Technology: Network Security
Area: Next Generation Firewalls
Vendor: Cisco
Software: 8.X, 9.X, FMC 5.X, 6.X, SFR module 5.X , 6.X
Platform: Cisco ASA, Firepower Management Center VM

Setup of FMC – CLI (you might be prompted for sudo password then provide the same password as used when loging in) 11. Checking the interfaces on FMC and ensuring proper addressing: 12. First GUI login comes up after typing the IP address (or FMC’s FQDN) set during installation. To login use exactly the same credentials as used for CLI. Add the Radius Server details. Add the username in the shell access filter which will be used to access FTD Sensor (Firewall appliance) 4. Save the settings and apply the changes. Default shell profile is administrator and shell authentication is enabled. This setting is only valid for FMC.

Firepower Management Center installation steps

1. Deployment from OVF

2. Assign the hostname for VM

3. Choose the right ovf and vmdk files

4. Select proper vNIC (the one you will use for management purposes and communication with the sensor) and disk provisioning type

5. VM Deployment is finished

6. VM starts the installation

Note: The Cisco Firepower Management Center Virtual instance then appears under the specified data center in the Inventory. Booting up the new VM could take up to 30-40 minutes.

7. After about 20 minutes you will see the system first initialization message

8. After installation is complete, the firepower login prompt appears.

Note: A message “WRITE SAME failed. Manually zeroing.” may appear after the system is booted up for the first time. This does not indicate a defect, it correctly indicates that the VMware storage driver does not support the WRITE SAME command. The system displays this message, and proceeds with a fallback command to perform the same operation

Default user and password for version 6.x FMC and later

Username: admin
Password: Admin123

9. First login and setup

10. Setup of FMC – CLI (you might be prompted for sudo password then provide the same password as used when loging in)

11. Checking the interfaces on FMC and ensuring proper addressing:

12. First GUI login comes up after typing the IP address (or FMC’s FQDN) set during installation. To login use exactly the same credentials as used for CLI login.

See also how to redirect traffic to SFR module.

Define static routes on the Firepower firewall so it knows where to send packets bound for networks not directly connected to the interfaces on the system.

Consider creating a default route. This is the route for network 0.0.0.0/0. This route defines where to send packets whose egress interface cannot be determined by existing NAT translations, static NAT rules, or other static routes.

You might need other static routes if the default gateway cannot be used to get to all networks. For example, the default route is usually an upstream router on the outside interface. If there are additional inside networks that are not directly connected to the device, and they cannot be accessed through the default gateway, you need static routes for each of those inside networks.

You cannot define static routes for the networks that are directly connected to system interfaces. The system automatically creates these routes.

Procedure

Click Devices & Services in the navigation bar.
Select the Firepower Threat Defense (FTD) device on which you want to define static routes.
In the Management pane at the right, click Routing.
On the Static Routing page, do one of the following:

To add a new static route, click the plus button .
Click the edit icon for the route you want to edit.

If you no longer need a route, click the trash can icon for the route to delete it.

Configure the route properties

Protocol-Select whether the route is for an IPv4 or IPv6 address.
Interface-Select the interface through which you want to send traffic. The gateway address needs to be accessible through this interface.
Gateway-Select the network object that identifies the IP address for the gateway to the destination network. Traffic is sent to this address.

Metric-The administrative distance for the route, between 1 and 254. The default is for static routes is 1. If there are additional routers between the interface and the gateway, enter the number of hops as the administrative distance.

Add Firepower To Fmcsa

Administrative distance is a parameter used to compare routes. The lower the number, the higher precedence the route is given. Connected routes (networks directly connected to an interface on the device) always take precedence over static routes.

Destination Network-Select the network object(s), that identifies the destination network, that contains the host(s), that uses the gateway in this route.

To define a default route, use the pre-defined any-ipv4 or any-ipv6 network objects, or create an object for the 0.0.0.0/0 (IPv4) or ::/0 (IPv6) network.

Click OK.
Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Static Route Example

See the Static Route Network Diagram for the addresses used in this example.

The goal is to create a static route that allows return traffic to the host at 20.30.1.2 in destination network 20.30.1.0/24.

The packet can take any path to reach the destination. When a network receives a packet on an interface, it determines where to forward the packet for the best route to a destination.

Note: The DMZ does not have a static route as it is connected directly to the interface.

Adding Firepower Module To Fmc

For example, consider the following two routes for reaching the destination.

Route 1:

Packets come back to the outside interface, 209.165.201.0/27, looking for 20.30.1.2.
We direct the packets to use the inside interface to get to the gateway 192.168.1.2, which is on the same network as the destination.
From there, we identify the destination network by the gateway address for that network, 20.30.1.1.
The IP address 20.30.1.2 is on the same subnet as 20.30.1.1. The router forwards the packet to the switch, the switch forwards the packet to 20.30.1.2.

Interface:Inside Destination_N/W:20.30.1.0/24 Gateway: 192.168.1.2 Metric: 1

Route 2:

Packets come back to the outside interface, 209.165.201.0/27, looking for 20.30.1.2.
We direct the packets to use the internal interface to get to the gateway 192.168.50.20, which is multiple hops away from the destination network.
From there, we identify the destination network by the gateway address for that network, 20.30.1.1.
The IP address 20.30.1.2 is on the same subnet as 20.30.1.0. The router forwards the packet to the switch, the switch forwards the packet to 20.30.1.2.

Interface:Inside Destination_N/W:20.30.1.0/24 Gateway: 192.168.50.20 Metric: 100

Add Firepower To Fmc

Here is what the completed Add Static Route table would like for these routes.