Cisco Firepower 1100 Manuel utilisateur

Cisco Firepower 1100 Getting Started Guide

First Published: 2019-06-13

Last Modified: 2022-06-09

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CHAPTER 1

Which Operating System and Manager is Right

for You?

Your hardware platform can run one of two operating systems. For each operating system, you have a choice

of managers. This chapter explains the operating system and manager choices.

•Operating Systems, on page 1

•Managers, on page 1

Operating Systems

You can use either the Secure Firewall ASA or the Secure Firewall Threat Defense (formerly Firepower Threat

Defense) operating system on your hardware platform:

• ASA—The ASA is a traditional, advanced stateful firewall and VPN concentrator.

You may want to use the ASA if you do not need the advanced capabilities of the threat defense, or if

you need an ASA-only feature that is not yet available on the threat defense. Cisco provides ASA-to-threat

defense migration tools to help you convert your ASA to the threat defense if you start with ASA and

later reimage to threat defense.

• Threat Defense—The threat defense is a next-generation firewall that combines an advanced stateful

firewall, VPN concentrator, and next generation IPS. In other words, the threat defense takes the best of

ASA functionality and combines it with the best next-generation firewall and IPS functionality.

We recommend using the threat defense over the ASA because it contains most of the major functionality

of the ASA, plus additional next generation firewall and IPS functionality.

To reimage between the ASA and the threat defense, see the Cisco Secure Firewall ASA and Threat Defense

Reimage Guide.

Managers

The threat defense and ASA support multiple managers.

Cisco Firepower 1100 Getting Started Guide

Threat Defense Managers

Table 1: Threat Defense Managers

DescriptionManager

The management center is a powerful, web-based, multi-device manager that runs on

its own server hardware, or as a virtual device on a hypervisor. You should use the

management center if you want a multi-device manager, and you require all features

on the threat defense. The management center also provides powerful analysis and

monitoring of traffic and events.

In 6.7 and later, the management center can manage the threat defenses from the outside

(or other data) interface instead of from the standard Management interface. This feature

is useful for remote branch deployments.

The management center is not compatible with other managers because the

management center owns the threat defense configuration, and you are not

allowed to configure the threat defense directly, bypassing the management

center.

Note

To get started with the management center on the Management network, see Threat

Defense Deployment with the Management Center, on page 5.

To get started with the management center on a remote network, see Threat Defense

Deployment with a Remote Management Center, on page 41.

Secure Firewall Management Center

(formerly Firepower Management Center)

The device manager is a web-based, simplified, on-device manager. Because it is

simplified, some threat defense features are not supported using the device manager.

You should use the device manager if you are only managing a small number of devices

and don't need a multi-device manager.

Both the device manager and CDO in FDM mode can discover the

configuration on the firewall, so you can use the device manager and CDO

to manage the same firewall. The management center is not compatible with

other managers.

Note

To get started with the device manager, see Threat Defense Deployment with the Device

Manager, on page 83.

Secure Firewall Device Manager (formerly

Firepower Device Manager)

Cisco Firepower 1100 Getting Started Guide

Which Operating System and Manager is Right for You?

Threat Defense Managers

DescriptionManager

CDO offers two management modes:

• (7.2 and later) Cloud-delivered management center mode with all of the

configuration functionality of an on-premises management center. For the analytics

functionality, you can use either Secure Cloud Analytics in the cloud or an on-prem

management center.

• Device manager mode with a simplified user experience. This mode is not covered

in this guide.

Because CDO is cloud-based, there is no overhead of running CDO on your own servers.

CDO also manages other security devices, such as ASAs, so you can use a single manager

for all of your security devices.

To get started with CDO provisioning, see Threat Defense Deployment with CDO, on

page 109.

Cisco Defense Orchestrator (CDO)

The threat defense REST API lets you automate direct configuration of the threat defense.

This API is compatible with the device manager and CDO use because they can both

discover the configuration on the firewall. You cannot use this API if you are managing

the threat defense using the management center.

The threat defense REST API is not covered in this guide. For more information, see

the Cisco Secure Firewall Threat Defense REST API Guide.

Secure Firewall Threat Defense REST API

The management center REST API lets you automate configuration of management

center policies that can then be applied to managed threat defenses. This API does not

manage the threat defense directly.

The management center REST API is not covered in this guide. For more information,

see the Secure Firewall Management Center REST API Quick Start Guide.

Secure Firewall Management Center REST

API

ASA Managers

Table 2: ASA Managers

DescriptionManager

ASDM is a Java-based, on-device manager that provides full ASA functionality. You

should use ASDM if you prefer using a GUI over the CLI, and you only need to manage

a small number of ASAs. ASDM can discover the configuration on the firewall, so you

can also use the CLI, CDO, or CSM with ASDM.

To get started with ASDM, see ASA Deployment with ASDM, on page 157.

Adaptive Security Device Manager

(ASDM)

You should use the ASA CLI if you prefer CLIs over GUIs.

The CLI is not covered in this guide. For more information, see the ASA configuration

guides.

CLI

Cisco Firepower 1100 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

DescriptionManager

CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some

ASA features are not supported using CDO. You should use CDO if you want a

multi-device manager that offers a simplified management experience. And because

CDO is cloud-based, there is no overhead of running CDO on your own servers. CDO

also manages other security devices, such as threat defenses, so you can use a single

manager for all of your security devices. CDO can discover the configuration on the

firewall, so you can also use the CLI or ASDM.

CDO is not covered in this guide. To get started with CDO, see the CDO home page.

CDO

CSM is a powerful, multi-device manager that runs on its own server hardware. You

should use CSM if you need to manage large numbers of ASAs. CSM can discover the

configuration on the firewall, so you can also use the CLI or ASDM. CSM does not

support managing the threat defenses.

CSM is not covered in this guide. For more information, see the CSM user guide.

Cisco Security Manager (CSM)

The ASA REST API lets you automate ASA configuration. However, the API does not

include all ASA features, and is no longer being enhanced.

The ASA REST API is not covered in this guide. For more information, see the Cisco

ASA Secure Firewall REST API Quick Start Guide.

ASA REST API

Cisco Firepower 1100 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

CHAPTER 2

Threat Defense Deployment with the

Management Center

Is This Chapter for You?

To see all available operating systems and managers, see Which Operating System and Manager is Right for

You?, on page 1. This chapter applies to the threat defense with the management center.

This chapter explains how to complete the initial configuration of your threat defense and how to register the

firewall to the management center located on your management network. For remote branch deployment,

where the management center resides at a central headquarters, see Threat Defense Deployment with a Remote

Management Center, on page 41.

In a typical deployment on a large network, you install multiple managed devices on network segments. Each

device controls, inspects, monitors, and analyzes traffic, and then reports to a managing management center.

The management center provides a centralized management console with a web interface that you can use to

perform administrative, management, analysis, and reporting tasks in service to securing your local network.

About the Firewall

The hardware can run either threat defense software or ASA software. Switching between threat defense and

ASA requires you to reimage the device. You should also reimage if you need a different software version

than is currently installed. See Reimage the Cisco ASA or Firepower Threat Defense Device.

The firewall runs an underlying operating system called the Secure Firewall eXtensible Operating System

(FXOS). The firewall does not support the FXOS Secure Firewall chassis manager; only a limited CLI is

supported for troubleshooting purposes. See the Cisco FXOS Troubleshooting Guide for the Firepower

1000/2100 Series Running Firepower Threat Defense for more information.

Privacy Collection Statement—The firewall does not require or actively collect personally-identifiable

information. However, you can use personally-identifiable information in the configuration, for example for

usernames. In this case, an administrator might be able to see this information when working with the

configuration or when using SNMP.

•Before You Start, on page 6

•End-to-End Procedure, on page 6

•Review the Network Deployment, on page 8

•Cable the Firewall, on page 10

•Power on the Firewall, on page 12

•(Optional) Check the Software and Install a New Version, on page 13

•Complete the Threat Defense Initial Configuration, on page 15

Cisco Firepower 1100 Getting Started Guide

•Log Into the Management Center, on page 22

•Obtain Licenses for the Management Center, on page 23

•Register the Threat Defense with the Management Center, on page 24

•Configure a Basic Security Policy, on page 27

•Access the Threat Defense and FXOS CLI, on page 38

•Power Off the Firewall, on page 39

•What's Next?, on page 40

Before You Start

Deploy and perform initial configuration of the management center. See the Cisco Firepower Management

Center 1600, 2600, and 4600 Hardware Installation Guide or Cisco Secure Firewall Management Center

Virtual Getting Started Guide.

End-to-End Procedure

See the following tasks to deploy the threat defense with the management center on your chassis.

Cisco Firepower 1100 Getting Started Guide

Threat Defense Deployment with the Management Center

Before You Start

Install the firewall. See the hardware installation guide.Pre-Configuration

Review the Network Deployment, on page 8.Pre-Configuration

Cable the Firewall, on page 10.Pre-Configuration

Power on the Firewall, on page 12.Pre-Configuration

(Optional) Check the Software and Install a New Version, on page 13CLI

Cisco Firepower 1100 Getting Started Guide

Threat Defense Deployment with the Management Center

End-to-End Procedure

Complete the Threat Defense Initial Configuration, on page 15.CLI or Device

Manager

Log Into the Management Center, on page 22.Management Center

Obtain Licenses for the Management Center, on page 23: Buy feature licenses.Cisco Commerce

Workspace

Obtain Licenses for the Management Center, on page 23: Generate a license

token for the management center.

Smart Software

Manager

Obtain Licenses for the Management Center, on page 23: Register the

management center with the Smart Licensing server.

Management Center

Configure a Basic Security Policy, on page 27.Management Center

Review the Network Deployment

The dedicated Management 1/1 interface is a special interface with its own network settings. By default, the

Management 1/1 interface is enabled and configured as a DHCP client. If your network does not include a

DHCP server, you can set the Management interface to use a static IP address during initial setup at the console

port. You can configure other interfaces after you connect the threat defense to the management center.

In 6.5 and earlier, the Management interface is configured with an IP address (192.168.45.45).

Note

See the following sample network deployments for ideas on how to place your threat defense device in your

network.

Separate Management Network

Both the management center and threat defense require internet access from Management for licensing and

updates.

The following figure shows a possible network deployment for the Firepower 1100 where the management

center and management computer connect to the management network. The management network has a path

to the internet for licensing and updates.

Cisco Firepower 1100 Getting Started Guide

Threat Defense Deployment with the Management Center

Review the Network Deployment

Autres manuels pour Firepower 1100

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Porte

Cisco

Cisco Linksys WAG54GP2 Manuel utilisateur

Cisco

Cisco D-PCG1000 PowerKEY CAS Manuel utilisateur

Cisco

Cisco Catalyst 8200 Series Manuel utilisateur

Cisco

Cisco VG204 Manuel utilisateur

Cisco

Cisco AS5400 Series Manuel utilisateur

Cisco

Cisco RF Gateway 10 Comment utiliser

Cisco

Cisco Linksys WAG160N Manuel utilisateur

Cisco

Cisco DPQ2425 Manuel utilisateur

Cisco

Cisco SIEMENS HICOM 330E Instructions d'installation et d'utilisation

Cisco

Cisco EPC3928 DOCSIS Manuel utilisateur

Cisco

Cisco DPC2325 Manuel utilisateur

Cisco

Cisco VG202 Manuel utilisateur

Cisco

Cisco TES301 Manuel utilisateur

Cisco

Cisco DPC3929 Manuel utilisateur

Cisco

Cisco RF Gateway 1 Modules Manuel utilisateur

Cisco

Cisco 3522 BRI Manuel d'installation et d'exploitation

Cisco

Cisco TES301 Manuel utilisateur

Cisco

Cisco IP/VC 3526 Comment utiliser

Cisco

Cisco DPC3848 Manuel utilisateur

Cisco

Cisco Intelligent Wireless Access Gateway Manuel utilisateur

Cisco

Cisco IOS XE Intelligent Services Manuel utilisateur

Cisco

Cisco Comcast Xfinity DPC3939 Manuel utilisateur

Cisco

Cisco Expressway CE1000 Appliance Manuel utilisateur

Cisco

Cisco VG310 Manuel

Manuels Porte populaires d'autres marques

LST

LST M500RFE-AS Manuel utilisateur

Kinnex

Kinnex Media Gateway Manuel utilisateur

2N Telekomunikace

2N Telekomunikace 2N StarGate Manuel utilisateur

Mitsubishi Heavy Industries

Mitsubishi Heavy Industries Superlink SC-WBGW256 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZYWALL2 ET 2WE Manuel utilisateur

Telsey

Telsey CPVA 500 - SIP Manuel utilisateur

RTA

RTA 460A-NNA4 Fiche technique

Shaw

Shaw Gateway HDPVR Manuel utilisateur

ABB

ABB VSN900 Guide de démarrage rapide

Commander

Commander Pulse Manuel utilisateur

2N Telekomunikace

2N Telekomunikace ATEUS EasyGate 501309E Manuel utilisateur

NETGEAR

NETGEAR C6300BD Manuel utilisateur

Amit

Amit CDW531AM Manuel utilisateur

HMS

HMS Netbiter EasyConnect EC150 Manuel utilisateur

Huawei

Huawei EchoLife HG620 Manuel utilisateur

AT&T

AT&T U-verse 3801 Manuel d'utilisation et d'entretien

Logic IO

Logic IO RTCU MX2 turbo Manuel utilisateur

Suttle

Suttle MediaMAX MXM-521 Manuel utilisateur