Cisco ASA Guida rapida

Cisco ASA Firepower Module

Easy Setup Guide

1 Preconfiguring

2 Configuring Security Policy

3 Updating Database

4 Reporting & Monitoring

You can easily set up your ASA Firepower Module

in this step-by-step guide

This guide provides information about basic configuration of security policies (ac-

cess control policies) on the Cisco ASA Firepower module, using the Cisco Adap-

tive Security Device Manager (ASDM). Before proceeding, make sure that you have

completed the initial configuration of the Cisco ASA with Firepower Services, refer

to the separate "Cisco ASA with Firepower Services Easy Setup Guide" and so on.

Some configurations in this guide require having optional licenses installed. In those

cases, "MEMO" or "Caution" columns specify the necessary licenses.

The Cisco ASA with Firepower Services ship with a base license for Application

Visibility and Control (AVC). Optional subscriptions for Next-Generation IPS

（N-

GIPS）

, Cisco Advanced Malware Protection

（AMP）

, and URL Filtering (URL) can

be added to the base configuration for advanced functionality.

●AVC

：

Supports more than 3,000 application-layer and risk-based controls that

can launch tailored intrusion prevention system (IPS) threat detection policies to

optimize security effectiveness.

●NGIPS

：

Provides highly effective threat prevention and full contextual awareness

of users, infrastructure, applications, and content to detect multivector threats

and automate defense response.

●AMP

：

Delivers inline network protection against sophisticated malware and Cisco

Threat Grid sandboxing.

●URL

：

Adds the capability to filter more than 280 million top-level domains by risk

level and more than 82 categories.

Redirect traffic to the ASA Firepower module by creating a service policy on the

ASA that identifies specific traffic that you want to send.

Preconfiguring

1-1 Before You Begin

1-2 Configuring Service Policy

11Click [Configuration].

2Click [Firewall].

Optional Licenses

Characters

Included

in SKU

NGIPS AMP URL

NGIPS License TA ●- -

AMP License AMP - ●-

URL License URL - - ●

NGIPS & AMP License TAM ● ● -

NGIPS & URL License TAC ●-●

NGIPS & AMP & URL License TAMC ●●●

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

8Click [ASA FirePOWER

Inspection].

5Click [Next].

Use the default [Global - applies

to all interfaces]. This option ap-

plies the service policy globally

to all interfaces.

3Click [Service Policy

Rules].

4Click [Add Service Policy

Rule] from the [Add] menu

bar.

6Click [Use class-default as

the traffic class].

7Click [Next].

9Click [Enable ASA Fire-

POWER for this traffic

flow].

10 Click [Permit traffic] or

[Close traffic].

The [Permit traffic] sets the

ASA to allow all traffic through,

uninspected, if the module is

unavailable. The [Close traffic]

sets the ASA to block all traffic if

the module is unavailable.

11 Click [Finish].

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

Create file policies to configure the system to perform malware protection and file

control as part of your overall access control configuration. The file policies that

you create here will be used in ”2-2 Configuring Access Control Policy: Visual-

ization”.

Configuring Security Policy

2-1 Configuring File Policy: Blocking Malware

1Click [ASA FirePOWER

Configuration].

2Click [Policies].

3Click [Files].

4Click [New File Policy].

The [New File Policy] pop-up

window appears.

5Enter a name for your new

policy in the [Name] field.

6Click [Store ASA Fire-

POWER Changes].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

7Click [Add File Rule].

The [Add File Rule] pop-up win-

dow appears.

8Click [Block Malware]

from the [Action] drop-

down list.

9Select one or more [File

Types].

10 Click [Add].

You can select one or more [File

Type Categories] and search for

a file type by its name or de-

scription.

11 Click [Store ASA Fire-

POWER Changes].

12 Click [Store ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

Caution

At step ❽, the rule actions [Malware Cloud Lookup].and

[Block Malware] require the NGIPS License or the AMP

License. If you donʼt have these licenses, select the rule

actions [Detect Files].or [Block Files].

●Detect Files rules allow you to log the detection of

specific file types while still allowing their transmis-

sion.

●Block File rules allow you to block specific file types.

●Malware Cloud Lookup rules allow you to log the

malware disposition of files traversing your network

based on a cloud lookup, while still allowing their

transmission.

●Block Malware rules allow you to calculate the SHA-

256 hash value of specific file types, then use a cloud

lookup process to first determine if files traversing

your network contain malware, then block files that

represent threats.

MEMO

You can set separate rules within a file policy to take different actions for different file types,

application protocols, or directions of transfer. If you want to do so, repeat the steps ❼to ⓫.

By editing the [Default Allow All Traffic] policy that the system provides by default,

configure access control rules to exert granular control over network traffic logging

and handling (visualization).

2-2 Configuring Access Control Policy: Visualization

1Click [Access Control

Policy].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Click the edit icon ( )

next to the [Default Allow

All Traffic] policy.

3Click [Add Rule].

The [Add Rule] pop-up window

appears.

4Enter a name for your new

rule in the [Name] field.

5Click [Inspection].

9Click [Log at End of Con-

nection].

10 Click [Add].

11 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

12 Click [Apply All].

6Select [Connectivity Over

Security] from the [Intru-

sion Policy] drop-down

list.

7Select the policy name of

the step 2-1 ❺from the

[File Policy] drop-down

list.

8Click [Logging].

Caution

At step ❻, the intrusion policies [Connectivity Over Security] and so on require the NGIPS Li-

cense. If you donʼt have this license, select the [None].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Enter a name for your new

rule in the [Name] field.

3Select [Block] from the

[Action] drop-down list.

4Select [above rule] from

the [Insert] drop-down

list.

5Click [Applications].

6Select one or more [Avail-

able Applications].

7Click [Add to Rule].

You can select one or more

[Application Filters] and search

for a application by its name or

description.

8Click [URL].

910

9Select one or more

[Categories and URLs].

10 Select one [Reputations].

11 Click [Add to Rule].

If you do not specify a reputa-

tion level, the system defaults to

[Any], meaning all levels.

12 Click [Logging].

1Click [Add Rule].

The [Add Rule] pop-up window

appears.

Because the [Default Allow All Traffic] allows all traffic through, configure access

control rules to block specific traffic, for example, application or web traffic that is

high risk or has low business relevance.

2-3 Configuring Access Control Policy: Blocking

13 Click [Log at Beginning

and End of Connection].

14 Click [Add].

Caution

At step ❿, the URL reputation requires the URL License. And you can only select one reputa-

tion level. Selecting a reputation level also selects all reputations more severe than that level.

For example, if you configure a rule to block [Suspicious sites] (level 2), it also automatically

blocks [High Risk] (level 1) sites.

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

15 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

16 Click [Apply All].

As new vulnerabilities become known, Cisco releases rule updates that you can

first import onto your ASA Firepower module, then implement by applying affected

access control, network analysis, and intrusion policies.

Rule updates are cumulative, and Cisco recommends you always import the latest

update.

1Click [Updates].

2Click [Rule Updates].

Updating Database

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

3Select [Download new

Rule Update from the

Support Site] and click

two options below.

4Click [Import].

The system installs the rule up-

date.

5Click [Enable Recurring

Rule Update Imports].

The page expands to display

options for configuring recurring

imports.

6Select import frequency

and click two options be-

low.

We recommend [Daily].

7Click [Save].

8Click [Geolocation Up-

dates].

9Click [Download and install

geolocation update from

the Support Site].

10 Click [Import].

The update process begins.

The average duration of update

installation is 30 to 40 minutes.

11 Click [Enable Recurring

Weekly Updates].

The page expands to display

options for configuring recurring

imports.

12 Specify the time and day of

the week when you want

weekly GeoDB updates to

occur.

13 Click [Save].

13 12

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

The Cisco Adaptive Security Device Manager (ASDM) provides many useful report-

ing and monitoring features to assist you in the daily administration of your system.

Reporting & Monitoring

4-2 Monitoring the System

1Click [Monitoring].

2Click [ASA FirePOWER

Monitoring].

4 -1 Viewing Reports

1Click [Home].

2Click [ASA FirePOWER

Reporting].

3Click individual items to get

more detailed information.

4Click individual items to get

more detailed information.

3Click [Real Time Eventing].

Cisco ASA Firepower Module Easy Setup Guide

4Reporting & Monitoring

Indice

Altri manuali Cisco Hardware di rete

Cisco

Cisco IP/VC 3500 Istruzioni originali

Cisco

Cisco NSS4100 - Gigabit Storage System Manuale di istruzioni

Cisco

Cisco AIR-BR1410A-A-K9 - Aironet 1410 Wireless... Guida di riferimento rapido

Cisco

Cisco SA520-K9 - SA 500 Series Security Appliances Manuale utente

Cisco

Cisco Catalyst 8300 Series Manuale

Cisco

Cisco SPA901-UK - Small Business Pro Manuale utente

Cisco

Cisco ATM Cable Interface Processor ACIP-SM(=) Manuale dell'operatore

Cisco

Cisco Aironet 1000 Series Manuale

Cisco

Cisco GS7000 Istruzioni operative

Cisco

Cisco Mc3810 - 16MB Flash Memory Guida rapida

Cisco

Cisco SA-VAM - VPN Acceleration Module Manuale dell'operatore

Cisco

Cisco ASR 5500 Manuale utente

Cisco

Cisco WEC600N Manuale utente

Cisco

Cisco NSS2000 Series Manuale utente

Cisco

Cisco ON100 Network Agent Manuale utente

Cisco

Cisco OSM-12CT3/T1 - Optical Services Module... Guida rapida

Cisco

Cisco NM-1FE-TX - Interface Module Ethernet Manuale utente

Cisco

Cisco Wide Area Virtualization Engine 274 Manuale

Cisco

Cisco 8540 - Catalyst Campus Switch Router Modular Expansion... Manuale utente

Cisco

Cisco Firepower 2130 Guida alla manutenzione e all'assistenza

Cisco

Cisco Secure Firewall Management Center 1700 Manuale utente

Cisco

Cisco 5400 Manuale di istruzioni

Cisco

Cisco Nexus 93180LC-EX Manuale utente

Cisco

Cisco MGX 8260 Guida rapida

Manuali Hardware di rete popolari di altre marche

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuale utente

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuale utente

Yudor

Yudor YDS-16 Manuale utente

D-Link

D-Link ShareCenter DNS-320L Manuale utente

Samsung

Samsung ES1642dc Istruzioni per l’uso

Honeywell Home

Honeywell Home LTEM-PV Istruzioni per il montaggio

evertz

evertz 7700 Series Manuale utente

D-Link

D-Link ShareCenter DNS-343 Manuale utente

Asante

Asante AsanteBridge 1012 Manuale utente

FireBrick

FireBrick FB2700 Manuale utente

Audiovox Electronics

Audiovox Electronics ARWH2T Manuale utente

ADC

ADC DSX-1 Manuale

NetComm

NetComm NF2 Manuale utente

Alcatel-Lucent

Alcatel-Lucent 5620 Manuale utente

Dell EMC

Dell EMC XC6420 Series Manuale utente

Lanner

Lanner NCA-1020A Manuale utente

Allied Telesis

Allied Telesis AT-TN121-A Manuale utente

Arista

Arista CCA-ETM-Q12 Manuale utente