1- FMC - FTD

SNCF 01
• Securing Networks with Cisco Firepower v1.0 (SNCF 300-710)

• A 90-minute exam associated with the CCNP Security.
• This exam tests a candidate's knowledge of Cisco Firepower Threat Defense and Firepower 7000/8000
Series virtual appliances, including policy configurations, integrations, deployments, management
and troubleshooting.
• Cisco Firepower is an integral part of the suite of Cisco security products.

• There are Firepower managers and the various Firepower devices that are configured, managed, and
monitored from the managers.
• The new Adaptive Security Appliance (ASA), called Firepower Threat Defense (FTD).
• History of SourceFire/Firepower
• Sourcefire was founded in 2001 by Martin Roesch, the creator of Snort.
• The company created a commercial version of the Snort software, the Sourcefire 3D System, which
evolved into the company’s Firepower line of network security products.
• Sourcefire was acquired by Cisco for $2.7 billion in July 2013.
• In early 2012, Sourcefire introduced version 5 of the “SourceFire System.”
• When you see FirePOWER , it’s almost always used to describe "FirePOWER Services on ASA."
• This could mean software services, or the FirePOWER blade installed on the ASA 5585-X.
• The "Firepower System" is the new Cisco IPS
• Managing Firepower
• There are many ways to manage your Firepower appliances and/or FTD
- Firepower Device Manager (FDM)
- Firepower Management Center (FMC)
- Cisco Defense Orchestrator (CDO)
- Adaptive Security Device Manager (ASDM)
• Firepower Device Manager (FDM)

• A little power manager used for SOHO environments or single-device configuration where you have
no FMC available.
SNCF Page 1
no FMC available.
• Firepower Management Center (FMC)

• This is the most prevalent Firepower manager.
• Available in both virtual and hardware versions.
• The difference really comes down to how many devices you need to configure/manage.
• Cisco Defense Orchestrator (CDO)

• This cloud-based management system is the future of managing Cisco security products like the ISE,
Firepower, StealthWatch, AMP ASAs, and more
• Adaptive Security Device Manager (ASDM)

• This tool has been around for a long time and has really helped configure, manage, and troubleshoot
our small to large ASA deployments.
SNCF Page 2
•
our small to large ASA deployments.
• ASDM provides some of the configuration and management capability of FirePOWER.
• Whether you have a Firepower appliance (7000/8000), ASA with a FirePOWER module, or an FTD
device, the Snort engine is basically the same for all models and configured mostly the same way
through the FMC.
• Deploying a Cisco Firepower Network

- Physically cable the devices with the management port of each device placed into a switch port
configuration with the management VLAN, then power up the device.
- Log in to the command-line interface (CLI) of each device and complete the initial configuration of
the Firepower devices from the CLI, which configures and enables the management ports.
- Then you need to log in so you can configure the FMC and prepare the appliance for managing
Firepower devices like FTD.
- Obtain licenses for the Firepower Management Center and buy feature licenses like malware and URL
filtering.
- Log in to the FMC and register the appliance with the Smart Licensing server for the devices you want
the FMC to manage.
• What Is a Firepower Management Center (FMC)?

• Provides complete and unified management for Firepower devices, referred to as Next Generation
Firewalls (NGFWs).
• This provides application visibility and control (AVC), intrusion prevention (IPS), URL filtering, and
advanced malware protection along with lots of other important things.
• The FMC makes no decisions on what happens to the packets going through your network.
• The FMC is sending the configuration and policies to the FTD devices, which make decisions based
on Snort policy configuration.
• If a Snort event occurs, the logging and the packets themselves will be sent to the FMC for analysis.
• What If Your FMC Goes Down?
- You won’t be getting network analysis and you won’t be able to make any changes to the devices, but
the Firepower device will actually keep passing/dropping packets based on the configuration and
policies it’s already received from the FMC.
- Also, Any rule created using AD users and groups will no longer be able to be filtered because the AD
integration only connects to the FMC, and the Firepower device needs to query the FMC for the AD
information.
SNCF Page 3
information.
- File SHA-256 Hash checks

The device transmits the hash to the FMC—only the SHA-256 hash is transmitted, not the file.
The FMC checks its local cache and if necessary, transmits the hash to the Cisco AMP cloud.
A disposition is then returned to the FMC.
The disposition is forwarded to the device.
If the disposition returned is malware, the device can block the file and maybe even store the file on
the FMC depending on the file policy settings in place.
This lookup happens really fast, usually well under 600 milliseconds
• Virtual FMCs
• The original version, managed up to 25 devices.
• The new virtual FMC that runs in beast mode, managing up to 300 devices!
• Install the FMC
SNCF Page 4
SNCF Page 5
• Log in with the default credentials:
- Username: admin
- Password: Admin123
• Hardware FMCs
• The FMC will only have management interfaces. (FMC doesn’t actually do any detection itself).
• The primary management port for all of the hardware FMCs is eth0, and you can use eth1, eth2, and
eth3 as secondary management or event ports.
SNCF Page 6
• There are three options available to access the console:
- Connect a USB keyboard and VGA monitor.
- Connect to the serial console port.
- Connect via SSH to the default IP address of 192.168.45.45
SNCF Page 7
• Run the configure network script with the following command:
> expert
> sudo /usr/local/sf/bin/configure-network
Password:
Do you with to configure IPv4 (y or n) y
Management IP address? 172.16.10.20
Management netmask? 255.255.255.0
Managmeent Default gateway? 172.16.10.1
Are these settings correct? (y or n) y
Do you wish to configure IPv6 (y or n) n
Updated network configuration.
Please go https://172.16.10.20/ to finish installation.
SNCF Page 8

1- FMC - FTD

Uploaded by

Copyright:

Available Formats

1- FMC - FTD

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1- FMC - FTD

Uploaded by

Copyright:

Available Formats

SNCF 01

• Securing Networks with Cisco Firepower v1.0 (SNCF 300-710)

• Cisco Firepower is an integral part of the suite of Cisco security products.

• Firepower Device Manager (FDM)

• Firepower Management Center (FMC)

• Cisco Defense Orchestrator (CDO)

• Adaptive Security Device Manager (ASDM)

• Deploying a Cisco Firepower Network

• What Is a Firepower Management Center (FMC)?

- File SHA-256 Hash checks

You might also like