topic Re: Security Global Forum for ASA and FTD Topics - AMA in Network Security

Security Global Forum for ASA and FTD Topics - AMA

ciscomoderator — Thu, 14 Jan 2021 06:12:27 GMT

This event is a chance to discuss about Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) regarding products, management, installation, configuration, implementation, use, and integration with other devices within your network. Learn the best practices to make the most of the advanced firewall settings, as well as the best practices to troubleshoot its common issues. This forum event works well as an introduction for those who are not familiar with the security tools and have recently started using them.

To participate in this event, please use the button below to ask your questions

Ask questions from Tuesday, January 12 to Friday, January 22, 2021

Featured experts

Berenice Guerra Martinez is a Technical Consulting Engineer at the Cisco Global Technical Assistance Center (TAC) for Security - Next Generation Firewall (NGFW). She specializes in Threat Detection, ASA and Firepower configuration and best practices, and Firepower integrations. Berenice has a bachelor’s degree in electronic engineering with a cybersecurity specialization and is a Telecommunications Technician. She holds three different Cisco certifications: CCNA R&S, CyberOps Associate, and DevNet Associate.

Namit Agarwal is a Technical Marketing Engineer in the Security Business Group. He is based out of Toronto, Canada. He partners closely with our platform product management team and leads critical technical enablement engagements. He joined Cisco in 2009 and has held multiple positions, most recently working as a Technical Leader with the Security CX team in Bangalore, India. In that role, he worked on escalations, led serviceability initiatives for product improvement, and drove engagements with the NGFW sales teams. He is a CCIE n°33795 Security and has experience with multiple Cisco Security solutions such as Cisco Firewalls, IPS, VPN, and Cloud Security.

Ilkin Gasimov is a Technical Consulting Engineer in the Cisco Global TAC for Security - NGFW. He joined the TAC team in 2017 and since then has mainly been focused on supporting Cisco NGFW platforms and on the collaboration with the Cisco Business Unit to contribute to the NGFW product quality improvement. He has also delivered troubleshooting sessions to the partners and customers. Before joining Cisco, he had hands-on experience with the Cisco ASA firewalls in enterprise and mobile networking environments. He holds a CCIE n°54979 Security certification since 2016.

Ricardo Diez Gutierrez Gonzalez is a Technical Consulting Engineer at the Cisco HTTS TAC for Security – NGFW – ASA – VPN. He joined Cisco six years ago. He belonged to the incubator program for six months achieving his CCNA and then he became a full-time engineer. Later he obtained his Specialist NGFW and CCNP security certifications. He is currently studying for the CCIE exam.

For more information, visit the Security Discussions category.
Find further events on Security Events list.

Do you know you can get answers before opening a TAC case by visiting the Cisco Community?

**Helpful votes Encourage Participation! **
Please be sure to rate the Answers to Questions

Re: Security Global Forum for ASA and FTD Topics - AMA

Marvin Rhoads — Tue, 12 Jan 2021 12:31:05 GMT

Hello team,

When using an FDM-managed FTD 6.7 appliance we are directed to use the API for adding snmp-server hosts. Reference:

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/216551-configure-and-troubleshoot-snmp-on-firep.html#anc7

However, when querying the interfaces using the API explorer, we are unable to get the diagnostic interface details. The API query GET /devices/default/interfaces only returns information for data interfaces. GET /devices/default/operational/interfaces shows us diagnostic interface information but not the interface "version", "name", "id", and "type" fields needed for the POST /object/snmphosts/ API.

So how do we add an snmp-server for the diagnostic interface? The appliance in question is a Firepower 2140 if that makes any difference.

Re: Security Global Forum for ASA and FTD Topics - AMA

Cisco Moderador — Tue, 12 Jan 2021 18:25:51 GMT

Hello,

On ASA if an access-list allows connections between 2 interfaces with the same security-level, are these connections still subject to the ‘same-security-traffic permit inter-interface’ command check?

Thanks

Note: This question is a translation of a post originally created in Portuguese by Didier M. It has been translated by Cisco Community to share the inquiry and its solution in different languages.

Re: Security Global Forum for ASA and FTD Topics - AMA

Ilkin — Tue, 12 Jan 2021 18:26:35 GMT

Yes. Even if an access-list allows connections between 2 interfaces with the same security-level, the "same-security-traffic permit inter-interface" command is still needed to allow connections.

Re: Security Global Forum for ASA and FTD Topics - AMA

Modérateur Cisco — Tue, 12 Jan 2021 20:53:25 GMT

Hi,

Is it possible to integrate ASA with Firepower services into the new SecureX dashboard ?

Cdlt. JMD

* This is a question posted in French by Jean MD. It has been translated by Cisco Community to share the inquiry and its solution in different languages.

Re: Security Global Forum for ASA and FTD Topics - AMA

Berenice Guerra — Tue, 12 Jan 2021 22:05:51 GMT

Hi Marvin,

To get the details of the diagnostic interface, first, get the id of the Management interface with the API query InterfaceInfo > GET /operational/interfaceinfo/{objId}. You can leave the default value for the objid parameter.

{
  "interfaceInfoList": [
    {
      "interfaceId": "string",
      "hardwareName": "string",
      "speedCapability": [
        "AUTO"
      ],
      "duplexCapability": [
        "AUTO"
      ],
      "interfacePresent": true,
      "id": "string",
      "type": "InterfaceInfoEntry"
    }
  ],
  "id": "string",
  "type": "InterfaceInfo",
  "links": {
    "self": "string"
  }
}

This is an example of the API response for the Management interface.

{
  "interfaceInfoList": [
     {
      "interfaceId": "b727b013-c677-11e9-adec-5d5808710d61",
      "hardwareName": "Management1/1",
      "speedCapability": [
        "IGNORE"
      ],
      "duplexCapability": [
        "IGNORE"
      ],
      "interfacePresent": true,
      "id": "default",
      "type": "interfaceinfoentry"
    }
  ],
  "id": "default",
  "type": "interfaceinfo",
  "links": {
    "self": "https://x.x.x.x/api/fdm/v5/operational/interfaceinfo/default"
  }
}

Collect the interfaceId value, this will be the value of the objid of the next query.

Now go to Interface > GET/devices/default/operational/interfaces/{objId}. Add the interfaceIdvalue of the Management interface from the above query and execute the API call.

From the API response, you will get the diagnostic interface details.

{
  "name": "diagnostic",
  "hardwareName": "Management1/1",
  "ipv4Address": {
    "ipAddress": null,
    "netmask": null,
    "type": "ipv4address"
  },
  "ipv6Address": {
    "ipAddress": null,
    "type": "ipv6address"
  },
  "macAddress": "string",
  "speedType": null,
  "enabled": true,
  "linkState": "UP",
  "id": "b727b013-c677-11e9-adec-5d5808710d61",
  "type": "interfacedata",
  "links": {
    "self": "https://x.x.x.x/api/fdm/v5/devices/default/operational/interfaces/b727b013-c677-11e9-adec-5d5808710d61"
  }
}

Re: Security Global Forum for ASA and FTD Topics - AMA

CiscoJapanModerator — Wed, 13 Jan 2021 02:15:28 GMT

Is there any upgrade path and procedure for firepower devices?

Note: This question is a translation of a post originally created in Japanese by S.Takenaka. It has been translated by Cisco Community to share the inquiry and its solution in different languages.

Re: Security Global Forum for ASA and FTD Topics - AMA

johnlloyd_13 — Wed, 13 Jan 2021 03:11:22 GMT

hi,

we'll be doing a tech refresh soon with our ASA 5500-X series. per checking EOL link, there's no product replacement yet and i tried to search in cisco links and tried to google but no avail.

https://www.cisco.com/c/en/us/products/collateral/security/asa-firepower-services/eos-eol-notice-c51-743545.html

our ASA simply does ACL, NAT, security/customer context, A/S HA, S2S and RA VPN in our environment and we just need to do a 1-1 replacement.

can someone advise the "rule of thumb" in sizing the equivalent ASA below:

ASA5525x > FPR21xx ?

ASA5545x > FPR41xx ?

ASA 5555x > FPR41xx ?

ASA5585-X > FPR9300 ?

we also plan to run the classic ASA image/appliance. is there a separate for this or is license structure shared with FTD?

Re: Security Global Forum for ASA and FTD Topics - AMA

CiscoJapanModerator — Wed, 13 Jan 2021 08:06:12 GMT

Please teach me how to operate (convert) Firepower running ASA-OS with FTD (FX-OS).

Note: This question is a translation of a post originally posted in Japanese by cja56910tf. The post has been translated to all the languages we have in the community

Re: Security Global Forum for ASA and FTD Topics - AMA

CiscoJapanModerator — Wed, 13 Jan 2021 08:06:50 GMT

Can you give us an example configuration for profiling devices with the Cisco ASA in conjunction with Cisco ISE for anyConnect connections on the Cisco ASA?

Note: This question is a translation of a post originally posted in Japanese by cja56910tf. The post has been translated to all the languages we have in the community

Re: Security Global Forum for ASA and FTD Topics - AMA

CiscoJapanModerator — Wed, 13 Jan 2021 08:07:59 GMT

Since DDoS attacks may occur from the Internet, we are considering using ASA or Firepower as a DDoS countermeasure device.
Does the machine have such a function in the first place?
Also, if there is a function, it would be helpful if you could teach us about setting examples, parameter values, and tuning points.

Note: This question is a translation of a post originally posted in Japanese by cja56910tf. The post has been translated to all the languages we have in the community

Re: Security Global Forum for ASA and FTD Topics - AMA

Yanli Sun — Wed, 13 Jan 2021 07:25:42 GMT

Why I'm not seeing any device in order to generate a Troubleshooting file from my Firepower devices?

Note: This question is a translation of a post originally created in Chinese by alina_xiao ， It has been translated by Cisco Community to share the inquiry and its solution in different languages.

Re: Security Global Forum for ASA and FTD Topics - AMA

Ilkin — Wed, 13 Jan 2021 07:29:49 GMT

Could you please clarify the details of this question?

Do you want to convert or migrate ASA to FTD?

Re: Security Global Forum for ASA and FTD Topics - AMA

Ilkin — Wed, 13 Jan 2021 07:44:06 GMT

Firepower 4100/9300 Series appliances support the deployment of Radware vDP in a Service Chain to protect against DDoS attacks.

Please review the following links:

1. Radware DefensePro Service Chain for Firepower Threat Defense Quick Start Guide

2. Firepower 4100/9300 Configuration guide - Chapter: Logical Devices

3. Links in the Radware DefensePro section of the Firepower 9300 Configuration Guides

Re: Security Global Forum for ASA and FTD Topics - AMA

Ricardo1 — Wed, 13 Jan 2021 08:46:48 GMT

Hi, yes there is path specially for oldest version of firepower (6.1.0,6.2.0 and 6.2.3).
On the release notes of each version you can find the upgrade path. For versions 6.2.3+ you can upgrade directly to any base version (6.3.0, 6.4.0 , 6.5.0 , 6.6.0
The procedure is the same for the firepower devices and firepower threat defense. You can see the following link for the procedure.
https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/213269-upgrade-procedure-through-fmc-for-firepo.html
The upgrade must be done first on the FMC and then on the sensors. The FMC must be on higher or same version of the sensors.

Re: Security Global Forum for ASA and FTD Topics - AMA

Marvin Rhoads — Wed, 13 Jan 2021 12:32:04 GMT

@Berenice Guerra That's helpful but I am still unable to create a well-formed PUT using the information derived from the instructions you gave. Perhaps it would be best if I opened a TAC case for this issue.

It is VERY frustrating that, for a senior engineer with over 10 years experience with Cisco firewalls, I can no longer easily do what took ONE LINE of configuration on an ASA now that we are on FTD.

Re: Security Global Forum for ASA and FTD Topics - AMA

Berenice Guerra — Wed, 13 Jan 2021 16:02:18 GMT

Hi JMD,

Yes in fact, you can integrate your ASA devices with Firepower services with SecureX.

For this you will need to setup a proxy, Cisco Security Services Proxy (CSSP), which will work as a Syslog for the FTD in order to forward the events. The CSSP file to setup can be downloaded from the SSE portal.

For further details look within the next Cisco content.

Cisco Video Portal - https://video.cisco.com/video/6161531920001

Cisco Tech Notes - https://www.cisco.com/c/en/us/td/docs/security/firepower/integrations/CTR/Firepower_and_Cisco_Threat_Response_Integration_Guide/send_events_to_the_cloud_using_syslog.html

Thanks for asking

Bere

Re: Security Global Forum for ASA and FTD Topics - AMA

Berenice Guerra — Thu, 14 Jan 2021 03:09:22 GMT

In order to generate the Troubleshooting file of your firepower devices, navigate in your FMC to System > Health > Monitor > Select Appliance within the list displayed > Generate Troubleshooting Files.
If you do not see any devices listed below you must probably need to click on the pie chart. Will depend on the health status of your devices from where you can click the pie chart portion to display them.
Green - Health status
Yellow – Appliances with some Warnings
Red – Appliances with Errors
Blue – Disabled Appliances

For more details you can go to the next content.
Cisco Video Portal - https://video.cisco.com/video/6155382458001
Cisco Tech Notes - https://www.cisco.com/c/en/us/support/docs/security/sourcefire-defense-center/117663-technote-SourceFire-00.html

回复： Security Global Forum for ASA and FTD Topics - AMA

Yanli Sun — Thu, 14 Jan 2021 07:20:54 GMT

Thanks for hosting this event. How can I manage my firepower devices?

Note: This question is a translation of a post originally created in Chinese by W2493455280 ， It has been translated by Cisco Community to share the inquiry and its solution in different languages.

Re: Security Global Forum for ASA and FTD Topics - AMA

Cisco Moderador — Thu, 14 Jan 2021 13:31:42 GMT

Hi team!

How can I take packet captures in the FTD? I’m familiar with the ASA captures however seems that those commands are not supported by the FTD.

Thanks

Note: This question is a translation of a post originally created in Portuguese by Adolfo Suarez. It has been translated by Cisco Community to share the inquiry and its solution in different languages.