in an air-gapped environment, see the Cisco Secure Firewall

Management Center Administration Guide for your version for alternative methods you can use to support

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Review Network Deployment

certain features such as configuring a proxy for HTTP communications, or using a Smart Software Satellite

Server for Smart Licensing.

Initial Network Configuration for Management Centers

• Management Interface

By default, the management center seeks out a local DHCP server for the IP address, network mask, and

default gateway to use for the management interface (eth0). If the management center cannot reach a

DHCP server, it uses the default IPv4 address 192.168.45.45, netmask 255.255.255.0, and gateway

192.168.45.1. During the initial setup, you can accept these defaults or specify different values.

If you use DHCP, you must use DHCP reservation, so the assigned address does

not change. If the DHCP address changes, device registration will fail because

the management center network configuration gets out of sync. To recover from

a DHCP address change, connect to the management center (using the hostname

or the new IP address) and navigate to System ( ) > Configuration >

Management Interfaces to reset the network.

Note

If you use IPv6 addressing for the management interface, you must configure the address using the web

interface after completing the initial setup.

• DNS Servers

Specify IP addresses for up to two DNS servers. If you use an evaluation license, you may choose not

to use DNS.

During initial configuration, you can also provide a hostname and domain to

facilitate communication between the management center and other hosts through

DNS; you can configure more domains after completing the initial setup.

Note

• NTP Servers

Synchronize the system time on your management center and its managed devices during initial

configuration. You can accept the default (0.sourcefire.pool.ntp.org and 1.sourcefire.pool.ntp.org as the

primary and secondary NTP servers, respectively), or supply FQDNs or IP addresses for one or two

trusted NTP servers reachable from your network. If you do not use DNS, you cannot use FQDNs to

specify the NTP servers.

Cable the Management Center

You can cable the management center using one or more of the three connections listed below:

•Connect a keyboard to the USB port and a monitor to the VGA port of the management center. By default,

the management center sends console messages to the VGA port.

• Connect the management center CIMC port to a local network reachable from a local computer where

you can run an IPMI utility for Lights-Out Management. To use this connection see Set Up Light-Out

Management, on page 17.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Cable the Management Center

• Connect a local computer to the management center serial port as described in the procedure below.

AC power supplies have internal grounding so no additional chassis grounding is required when the supported

AC power cords are used. For more information about supported power cords, see the Cisco Secure Firewall

Management Center 1700, 2700 and 4700 Hardware Installation Guide

After rack-mounting the chassis, follow these steps to connect the cables.

Figure 1: Cable the Appliance to a Management Network

Before you begin

Read the Regulatory and Compliance Safety Information document before installing the management center

chassis.

Important

Rack-mount the appliance as described in the Cisco Secure Firewall Management Center 1700, 2700, and

4700 Hardware Installation Guide.

If you plan to cable the appliance using the console port and a local computer, redirect the console output to

the console port. For more information, see Redirect the Console Output Using the Web Interface, on page

11 and Redirect the Console Output Using the CLI, on page 11.

Procedure

Step 1 Cable the following to your management network:

• Management 1/1 interface

• Management computer

Step 2 Connect the management computer to the console port using an RJ-45 to DB-9 console cable. Use the console

port to access the CLI for initial setup.

Step 3 Use a terminal emulation software (such as HyperTerminal or XModem) on the local computer to interact

with the management center. Set the terminal emulator for 9600 baud, 8 data bits, no parity, 1 stop bit, and

no flow control.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Cable the Management Center

Step 4 (Optional) Install any supported SFP+ transceiver and cable in the 10-Gigabit Ethernet SFP+ interface (data

port) for management center 1700, 2700, and 4700, or the 25-Gigabit Ethernet SFP+ interface for management

center 4700. Connect this interface to the same or different network from your other management interfaces

depending on your network needs.

We recommend that you use only the supported SFP+ transceivers. For more information about

the SFPs that 1700, 2700, and 4700 support, see the Cisco Secure Firewall Management Center

1700, 2700 and 4700 Hardware Installation Guide.

Note

What to do next

1. Power on the Management Center, on page 6

2. Perform Initial Setup of the Management Center Using the CLI, on page 8

Power on the Management Center

The management center 1700, 2700, and 4700 appliances use 1050-W AC power supplies. For more information

about the power supplies and the supported power cords, see the Cisco Firepower Management Center 1700,

2700, and 4700 Hardware Installation Guide.

Before you begin

It is important that you provide reliable power for your device, for example, use an uninterruptable power

supply (UPS). Loss of power without first shutting down the chassis can cause serious file system damage.

Procedure

Step 1 Use one of the supported power cords to connect the power supplies of the chassis to your power source.

We recommend connecting both power supplies on the management center. The appliance

generates a health alert if only one power supply is connected.

Note

Step 2 Press the Power button (labeled "1") on the front of the chassis, and verify that the power supply status LED

(labeled "2") is on.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Power on the Management Center

Figure 2: Power Button and Power Supply Status LED

Access the CLI or the Linux Shell on the Management Center

We strongly recommend that you do not use the Linux shell unless directed by Cisco TAC or explicit

instructions in the user documentation.

Caution

Before you begin

Establish a direct physical connection with the management center using the serial port, a keyboard and

monitor, or establish an SSH session with the management center interface.

Procedure

Step 1 Log in to the management center using the credentials for the CLI admin user.

This action gives you access to the management center CLI.

Step 2 Use the show version command to verify the management center software version.

Example:

> show version

-----------[ firepower ]------------

Model : Cisco Firewall Management Center 4700 (66) Version 7.4.0 (Build

1482)

UUID : a10ed34e-d127-11e8-b440-728439d95305

Rules update version : 2023-11-15-001-vrt

LSP version : lsp-rel-20231115-1600

VDB version : 375

----------------------------------------------------

Step 3 To access the Linux shell from the management center CLI, enter the expert command.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Access the CLI or the Linux Shell on the Management Center

Shutdown or Restart the Management Center

Use the web interface to initiate an orderly shutdown or restart.

You can also shut down the management center using the system shutdown command from the management

center CLI.

For virtual devices, see the documentation for your virtual platform. For VMware in particular, custom power

options are part of VMware Tools.

Tip

Do not shutdown the management center using the power button; this action can cause data loss. Using the

web interface or the shutdown command prepares the system to safely power off and restart without losing

configuration data.

Caution

Procedure

Step 1 Log in to your management center, choose System ( ) > Configuration >Process.

Step 2 Choose one of the following:

•Shutdown Management Center to initiate a graceful shutdown of the management center.

•Reboot Management Center to shut down and restart the management center gracefully.

•Restart Management Center Console to restart the communications, database, and HTTP server

processes. This action is typically used during troubleshooting, and may cause deleted hosts to reappear

in the network map.

Perform Initial Setup of the Management Center Using the CLI

You can also perform the initial setup using the CLI. You must complete an Initial Configuration Wizard that

configures the new appliance to communicate on your trusted management network.

Before you begin

• Cable the management center as described in Cable the Management Center, on page 4.

• Ensure that you have the following information for the management center to communicate on your

management network:

• An IPv4 management IP address

• A network mask and a default gateway (if not using DHCP)

• Connect to the management center using one of three methods:

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Shutdown or Restart the Management Center

• Connect a USB keyboard and VGA monitor to the management center for console access.

• Connect a local computer to the management center serial port with an RJ-45 to DP-9 console cable.

• After configuring the IP using the above two methods, access the device using SSH to connect to

the management center using the IPv4 management IP address.

Procedure

Step 1 Log in to the management center at the console using admin as the username and Admin123 as the password

for the admin account. The password is case-sensitive.

Step 2 When prompted, press Enter to display the End User License Agreement (EULA).

Step 3 Review the EULA. When prompted, enter yes,YES, or press Enter to accept the EULA.

You cannot proceed without accepting the EULA. If you respond with anything other than yes,

YES, or Enter, the system logs you out.

Important

Step 4 To ensure system security and privacy, the first time you log in to the management center you are required

to change the admin password. When the system prompts for a new password, enter a new password complying

with the restrictions, and enter the same password again when the system prompts for confirmation.

The management center compares your password against a password cracking dictionary that

checks not only for many English dictionary words but also other character strings that could be

easily cracked with common password hacking techniques. For example, the initial configuration

script may reject passwords such as "abcdefg" or "passw0rd."

Note

On completion of the initial configuration process, the system sets the passwords for the two

admin accounts (one for web access and the other for CLI access) to the same value, complying

with the strong password requirements described in the Cisco Secure Firewall Management Center

Administration Guide. If you change the password for either admin account thereafter, they are

no longer be the same. You can remove the strong password requirement from the web interface

admin account.

Note

Step 5 Configure the network settings.

When you follow the prompts, your options appear in parentheses such as (y/n). Defaults are listed in square

brackets such as [y]. Note the following when responding to the prompts:

•If you are setting up an appliance after restoring it to factory defaults and you did not delete the appliance's

license and network settings, the prompts are prepopulated with the retained values.

• Press Enter to accept the default.

• For hostname, enter a fully qualified domain name (<hostname>.<domain>) or host name. This field is

required.

• If you use DHCP, you must use DHCP reservation, so the assigned address does not change. If the DHCP

address changes, device registration will fail because the management center network configuration gets

out of sync. To recover from a DHCP address change, connect to the management center (using the

hostname or the new IP address) and navigate to System ( ) > Configuration >Management Interfaces

to reset the network.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Perform Initial Setup of the Management Center Using the CLI

• If you choose to configure IPv4 manually, the system prompts for the IPv4 address, netmask, and default

gateway.

• Configuring a DNS server is optional; to specify no DNS server enter none. Otherwise specify IPv4

addresses for one or two DNS servers. If you specify two addresses, separate them with a comma. If you

specify more than two DNS servers, the system ignores the additional entries. If your management center

does not have internet access, you cannot use a DNS outside of your local network.

If you use an evaluation license, specifying DNS is optional, but DNS is required to use

permanent licenses for your deployment.

Note

• You must enter the fully qualified domain name or IP address for at least one NTP server reachable from

your network. You may not specify FQDNs for NTP servers if you are not using DHCP. You may specify

two servers (a primary and a secondary); separate their information with a comma. If you specify more

than two DNS servers, the system ignores the additional entries. If your management center does not

have internet access, you cannot use an NTP server outside of your local network.

Example:

Enter a hostname or fully qualified domain name for this system [firepower]: fmc

Configure IPv4 via DHCP or manually? (dhcp/manual) [DHCP]: manual

Enter an IPv4 address for the management interface [192.168.45.45]: 10.10.0.66

Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.224

Enter the IPv4 default gateway for the management interface [ ]: 10.10.0.65

Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220]:

208.67.222.222,208.67.220.220

Enter a comma-separated list of NTP servers [0.sourcefire.pool.ntp.org,

1.sourcefire.pool.ntp.org]:

Step 6 Review the settings. The system displays a summary of the configurations.

Example:

Hostname: fmc

IPv4 configured via: manual configuration

Management interface IPv4 address: 10.10.0.66

Management interface IPv4 netmask: 255.255.255.224

Management interface IPv4 gateway: 10.10.0.65

DNS servers: 208.67.222.222,208.67.220.220

NTP servers: 0.sourcefire.pool.ntp.org, 1.sourcefire.pool.ntp.org

Step 7 Confirm the settings.

• If the settings are correct, enter yand press Enter to accept the settings and continue.

• If the settings are incorrect, enter nand press Enter. The system prompts for the information again,

beginning with the hostname.

Example:

Are these settings correct? (y/n) y

If your networking information has changed, you will need to reconnect.

Updated network configuration.

Step 8 After you accept the settings, you can enter exit to exit the management center CLI.

Cisco Secure Firewall Management Center 1700, 2700, and 4700 Getting Started Guide

About the Secure Firewall Management Center 1700, 2700, and 4700

Perform Initial Setup of the Management Center Using the CLI

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Hardware de red de Cisco

Cisco

Cisco IPS-4240-K9 - Intrusion Protection Sys 4240 Manual de usuario

Cisco

Cisco 2600 Series Documento técnico

Cisco

Cisco Edge 300 Series Guía de inicio rápido

Cisco

Cisco 220 Series Smart Plus Manual de usuario

Cisco

Cisco TelePresence Manual de servicio

Cisco

Cisco 5400 Manual de instrucciones

Cisco

Cisco VIP-4R/4T Instrucciones de funcionamiento y mantenimiento

Cisco

Cisco IAD2430 Series Manual

Cisco

Cisco SCE 2000 4/8xFE Manual de usuario

Cisco

Cisco 2610 - Router - EN Manual de usuario

Cisco

Cisco NCS 2002 Manual de instrucciones

Cisco

Cisco Wide Area Virtualization Engine 274 Manual

Cisco

Cisco SCE8000 GBE Manual del operador

Cisco

Cisco ONS 15454 M12 Manual de usuario

Cisco

Cisco FirePOWER 8000 Series Manual de usuario

Cisco

Cisco ATA 191 Manual de usuario

Cisco

Cisco ON100 Network Agent Manual de usuario

Cisco

Cisco Cisco ONS 15600 SDH Manual de usuario

Cisco

Cisco Firepower 1010 Manual de usuario

Cisco

Cisco ME 1200 Series Manual

Cisco

Cisco NSS2000 Series Manual de usuario

Cisco

Cisco GS7000 Instrucciones de funcionamiento

Cisco

Cisco CVPN3002-K9 - Fast Ethernet VPN Gateway Manual de usuario

Cisco

Cisco Catalyst 8300 Series Manual

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario