The Cisco Adaptive Security Appliance (ASA) can run a program or hardware procedure famous as FirePOWER or SFR (short for Sourcefire) module. The FirePOWER procedure for a Cisco ASA provides several next-generation firewall services. In fact, some of a capabilities directly overlie with what a ASA can do on a own. Without going into a details, we will contend this: If we have FirePOWER module, we would suggest regulating a facilities rather than a ASA’s, as a FirePOWER procedure is mainly configured and tends to get some-more visit updates.
The FirePOWER procedure creates decisions on what trade is good and bad, though it’s a ASA that enforces a decision. So we initial need to send trade to FirePOWER so it can make those decisions, and second, we need to have a routine on a FirePOWER procedure that gives it decisions to make. The thing is, a FirePOWER requires that we use a government core famous as a FireSIGHT Management Center (FMC) to configure it. In this post I’ll uncover we how to get FirePOWER purebred with a government center. In this box we are regulating a Virtual FireSIGHT Management Center.
Virtual FireSIGHT Management Center
The Virtual FireSIGHT Management Center (FMC) can be downloaded from Cisco and deployed as an open practical focus (OVA) in your VMware environment. Once deployed, there is a bit of setup that we need to do on a practical appliance, though once we record into a web interface, we can set a complement routine as good as a IPS policies, record policies, and so on. In terms of a FMC, a FirePOWER is famous as a managed device. You’ll need to supplement a managed device to a FMC and allot a license. Yep, all gets a license. In a following picture we can see a ASA being combined to a FMC. When we supplement a ASA it will devour a licenses we select.
Note: The chartering routine for an ASA is not a many definite method. You will need to beget a PAK record and contention that to Cisco. That PAK, along with a permit series from a FMC ,will beget a Protect Control permit that is perpetual. From there we will need to additionally permit IPS and URL filtering. For sum on how to permit an ASA for FirePOWER services, see a user guide.
FirePOWER procedure configuration
I’m going to assume that we have an ASA that is already configured and has a basis of network connectivity already established. This includes network residence interpretation and routing along with anything else that creates your ASA tick. Additionally, there are some slight differences between a hardware indication of a ASA and how communication for a FirePOWER procedure works. The large takeaway here is that a government interface of a ASA is used to promulgate with a FMC. This is a management-only interface that does not track traffic, so you’ll indicate to a gateway and a FMC needs to be reachable on that network.
The authority line interface of a FirePOWER procedure is limited. It resembles a Linux bombard and there unequivocally isn’t most to do there. The pattern on a FirePOWER procedure requires a following command:
configure manager supplement hostname | IPv4_address | IPv6_address | DONTRESOLVE reg_key nat_id
For example, my demo sourroundings would be configured like this:
configure manager supplement 172.16.20.10 cisco123 Manager successfully configured.
This authority defines a residence or hostname of a FMC. You can demeanour during this as an entrance order that says; “This manager is authorised to speak to me and we will request whatever pattern it says.” We can determine a manager pattern by arising a following command:
uncover managers Host : 172.16.20.10 Registration Key : cisco123 Registration : pending RPC Status :
As mentioned formerly in this article, we contingency also supplement a SFR to a FMC and allot a license.
Adding a device to FMC and requesting elementary routine
You’ll initial need to record into a FMC:
Once logged in we need to navigate to DevicesDevice Management.
Next Click AddAdd Device.
Enter a compulsory information and name Default Access Control Policy. This will request a default entrance control routine to a procedure so that something is removing filtered once a ASA sends trade to a module.
Now name a licenses we wish to apply. By initial selecting Protection, a remaining check boxes turn active if we have accessible licenses for them.
Click Register and a device is combined to a FMC and elementary routine is practical to a module. The subsequent bit of pattern is to brazen trade to a procedure for inspection.
If we don’t have a same chronicle FMC as a procedure we will get an blunder so be certain to watch your versions:
Forward trade for inspection
To brazen trade to a procedure we use a policy-map. Apply a following pattern to a ASA CLI, not a module:
policy-map FP-Policy category class-default sfr fail-open service-policy FP-Policy interface inside
Once applied, trade on a inside interface will be sent to a procedure for inspection.
At this indicate you’re in business and a FireSIGHT government core is examination a trade that passes by a module. You’ll get some decent reporting, and as distant as insurance to a network goes, it’s flattering extensive. And while there’s still most some-more to learn about a FirePOWER procedure and FireSIGHT government center, this gets we a elementary pattern that provides some ubiquitous protection. As time goes by, you’ll expected wish to customize a policies and that’s all finished in a FMC.
Also see:
- Which Cisco certifications will be in direct in 2017?
- Cisco amps adult network confidence with new cloud complement and appurtenance training software
- Think your Cisco switch is secure? Think again: Hundreds are exposed to a elementary attack
- 3 Linux Foundation networking projects that your business needs to know
Article source: http://www.techrepublic.com/article/how-to-register-an-asa-sfr-module-with-the-firepower-management-center/#ftag=RSS56d97e7