Cisco ASA Guide de démarrage rapide

Cisco ASA Firepower Module

Easy Setup Guide

1 Preconfiguring

2 Configuring Security Policy

3 Updating Database

4 Reporting & Monitoring

You can easily set up your ASA Firepower Module

in this step-by-step guide

This guide provides information about basic configuration of security policies (ac-

cess control policies) on the Cisco ASA Firepower module, using the Cisco Adap-

tive Security Device Manager (ASDM). Before proceeding, make sure that you have

completed the initial configuration of the Cisco ASA with Firepower Services, refer

to the separate "Cisco ASA with Firepower Services Easy Setup Guide" and so on.

Some configurations in this guide require having optional licenses installed. In those

cases, "MEMO" or "Caution" columns specify the necessary licenses.

The Cisco ASA with Firepower Services ship with a base license for Application

Visibility and Control (AVC). Optional subscriptions for Next-Generation IPS

（N-

GIPS）

, Cisco Advanced Malware Protection

（AMP）

, and URL Filtering (URL) can

be added to the base configuration for advanced functionality.

●AVC

：

Supports more than 3,000 application-layer and risk-based controls that

can launch tailored intrusion prevention system (IPS) threat detection policies to

optimize security effectiveness.

●NGIPS

：

Provides highly effective threat prevention and full contextual awareness

of users, infrastructure, applications, and content to detect multivector threats

and automate defense response.

●AMP

：

Delivers inline network protection against sophisticated malware and Cisco

Threat Grid sandboxing.

●URL

：

Adds the capability to filter more than 280 million top-level domains by risk

level and more than 82 categories.

Redirect traffic to the ASA Firepower module by creating a service policy on the

ASA that identifies specific traffic that you want to send.

Preconfiguring

1-1 Before You Begin

1-2 Configuring Service Policy

11Click [Configuration].

2Click [Firewall].

Optional Licenses

Characters

Included

in SKU

NGIPS AMP URL

NGIPS License TA ●- -

AMP License AMP - ●-

URL License URL - - ●

NGIPS & AMP License TAM ● ● -

NGIPS & URL License TAC ●-●

NGIPS & AMP & URL License TAMC ●●●

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

8Click [ASA FirePOWER

Inspection].

5Click [Next].

Use the default [Global - applies

to all interfaces]. This option ap-

plies the service policy globally

to all interfaces.

3Click [Service Policy

Rules].

4Click [Add Service Policy

Rule] from the [Add] menu

bar.

6Click [Use class-default as

the traffic class].

7Click [Next].

9Click [Enable ASA Fire-

POWER for this traffic

flow].

10 Click [Permit traffic] or

[Close traffic].

The [Permit traffic] sets the

ASA to allow all traffic through,

uninspected, if the module is

unavailable. The [Close traffic]

sets the ASA to block all traffic if

the module is unavailable.

11 Click [Finish].

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

Create file policies to configure the system to perform malware protection and file

control as part of your overall access control configuration. The file policies that

you create here will be used in ”2-2 Configuring Access Control Policy: Visual-

ization”.

Configuring Security Policy

2-1 Configuring File Policy: Blocking Malware

1Click [ASA FirePOWER

Configuration].

2Click [Policies].

3Click [Files].

4Click [New File Policy].

The [New File Policy] pop-up

window appears.

5Enter a name for your new

policy in the [Name] field.

6Click [Store ASA Fire-

POWER Changes].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

7Click [Add File Rule].

The [Add File Rule] pop-up win-

dow appears.

8Click [Block Malware]

from the [Action] drop-

down list.

9Select one or more [File

Types].

10 Click [Add].

You can select one or more [File

Type Categories] and search for

a file type by its name or de-

scription.

11 Click [Store ASA Fire-

POWER Changes].

12 Click [Store ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

Caution

At step ❽, the rule actions [Malware Cloud Lookup].and

[Block Malware] require the NGIPS License or the AMP

License. If you donʼt have these licenses, select the rule

actions [Detect Files].or [Block Files].

●Detect Files rules allow you to log the detection of

specific file types while still allowing their transmis-

sion.

●Block File rules allow you to block specific file types.

●Malware Cloud Lookup rules allow you to log the

malware disposition of files traversing your network

based on a cloud lookup, while still allowing their

transmission.

●Block Malware rules allow you to calculate the SHA-

256 hash value of specific file types, then use a cloud

lookup process to first determine if files traversing

your network contain malware, then block files that

represent threats.

MEMO

You can set separate rules within a file policy to take different actions for different file types,

application protocols, or directions of transfer. If you want to do so, repeat the steps ❼to ⓫.

By editing the [Default Allow All Traffic] policy that the system provides by default,

configure access control rules to exert granular control over network traffic logging

and handling (visualization).

2-2 Configuring Access Control Policy: Visualization

1Click [Access Control

Policy].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Click the edit icon ( )

next to the [Default Allow

All Traffic] policy.

3Click [Add Rule].

The [Add Rule] pop-up window

appears.

4Enter a name for your new

rule in the [Name] field.

5Click [Inspection].

9Click [Log at End of Con-

nection].

10 Click [Add].

11 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

12 Click [Apply All].

6Select [Connectivity Over

Security] from the [Intru-

sion Policy] drop-down

list.

7Select the policy name of

the step 2-1 ❺from the

[File Policy] drop-down

list.

8Click [Logging].

Caution

At step ❻, the intrusion policies [Connectivity Over Security] and so on require the NGIPS Li-

cense. If you donʼt have this license, select the [None].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Enter a name for your new

rule in the [Name] field.

3Select [Block] from the

[Action] drop-down list.

4Select [above rule] from

the [Insert] drop-down

list.

5Click [Applications].

6Select one or more [Avail-

able Applications].

7Click [Add to Rule].

You can select one or more

[Application Filters] and search

for a application by its name or

description.

8Click [URL].

910

9Select one or more

[Categories and URLs].

10 Select one [Reputations].

11 Click [Add to Rule].

If you do not specify a reputa-

tion level, the system defaults to

[Any], meaning all levels.

12 Click [Logging].

1Click [Add Rule].

The [Add Rule] pop-up window

appears.

Because the [Default Allow All Traffic] allows all traffic through, configure access

control rules to block specific traffic, for example, application or web traffic that is

high risk or has low business relevance.

2-3 Configuring Access Control Policy: Blocking

13 Click [Log at Beginning

and End of Connection].

14 Click [Add].

Caution

At step ❿, the URL reputation requires the URL License. And you can only select one reputa-

tion level. Selecting a reputation level also selects all reputations more severe than that level.

For example, if you configure a rule to block [Suspicious sites] (level 2), it also automatically

blocks [High Risk] (level 1) sites.

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

15 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

16 Click [Apply All].

As new vulnerabilities become known, Cisco releases rule updates that you can

first import onto your ASA Firepower module, then implement by applying affected

access control, network analysis, and intrusion policies.

Rule updates are cumulative, and Cisco recommends you always import the latest

update.

1Click [Updates].

2Click [Rule Updates].

Updating Database

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

3Select [Download new

Rule Update from the

Support Site] and click

two options below.

4Click [Import].

The system installs the rule up-

date.

5Click [Enable Recurring

Rule Update Imports].

The page expands to display

options for configuring recurring

imports.

6Select import frequency

and click two options be-

low.

We recommend [Daily].

7Click [Save].

8Click [Geolocation Up-

dates].

9Click [Download and install

geolocation update from

the Support Site].

10 Click [Import].

The update process begins.

The average duration of update

installation is 30 to 40 minutes.

11 Click [Enable Recurring

Weekly Updates].

The page expands to display

options for configuring recurring

imports.

12 Specify the time and day of

the week when you want

weekly GeoDB updates to

occur.

13 Click [Save].

13 12

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

The Cisco Adaptive Security Device Manager (ASDM) provides many useful report-

ing and monitoring features to assist you in the daily administration of your system.

Reporting & Monitoring

4-2 Monitoring the System

1Click [Monitoring].

2Click [ASA FirePOWER

Monitoring].

4 -1 Viewing Reports

1Click [Home].

2Click [ASA FirePOWER

Reporting].

3Click individual items to get

more detailed information.

4Click individual items to get

more detailed information.

3Click [Real Time Eventing].

Cisco ASA Firepower Module Easy Setup Guide

4Reporting & Monitoring

Table des matières

Autres manuels Cisco Matériel réseau

Cisco

Cisco ISE - Line Card ISE Manuel utilisateur

Cisco

Cisco ON100 Network Agent Manuel utilisateur

Cisco

Cisco ISA 3000 Guide de démarrage rapide

Cisco

Cisco CE 2000 Platform SCE 2000 4xGBE Manuel de l'opérateur

Cisco

Cisco ASR 9000 Series Manuel utilisateur

Cisco

Cisco AIR-BR350-A-K9 - Aironet 350 Wireless Bridge Manuel

Cisco

Cisco WS-CE500 - Catalyst Express 500-24PC Mode d’emploi

Cisco

Cisco AIR-BR1410A-A-K9 - Aironet 1410 Wireless... Guide de référence rapide

Cisco

Cisco 8011-2X2XP4L Manuel

Cisco

Cisco ASR 5000 Mode d’emploi

Cisco

Cisco ONS 15454 Manuel utilisateur

Cisco

Cisco IAD1101 Manuel utilisateur

Cisco

Cisco ONS 15600 Manuel utilisateur

Cisco

Cisco Firepower 1100 Series Manuel

Cisco

Cisco ONS 15454 SDH Manuel

Cisco

Cisco ONS 15454 Mode d’emploi

Cisco

Cisco Aironet 1430 Series Manuel utilisateur

Cisco

Cisco Firepower 9300 Manuel

Cisco

Cisco NCS 1002 Mise à jour du firmware

Cisco

Cisco 5400 Manuel utilisateur

Cisco

Cisco Firepower 4100 Series Manuel utilisateur

Cisco

Cisco UCS X10c Instructions d'installation et d'entretien

Cisco

Cisco NM-1FE-TX - Interface Module Ethernet Manuel utilisateur

Cisco

Cisco CiscoWorks Wireless LAN Solution Engine Manuel de l'opérateur

Manuels Matériel réseau populaires d'autres marques

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuel utilisateur

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuel utilisateur

Yudor

Yudor YDS-16 Manuel utilisateur

D-Link

D-Link ShareCenter DNS-320L Manuel utilisateur

Samsung

Samsung ES1642dc Instructions d'utilisation

Honeywell Home

Honeywell Home LTEM-PV Instructions de montage

evertz

evertz 7700 Series Manuel utilisateur

D-Link

D-Link ShareCenter DNS-343 Manuel utilisateur

Asante

Asante AsanteBridge 1012 Manuel utilisateur

FireBrick

FireBrick FB2700 Manuel utilisateur

Audiovox Electronics

Audiovox Electronics ARWH2T Manuel utilisateur

ADC

ADC DSX-1 Manuel

NetComm

NetComm NF2 Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 5620 Manuel utilisateur

Dell EMC

Dell EMC XC6420 Series Manuel utilisateur

Lanner

Lanner NCA-1020A Manuel utilisateur

Allied Telesis

Allied Telesis AT-TN121-A Manuel utilisateur

Arista

Arista CCA-ETM-Q12 Manuel utilisateur