Cisco Firepower 1010 Manuale utente

Cisco Firepower 1010 Getting Started Guide

First Published: 2019-06-13

Last Modified: 2021-01-29

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CHAPTER 1

Which Operating System and Manager is Right

for You?

Your hardware platform can run one of two operating systems. For each operating system, you have a choice

of managers. This chapter explains the operating system and manager choices.

•Operating Systems, on page 1

•Managers, on page 1

Operating Systems

You can use either ASA or Firepower Threat Defense (FTD) operating systems on your hardware platform:

• ASA—The ASA is a traditional, advanced stateful firewall and VPN concentrator.

You may want to use the ASA if you do not need the advanced capabilities of the FTD, or if you need

an ASA-only feature that is not yet available on the FTD. Cisco provides ASA-to-FTD migration tools

to help you convert your ASA to an FTD if you start with ASA and later reimage to FTD.

• FTD—FTD, also known as Firepower NGFW, is a next-generation firewall that combines an advanced

stateful firewall, VPN concentrator, and next generation IPS. In other words, the FTD takes the best of

ASA functionality and combines it with the best next-generation firewall and IPS functionality.

We recommend using the FTD over the ASA because it contains most of the major functionality of the

ASA, plus additional next generation firewall and IPS functionality.

To reimage between the ASA and the FTD, see Reimage the Cisco ASA or Firepower Threat Defense Device.

Managers

The FTD and ASA support multiple managers.

Cisco Firepower 1010 Getting Started Guide

FTD Managers

Table 1: FTD Managers

DescriptionManager

FDM is a web-based, simplified, on-device manager. Because it is simplified, some

FTD features are not supported using FDM. You should use FDM if you are only

managing a small number of devices and don't need a multi-device manager.

Both FDM and CDO can discover the configuration on the device, so you

can use FDM and CDO to manage the same device. FMC is not compatible

with other managers.

Note

To get started with FDM, see Firepower Threat Defense Deployment with FDM, on

page 61.

Firepower Device Manager (FDM)

CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some

FTD features are not supported using CDO. You should use CDO if you want a

multi-device manager that offers a simplified management experience (similar to FDM).

And because CDO is cloud-based, there is no overhead of running CDO on your own

servers. CDO also manages other security devices, such as ASAs, so you can use a

single manager for all of your security devices.

In 6.7 and later, CDO offers Low Touch Provisioning that lets branch offices plug in

their hardware and leave it alone: the device will automtically register with CDO.

Both FDM and CDO can discover the configuration on the device, so you

can use FDM and CDO to manage the same device. FMC is not compatible

with other managers.

Note

To get started with CDO provisioning, see Firepower Threat Defense Deployment with

CDO Provisioning, on page 25.

Cisco Defense Orchestrator (CDO)

FMC is a powerful, web-based, multi-device manager that runs on its own server

hardware, or as a virtual device on a hypervisor. You should use FMC if you want a

multi-device manager, and you require all features on the FTD. FMC also provides

powerful analysis and monitoring of traffic and events.

FMC is not compatible with other managers because the FMC owns the FTD

configuration, and you are not allowed to configure the FTD directly,

bypassing the FMC.

Note

To get started with FMC, see Firepower Threat Defense Deployment with FMC, on

page 89.

For a remote branch setup, we recommend that you use the standalone document specific

to that deployment.

Firepower Management Center (FMC)

The FTD REST API lets you automate direct configuration of the FTD. This API is

compatible with FDM and CDO use because they can both discover the configuration

on the device. You cannot use this API if you are managing the FTD using FMC.

The FTD REST API is not covered in this guide. For more information, see the FTD

REST API guide.

FTD REST API

Cisco Firepower 1010 Getting Started Guide

Which Operating System and Manager is Right for You?

FTD Managers

DescriptionManager

The FMC REST API lets you automate configuration of FMC policies that can then be

applied to managed FTDs. This API does not manage an FTD directly.

The FMC REST API is not covered in this guide. For more information, see the FMC

REST API guide.

FMC REST API

ASA Managers

Table 2: ASA Managers

DescriptionManager

ASDM is a Java-based, on-device manager that provides full ASA functionality. You

should use ASDM if you prefer using a GUI over the CLI, and you only need to manage

a small number of ASAs. ASDM can discover the configuration on the device, so you

can also use the CLI, CDO, or CSM with ASDM.

To get started with ASDM, see ASA Deployment with ASDM, on page 135.

Adaptive Security Device Manager

(ASDM)

You should use the ASA CLI if you prefer CLIs over GUIs.

The CLI is not covered in this guide. For more information, see the ASA configuration

guides.

CLI

CDO is a simplified, cloud-based multi-device manager. Because it is simplified, some

ASA features are not supported using CDO. You should use CDO if you want a

multi-device manager that offers a simplified management experience. And because

CDO is cloud-based, there is no overhead of running CDO on your own servers. CDO

also manages other security devices, such as FTDs, so you can use a single manager

for all of your security devices. CDO can discover the configuration on the device, so

you can also use the CLI or ASDM.

CDO is not covered in this guide. To get started with CDO, see the CDO home page.

Cisco Defense Orchestrator (CDO)

CSM is a powerful, multi-device manager that runs on its own server hardware. You

should use CSM if you need to manage large numbers of ASAs. CSM can discover the

configuration on the device, so you can also use the CLI or ASDM. CSM does not

support managing FTDs.

CSM is not covered in this guide. For more information, see the CSM user guide.

Cisco Security Manager (CSM)

The ASA REST API lets you automate ASA configuration. However, the API does not

include all ASA features, and is no longer being enhanced.

The ASA REST API is not covered in this guide. For more information, see the ASA

REST API guide.

ASA REST API

Cisco Firepower 1010 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

Cisco Firepower 1010 Getting Started Guide

Which Operating System and Manager is Right for You?

ASA Managers

PART I

Firepower Threat Defense Deployment with CDO

•Firepower Threat Defense Deployment with CDO and Low-Touch Provisioning, on page 7

•Firepower Threat Defense Deployment with CDO Provisioning, on page 25

CHAPTER 2

Firepower Threat Defense Deployment with CDO

and Low-Touch Provisioning

Is This Chapter for You?

Low-Touch Provisioning (LTP) simplifies and automates the onboarding of new Firepower Threat Defense

(FTD) devices to Cisco Defense Orchestrator (CDO). LTP streamlines the deployment of new Firepower

devices by allowing network administrators to deliver the devices directly to a branch office, add the devices

to the CDO cloud-based device manager, and then manage the devices after the FTD device successfully

connects to the Cisco Cloud.

This chapter explains how to onboard your Firepower devices to CDO using low-touch provisioning. CDO

is a cloud-based multi-device manager that facilitates management of security policies in highly distributed

environments to achieve consistent policy implementation. CDO helps you optimize your security policies

by identifying inconsistencies with them and by giving you tools to fix them. CDO gives you ways to share

objects and policies, as well as make configuration templates, to promote policy consistency across devices.

This feature requires Firepower version 6.7 or later.

Note

This document assumes the Firepower 1010 hardware has a pre-installed FTD image on it. The Firepower

1010 hardware can run either FTD software or ASA software. Switching between FTD and ASA requires

you to reimage the device. See Reimage the Cisco ASA or Firepower Threat Defense Device.

Note

The Firepower 1010 runs an underlying operating system called the Firepower eXtensible Operating System

(FXOS). The Firepower 1010 does not support the FXOS Firepower Chassis Manager; only a limited CLI is

supported for troubleshooting purposes. See the FXOS troubleshooting guide for more information.

Note

Cisco Firepower 1010 Getting Started Guide

Privacy Collection Statement—The Firepower 1010 Series does not require or actively collect

personally-identifiable information. However, you can use personally-identifiable information in the

configuration, for example for usernames. In this case, an administrator might be able to see this information

when working with the configuration or when using SNMP.

Note

•End-to-End Procedure, on page 8

•Branch Office - Receive the Device, on page 10

•CDO Administrator - Central Headquarters, on page 11

•Branch Office - Install the Device, on page 17

•CDO Administrator - Complete the Onboarding, on page 19

End-to-End Procedure

This chapter explains how to deploy a factory-default FTD 1010 device at a remote branch office using the

low-touch provisioning feature:

1. Your branch office receives an FTD 6.7+ device that has either been shipped directly from Cisco or one

that has been reimaged with FTD 6.7+ software.

2. An administrator at the central headquarters onboards the device to CDO using the device's serial number.

3. The branch office employee cables and powers on the FTD.

4. The administrator at the central headquarters completes onboarding and configuration of the FTD using

CDO.

See the following tasks to deploy FTD with CDO using low-touch provisioning on your chassis.

Cisco Firepower 1010 Getting Started Guide

Firepower Threat Defense Deployment with CDO

End-to-End Procedure

Altri manuali per Firepower 1010

Indice

Altri manuali Cisco Hardware di rete

Cisco

Cisco ISA 3000 Guida rapida

Cisco

Cisco NCS 4201 Manuale

Cisco

Cisco Firepower 9300 Guida alla manutenzione e all'assistenza

Cisco

Cisco SCE 2000 4/8xFE Manuale dell'operatore

Cisco

Cisco MultiRIP Ethernet Card Manuale utente

Cisco

Cisco NCS 4016 Manuale utente

Cisco

Cisco MGX 8260 Guida rapida

Cisco

Cisco N540X-6Z18G-SYS-A Manuale utente

Cisco

Cisco GRP= Guida rapida

Cisco

Cisco CTE 1400 Series Manuale utente

Cisco

Cisco VPN 3002 Hardware Client Manager Manuale utente

Cisco

Cisco MERAKI CW9166D1 Manuale utente

Cisco

Cisco ONS 15310-MA SDH Manuale

Cisco

Cisco 2600 Series Documento tecnico

Cisco

Cisco Secure Network Server 3700 Series Manuale

Cisco

Cisco 8011-2X2XP4L Manuale

Cisco

Cisco MERAKI MX75 Manuale utente

Cisco

Cisco ON100 Network Agent Manuale utente

Cisco

Cisco CGR 1240 Manuale utente

Cisco

Cisco Remote PHY Shelf 7200 Manuale di installazione

Cisco

Cisco Nexus 3000 series Manuale utente

Cisco

Cisco WBPN Manuale utente

Cisco

Cisco 3600 Series Istruzioni operative e di sicurezza

Cisco

Cisco Catalyst 8300 Series Manuale

Manuali Hardware di rete popolari di altre marche

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuale utente

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuale utente

Yudor

Yudor YDS-16 Manuale utente

D-Link

D-Link ShareCenter DNS-320L Manuale utente

Samsung

Samsung ES1642dc Istruzioni per l’uso

Honeywell Home

Honeywell Home LTEM-PV Istruzioni per il montaggio

evertz

evertz 7700 Series Manuale utente

D-Link

D-Link ShareCenter DNS-343 Manuale utente

Asante

Asante AsanteBridge 1012 Manuale utente

FireBrick

FireBrick FB2700 Manuale utente

Audiovox Electronics

Audiovox Electronics ARWH2T Manuale utente

ADC

ADC DSX-1 Manuale

NetComm

NetComm NF2 Manuale utente

Alcatel-Lucent

Alcatel-Lucent 5620 Manuale utente

Dell EMC

Dell EMC XC6420 Series Manuale utente

Lanner

Lanner NCA-1020A Manuale utente

Allied Telesis

Allied Telesis AT-TN121-A Manuale utente

Arista

Arista CCA-ETM-Q12 Manuale utente