Step 1

Connect to the threat defense CLI, either from the console port or using SSH to the Management interface, which obtains an IP address from a DHCP server by default. If you intend to change the network settings, we recommend using the console port so you do not get disconnected.

Step 2

Log in with the username admin and the password Admin123.

firepower login: admin
Password: Admin123
Successful login attempts for user 'admin' : 1

[...]

Hello admin. You must change your password.
Enter new password: ********
Confirm new password: ********
Your password was updated successfully.

[...]

firepower# 

Step 3

If you connected to FXOS on the console port, connect to the threat defense CLI.

firepower# connect ftd
>

Step 4

The first time you log in to the threat defense, you are prompted to accept the End User License Agreement (EULA) and, if using an SSH connection, to change the admin password. You are then presented with the CLI setup script.

You must accept the EULA to continue.
Press <ENTER> to display the EULA:
End User License Agreement
[...]

Please enter 'YES' or press <ENTER> to AGREE to the EULA: 

System initialization in progress.  Please stand by.
You must change the password for 'admin' to continue.
Enter new password: ********
Confirm new password: ********
You must configure the network to continue.
Configure at least one of IPv4 or IPv6 unless managing via data interfaces.
Do you want to configure IPv4? (y/n) [y]:
Do you want to configure IPv6? (y/n) [y]:n
Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]:
Enter an IPv4 address for the management interface [192.168.45.45]: 10.10.10.15
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.192
Enter the IPv4 default gateway for the management interface [data-interfaces]: 10.10.10.1
Enter a fully qualified hostname for this system [firepower]: ftd-1.cisco.com
Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220,2620:119:35::35]:
Enter a comma-separated list of search domains or 'none' []:cisco.com
If your networking information has changed, you will need to reconnect.
Disabling IPv6 configuration: management0
Setting DNS servers: 208.67.222.222,208.67.220.220,2620:119:35::35
Setting DNS domains:cisco.com
Setting hostname as ftd-1.cisco.com
Setting static IPv4: 10.10.10.15 netmask: 255.255.255.192 gateway: 10.10.10.1 on management0
Updating routing tables, please wait...
All configurations applied to the system. Took 3 Seconds.
Saving a copy of running network configuration to local disk.
For HTTP Proxy configuration, run 'configure network http-proxy'

Manage the device locally? (yes/no) [yes]: no
DHCP server is already disabled
DHCP Server Disabled
Configure firewall mode? (routed/transparent) [routed]:
Configuring firewall mode ...


Device is in OffBox mode - disabling/removing port 443 from iptables.
Update policy deployment information
    - add device configuration
    - add network discovery
    - add system policy

You can register the sensor to a Firepower Management Center and use the
Firepower Management Center to manage it. Note that registering the sensor
to a Firepower Management Center disables on-sensor Firepower Services
management capabilities.

When registering the sensor to a Firepower Management Center, a unique
alphanumeric registration key is always required.  In most cases, to register
a sensor to a Firepower Management Center, you must provide the hostname or
the IP address along with the registration key.
'configure manager add [hostname | ip address ] [registration key ]'

However, if the sensor and the Firepower Management Center are separated by a
NAT device, you must enter a unique NAT ID, along with the unique registration
key.
'configure manager add DONTRESOLVE [registration key ] [ NAT ID ]'

Later, using the web interface on the Firepower Management Center, you must
use the same registration key and, if necessary, the same NAT ID when you add
this sensor to the Firepower Management Center.
>

Step 5

Identify the management center that will manage this threat defense.

> configure manager add MC.example.com 123456
Manager successfully configured.

> configure manager add DONTRESOLVE regk3y78 natid90
Manager successfully configured.

> configure manager add 10.70.45.5 regk3y78 natid56
Manager successfully configured.

Step 1

Log in to the device manager.

1. Enter one of the following URLs in your browser.

   • Inside (Ethernet 1/2)—https://192.168.95.1 .

   • Management—https://management_ip . The Management interface is a DHCP client, so the IP address depends on your DHCP server. You might have to set the Management IP address to a static address as part of this procedure, so we recommend that you use the inside interface so you do not become disconnected.

2. Log in with the username admin, and the default password Admin123.

3. You are prompted to read and accept the General Terms and change the admin password.

Step 2

Use the setup wizard when you first log into the device manager to complete the initial configuration. You can optionally skip the setup wizard by clicking Skip device setup at the bottom of the page.

1. Configure the following options for the outside and management interfaces and click Next.

   1. Outside Interface Address—This interface is typically the internet gateway, and might be used as your manager access interface. You cannot select an alternative outside interface during initial device setup. The first data interface is the default outside interface.

      If you want to use a different interface from outside (or inside) for manager access, you will have to configure it manually after completing the setup wizard.

      Configure IPv4—The IPv4 address for the outside interface. You can use DHCP or manually enter a static IP address, subnet mask, and gateway. You can also select Off to not configure an IPv4 address. You cannot configure PPPoE using the setup wizard. PPPoE may be required if the interface is connected to a DSL modem, cable modem, or other connection to your ISP, and your ISP uses PPPoE to provide your IP address. You can configure PPPoE after you complete the wizard.

      Configure IPv6—The IPv6 address for the outside interface. You can use DHCP or manually enter a static IP address, prefix, and gateway. You can also select Off to not configure an IPv6 address.

   2. Management Interface

      You will not see Management Interface settings if you performed intial setup at the CLI. Note that setting the Management interface IP address is not part of the setup wizard. See Step Step 3 to set the Management IP address.

      DNS Servers—The DNS server for the firewall's Management interface. Enter one or more addresses of DNS servers for name resolution. The default is the OpenDNS public DNS servers. If you edit the fields and want to return to the default, click Use OpenDNS to reload the appropriate IP addresses into the fields.

      Firewall Hostname—The hostname for the firewall's Management interface.

2. Configure the Time Setting (NTP) and click Next.

   1. Time Zone—Select the time zone for the system.

   2. NTP Time Server—Select whether to use the default NTP servers or to manually enter the addresses of your NTP servers. You can add multiple servers to provide backups.

3. Select Start 90 day evaluation period without registration.

   Do not register the threat defense with the Smart Software Manager; all licensing is performed on the management center.

4. Click Finish.

5. You are prompted to choose Cloud Management or Standalone. For management center management, choose Standalone, and then Got It.

Step 3

(Might be required) Configure a static IP address for the Management interface. See the Management interface on Device > Interfaces.

Step 4

If you want to configure additional interfaces, including an interface other than outside or inside, choose Device, and then click the link in the Interfaces summary.

Step 5

Choose Device > System Settings > Central Management, and click Proceed to set up the management center management.

Step 6

Configure the Management Center/CDO Details.

1. For Do you know the Management Center/CDO hostname or IP address, click Yes if you can reach the management center using an IP address or hostname, or No if the management center is behind NAT or does not have a public IP address or hostname.

   At least one of the devices, either the management center or the threat defense device, must have a reachable IP address to establish the two-way, TLS-1.3-encrypted communication channel between the two devices.

2. If you chose Yes, then enter the Management Center/CDO Hostname/IP Address.

3. Specify the Management Center/CDO Registration Key.

   This key is a one-time registration key of your choice that you will also specify on the management center when you register the threat defense device. The registration key must not exceed 37 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-). This ID can be used for multiple devices registering to the management center.

4. Specify a NAT ID.

   This ID is a unique, one-time string of your choice that you will also specify on the management center. This field is required if you only specify the IP address on one of the devices; but we recommend that you specify the NAT ID even if you know the IP addresses of both devices. The NAT ID must not exceed 37 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-). This ID cannot be used for any other devices registering to the management center. The NAT ID is used in combination with the IP address to verify that the connection is coming from the correct device; only after authentication of the IP address/NAT ID will the registration key be checked.

Step 7

Configure the Connectivity Configuration.

1. Specify the FTD Hostname.

2. Specify the DNS Server Group.

   Choose an existing group, or create a new one. The default DNS group is called CiscoUmbrellaDNSServerGroup, which includes the OpenDNS servers.

3. For the Management Center/CDO Access Interface, choose management.

Step 8

Click Connect. The Registration Status dialog box shows the current status of the switch to the management center. After the Saving Management Center/CDO Registration Settings step, go to the management center, and add the firewall.

If you want to cancel the switch to the management center, click Cancel Registration. Otherwise, do not close the device manager browser window until after the Saving Management Center/CDO Registration Settings step. If you do, the process will be paused, and will only resume when you reconnect to the device manager.

If you remain connected to the device manager after the Saving Management Center/CDO Registration Settings step, you will eventually see the Successful Connection with Management Center or CDO dialog box, after which you will be disconnected from the device manager.

Step 1

Choose Devices > Device Management, and click the Edit () for the firewall.

Step 2

Click Interfaces.

Step 3

To create breakout ports from a 40-Gb or larger interface, click the Break icon for the interface.

Step 4

Click Edit () for the interface that you want to use for inside.

The General tab appears.

1. Enter a Name up to 48 characters in length.

   For example, name the interface inside.

2. Check the Enabled check box.

3. Leave the Mode set to None.

4. From the Security Zone drop-down list, choose an existing inside security zone or add a new one by clicking New.

   For example, add a zone called inside_zone. Each interface must be assigned to a security zone and/or interface group. An interface can belong to only one security zone, but can also belong to multiple interface groups. You apply your security policy based on zones or groups. For example, you can assign the inside interface to the inside zone; and the outside interface to the outside zone. Then you can configure your access control policy to enable traffic to go from inside to outside, but not from outside to inside. Most policies only support security zones; you can use zones or interface groups in NAT policies, prefilter policies, and QoS policies.

5. Click the IPv4 and/or IPv6 tab.

   • IPv4—Choose Use Static IP from the drop-down list, and enter an IP address and subnet mask in slash notation.

     For example, enter 192.168.1.1/24

     

   • IPv6—Check the Autoconfiguration check box for stateless autoconfiguration.

     

6. Click OK.

Step 5

Click the Edit () for the interface that you want to use for outside.

The General tab appears.

1. Enter a Name up to 48 characters in length.

   For example, name the interface outside.

2. Check the Enabled check box.

3. Leave the Mode set to None.

4. From the Security Zone drop-down list, choose an existing outside security zone or add a new one by clicking New.

   For example, add a zone called outside_zone.

5. Click the IPv4 and/or IPv6 tab.

   • IPv4—Choose Use DHCP, and configure the following optional parameters:

     • Obtain default route using DHCP—Obtains the default route from the DHCP server.

     • DHCP route metric—Assigns an administrative distance to the learned route, between 1 and 255. The default administrative distance for the learned routes is 1.

     

   • IPv6—Check the Autoconfiguration check box for stateless autoconfiguration.

     

6. Click OK.

Step 6

Click Save.

Step 1

Choose Devices > Device Management, and click Edit () for the device.

Step 2

Choose DHCP > DHCP Server.

Step 3

On the Server page, click Add, and configure the following options:

• Interface—Choose the interface from the drop-down list.

• Address Pool—Set the range of IP addresses from lowest to highest that are used by the DHCP server. The range of IP addresses must be on the same subnet as the selected interface and cannot include the IP address of the interface itself.

• Enable DHCP Server—Enable the DHCP server on the selected interface.

Step 4

Click OK.

Step 5

Click Save.

Step 1

Choose Devices > Device Management, and click Edit () for the device.

Step 2

Choose Routing > Static Route.

Step 3

Click Add Route, and set the following:

• Type—Click the IPv4 or IPv6 radio button depending on the type of static route that you are adding.

• Interface—Choose the egress interface; typically the outside interface.

• Available Network—Choose any-ipv4 for an IPv4 default route, or any-ipv6 for an IPv6 default route, and click Add to move it to the Selected Network list.

• Gateway or IPv6 Gateway—Enter or choose the gateway router that is the next hop for this route. You can provide an IP address or a Networks/Hosts object.

• Metric—Enter the number of hops to the destination network. Valid values range from 1 to 255; the default value is 1.

Step 4

Click OK.

Step 5

Click Save.

Step 1

Choose Devices > NAT, and click New Policy > Threat Defense NAT.

Step 2

Name the policy, select the device(s) that you want to use the policy, and click Save.

The policy is added the management center. You still have to add rules to the policy.

Step 3

Click Add Rule.

Step 4

Configure the basic rule options:

• NAT Rule—Choose Auto NAT Rule.

• Type—Choose Dynamic.

Step 5

On the Interface Objects page, add the outside zone from the Available Interface Objects area to the Destination Interface Objects area.

Step 6

On the Translation page, configure the following options:

• Original Source—Click Add () to add a network object for all IPv4 traffic (0.0.0.0/0).

  

  Note	You cannot use the system-defined any-ipv4 object, because Auto NAT rules add NAT as part of the object definition, and you cannot edit system-defined objects.

• Translated Source—Choose Destination Interface IP.

Step 7

Click Save to add the rule.

Step 8

Click Save on the NAT page to save your changes.

Step 1

Choose Policy > Access Policy > Access Policy, and click Edit () for the access control policy assigned to the threat defense.

Step 2

Click Add Rule, and set the following parameters:

• Name—Name this rule, for example, inside-to-outside.

• Selected Sources—Select the inside zone from Zones, and click Add Source Zone.

• Selected Destinations and Applications—Select the outside zone from Zones, and click Add Destination Zone.

Leave the other settings as is.

Step 3

Click Apply.

Step 4

Click Save.

Step 1

Click Deploy in the upper right.

Step 2

For a quick deployment, check specific devices and then click Deploy, or click Deploy All to deploy to all devices. Otherwise, for additional deployment options, click Advanced Deploy.

Step 3

Ensure that the deployment succeeds. Click the icon to the right of the Deploy button in the menu bar to see status for deployments.

Step 1

Choose Devices > Device Management.

Step 2

Next to the device that you want to restart, click Edit ().

Step 3

Click the Device tab.

Step 4

Click Shut Down Device () in the System section.

Step 5

When prompted, confirm that you want to shut down the device.

Step 6

If you have a console connection to the firewall, monitor the system prompts as the firewall shuts down. You will see the following prompt:

System is stopped.
It is safe to power off now.

Do you want to reboot instead? [y/N]

Step 7

You can now turn off the power switch and unplug the power to physically remove power from the chassis if necessary.

Step 1

In the FXOS CLI, connect to local-mgmt:

Step 2

Issue the shutdown command:

firepower(local-mgmt)# shutdown 
This command will shutdown the system.  Continue?
Please enter 'YES' or 'NO': yes
INIT: Stopping Cisco Threat Defense......ok

Step 3

Monitor the system prompts as the firewall shuts down. You will see the following prompt:

System is stopped.
It is safe to power off now.
Do you want to reboot instead? [y/N]

Step 4

You can now turn off the power switch and unplug the power to physically remove power from the chassis if necessary.