Cisco Firepower 2100 Series Bedienungsanleitung

Cisco Firepower 2100 Getting Started Guide

First Published: 2019-09-25

Last Modified: 2019-09-25

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CHAPTER 1

Firepower Threat Defense Deployment with FDM

Is This Chapter for You?

This chapter explains how to complete the initial set up and configuration of your Firepower Threat Defense

(FTD) device using the Firepower Device Manager (FDM) web-based device setup wizard.

FDM lets you configure the basic features of the software that are most commonly used for small networks.

It is especially designed for networks that include a single device or just a few, where you do not want to use

a high-powered multiple-device manager to control a large network containing many FDM devices.

If you are managing large numbers of devices, or if you want to use the more complex features and

configurations that FTD allows, use the Firepower Management Center (FMC) instead.

The Firepower 2100 Series hardware can run either FTD software or ASA software. Switching between FTD

and ASA requires you to reimage the device. See Reimage the Cisco ASA or Firepower Threat Defense

Device.

Note

Privacy Collection Statement—The Firepower 2100 Series does not require or actively collect

personally-identifiable information. However, you can use personally-identifiable information in the

configuration, for example for usernames. In this case, an administrator might be able to see this information

when working with the configuration or when using SNMP.

Note

•End-to-End Procedure, on page 2

•Review the Network Deployment and Default Configuration, on page 3

•Cable the Device, on page 5

•Power on the Device, on page 6

•(Optional) Change Management Network Settings at the CLI, on page 7

•Log Into FDM, on page 8

•Complete the Initial Configuration, on page 9

•Configure Licensing, on page 10

•Configure the Device in Firepower Device Manager, on page 16

•Access the FTD and FXOS CLI, on page 19

•Power Off the Device, on page 21

•What's Next?, on page 21

Cisco Firepower 2100 Getting Started Guide

End-to-End Procedure

See the following tasks to deploy FTD with FDM on your chassis.

Review the Network Deployment and Default Configuration, on page 3.Pre-Configuration

Cable the Device, on page 5.Pre-Configuration

Power on the Device, on page 6.Pre-Configuration

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

End-to-End Procedure

(Optional) Change Management Network Settings at the CLI, on page 7.FTD CLI

Log Into FDM, on page 8.Firepower Device

Manager

Complete the Initial Configuration, on page 9.Firepower Device

Manager

(Optional) Configure Licensing, on page 10: Obtain feature licenses.Cisco Commerce

Workspace

Configure Licensing, on page 10: Generate a license token.Smart Software

Manager

Configure Licensing, on page 10: Register the device with the Smart Licensing

Server.

Firepower Device

Manager

Configure the Device in Firepower Device Manager, on page 16.Firepower Device

Manager

Review the Network Deployment and Default Configuration

The following figure shows the default network deployment for Firepower Threat Defense using Firepower

Device Manager on a Firepower 2100 series appliance using the default configuration.

If cannot use the default IP address (for example, you are adding your device to an existing network), then

you can connect to the console port and perform initial setup at the CLI, including setting the Management

IP address, gateway, and other basic networking settings. See (Optional) Change Management Network

Settings at the CLI, on page 7.

Note

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

Review the Network Deployment and Default Configuration

Figure 1: Suggested Network Deployment

Default Configuration

The configuration for the Firepower device after initial setup includes the following:

•inside—Ethernet 1/2, IP address 192.168.1.1

•outside—Ethernet 1/1, IP address from DHCP or an address you specify during setup

•inside→outside traffic flow

•management—Management 1/1 (management)

• IP address 192.168.45.45

The Management 1/1 interface is a special interface separate from data interfaces

that is used for management, Smart Licensing, and database updates. The physical

interface is shared with a second logical interface, the Diagnostic interface.

Diagnostic is a data interface, but is limited to other types of management traffic

(to-the-device and from-the-device), such as syslog or SNMP. The Diagnostic

interface is not typically used. See the FDM configuration guide for more

information.

Note

•DNS server for management

• OpenDNS: 208.67.222.222, 208.67.220.220, or servers you specify during setup

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

Default Configuration

•NTP—Cisco NTP servers: 0.sourcefire.pool.ntp.org, 1.sourcefire.pool.ntp.org, 2.sourcefire.pool.ntp.org,

or servers you specify during setup

•Default routes

•Data interfaces—Obtained from outside DHCP, or a gateway IP address you specify during setup

•Management interface—Over the backplane and through the data interfaces

Note that the FTD requires internet access for licensing and updates.

•DHCP server—Enabled on the inside interface and management interface

•FDM access—Management and inside hosts allowed

•NAT—Interface PAT for all traffic from inside to outside

Cable the Device

Manage the Firepower 2100 on either Management 1/1 or Ethernet 1/2. The default configuration also

configures Ethernet1/1 as outside.

Procedure

Step 1 Connect your management computer to either of the following interfaces:

• Management 1/1 (labeled MGMT)—Connect your management computer directly to Management 1/1

for initial configuration, or connect Management 1/1 to your management network. Management 1/1 has

a default IP address (192.168.45.45) and also runs a DHCP server to provide IP addresses to clients

(including the management computer), so make sure these settings do not conflict with any existing

inside network settings (see Default Configuration, on page 4).

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

Cable the Device

If you need to change the Management 1/1 IP address from the default, you must also cable your

management computer to the console port. See (Optional) Change Management Network Settings at the

CLI, on page 7.

• Ethernet 1/2—Connect your management computer directly to Ethernet 1/2 for initial configuration, or

connect Ethernet 1/2 to your inside network. Ethernet 1/2 has a default IP address (192.168.1.1) and also

runs a DHCP server to provide IP addresses to clients (including the management computer), so make

sure these settings do not conflict with any existing inside network settings (see Default Configuration,

on page 4).

You can later configure FDM management access from other interfaces; see the FDM configuration guide.

Step 2 Connect the outside network to the Ethernet1/1 interface (labeled WAN).

Step 3 Connect other networks to the remaining interfaces.

Power on the Device

System power is controlled by a rocker power switch located on the rear of the device. The power switch is

implemented as a soft notification switch that supports graceful shutdown of the system to reduce the risk of

system software and data corruption.

Before you begin

It's important that you provide reliable power for your device (for example, using an uninterruptable power

supply (UPS)). Loss of power without first shutting down can cause serious file system damage. There are

many processes running in the background all the time, and losing power does not allow the graceful shutdown

of your system.

Procedure

Step 1 Attach the power cord to the device and connect it to an electrical outlet.

Step 2 Press the power switch on the back of the device.

Step 3 Check the PWR LED on the front of the device; if it is solid green, the device is powered on.

Step 4 Check the SYS LED on the front of the device; after it is solid green, the system has passed power-on

diagnostics.

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

Power on the Device

When the switch is toggled from ON to OFF, it may take several seconds for the system to eventually

power off. During this time, the PWR LED on the front of the device blinks green. Do not remove

the power until the PWR LED is completely off.

Note

(Optional) Change Management Network Settings at the CLI

If you cannot use the default management or inside IP address (for example, you are adding your device to

an existing network), then you can connect to the console port and perform initial setup at the CLI, including

setting the Management IP address, gateway, and other basic networking settings. You can only configure

the Management interface settings; you must configure data interface settings in FDM.

You cannot repeat the CLI setup script unless you clear the configuration; for example, by reimaging. However,

all of these settings can be changed later at the CLI using configure network commands. See the FTD

command reference.

Note

Procedure

Step 1 Connect to the FTD console port. See Access the FTD and FXOS CLI, on page 19 for more information.

Step 2 Log in with the username admin and the password Admin123.

Step 3 The first time you log in to FTD, you are prompted to accept the End User License Agreement (EULA) and

to change the admin password. You are then presented with the CLI setup script.

Defaults or previously-entered values appear in brackets. To accept previously entered values, press Enter.

See the following guidelines:

•Enter the IPv4 default gateway for the management interface—Enter either data-interfaces or the

IP address of the gateway router. The data-interfaces setting sends outgoing management traffic over

the backplane to exit a data interface. This setting is useful if you do not have a separate Management

network that can access the internet. Traffic originating on the Management interface includes license

registration and database updates that require internet access. If you use data-interfaces, you can still

use FDM on the Management interface if you are directly-connected to the Management network, but

for remote management on Management, you need to enter the IP address of a gateway router on the

Management network. Note that FDM management on data interfaces is not affected by this setting.

•If your networking information has changed, youwill need to reconnect—If you are connected with

SSH to the default IP address but you change the IP address at initial setup, you will be disconnected.

Reconnect with the new IP address and password. Console connections are not affected. Note also that

the DHCP server on Management will be disabled if you change the IP address.

•Manage the device locally?—Enter yes to use FDM. A no answer means you will use FMC instead.

Example:

You must accept the EULA to continue.

Press <ENTER> to display the EULA:

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

(Optional) Change Management Network Settings at the CLI

End User License Agreement

[...]

Please enter 'YES' or press <ENTER> to AGREE to the EULA:

System initialization in progress. Please stand by.

You must change the password for 'admin' to continue.

Enter new password: ********

Confirm new password: ********

You must configure the network to continue.

You must configure at least one of IPv4 or IPv6.

Do you want to configure IPv4? (y/n) [y]:

Do you want to configure IPv6? (y/n) [n]:

Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]:

Enter an IPv4 address for the management interface [192.168.45.45]: 10.10.10.15

Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.192

Enter the IPv4 default gateway for the management interface [data-interfaces]: 10.10.10.1

Enter a fully qualified hostname for this system [firepower]: ftd-1.cisco.com

Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220]:

Enter a comma-separated list of search domains or 'none' []:

If your networking information has changed, you will need to reconnect.

DHCP Server Disabled

The DHCP server has been disabled. You may re-enable with configure network ipv4

dhcp-server-enable

For HTTP Proxy configuration, run 'configure network http-proxy'

Manage the device locally? (yes/no) [yes]: yes

Step 4 Log into FDM on the new Management IP address.

Log Into FDM

Log into FDM to configure your FTD.

Before you begin

• Use a current version of Firefox, Chrome, Safari, Edge, or Internet Explorer.

Procedure

Step 1 Enter the following URL in your browser.

• Inside (Ethernet 1/2)—https://192.168.1.1.

•

• Management—https://192.168.45.45. If you changed the Management IP address at the CLI setup, then

enter that address.

Step 2 Log in with the username admin, and thedefault password Admin123.

Cisco Firepower 2100 Getting Started Guide

Firepower Threat Defense Deployment with FDM

Log Into FDM

Andere Handbücher für Firepower 2100 Series

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Cisco Firewall Handbücher

Cisco

Cisco LightStream 1010 Montageanleitung

Cisco

Cisco Small Business RV220W Bedienungsanleitung

Cisco

Cisco ISA3000-4C-K9 Handbuch

Cisco

Cisco ASA 5506-X Kurzanleitung

Cisco

Cisco Firepower 1100 Series Handbuch

Cisco

Cisco Cisco ASA 5510 Bedienungsanleitung

Cisco

Cisco IPS-4255-K9 - Intrusion Protection Sys 4255 Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Handbuch

Cisco

Cisco S195 Handbuch

Cisco

Cisco PIX 520 - PIX Firewall 520 Bedienungsanleitung

Cisco

Cisco Small Business RV220W Bedienungsanleitung

Cisco

Cisco M190 Bedienungsanleitung

Cisco

Cisco CSA 90 Series Produkthandbuch

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco PIX 506 - Firewall Bedienungsanleitung

Cisco

Cisco Meraki MX64 Bedienungsanleitung

Cisco

Cisco Small Business RV215W Bedienungsanleitung

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Bedienungsanleitung

Cisco

Cisco LightStream 1010 Bedienungsanleitung

Cisco

Cisco RV110W Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco 515E - PIX Restricted Bundle Bedienungsanleitung

Cisco

Cisco Firepower 4100 Series Installationshandbuch

Cisco

Cisco ASA 5506-X Bedienungsanleitung

Beliebte Firewall Handbücher anderer Marken

Fortinet

Fortinet FortiGate Voice Series Bedienungsanleitung

ADTRAN

ADTRAN NetVanta 2300 Bedienungsanleitung

SecureLogix

SecureLogix ETM System Bedienungsanleitung

NETGEAR

NETGEAR ProSafe FVX538 Bedienungsanleitung

Lanner

Lanner FW-8877 Bedienungsanleitung

Huawei

Huawei USG6000 Series Installations- und Betriebshandbuch

H3C

H3C SecPath F5000-AI-15 Bedienungsanleitung

Nexcom

Nexcom DNA 1150 Bedienungsanleitung

Fortinet

Fortinet FortiGate-60 series Bedienungsanleitung

Draytek

Draytek Vigor2860 Series Bedienungsanleitung

Lanner electronics

Lanner electronics FW-7650 Series Bedienungsanleitung

Swisscom

Swisscom Internet Backup Bedienungsanleitung

SonicWALL

SonicWALL NSa 5700 Bedienungsanleitung

DPtech

DPtech FW1000 SERIES Bedienungsanleitung

FEITIAN

FEITIAN MultiPass FIDO Bedienungsanleitung

EBLOCKER

EBLOCKER PRO Bedienungsanleitung

GTA

GTA GB-200 Bedienungsanleitung

Trend Micro

Trend Micro Deep Edge Bedienungsanleitung