topic Cisco 1010 QoS with FDM only. in Network Security

Cisco 1010 QoS with FDM only.

Piotr Kowalczyk — Wed, 06 Oct 2021 10:05:06 GMT

Hi,

I've just got new Cisco 1010 and decided to use Firepower NGFW instead of ASA image, just to learn. All seems fine when using FDM web interface, but it looks quite limited in feature. Unfortunately I can't afford FMC license and I have to set QoS policies, which doesn't seem to be available on FDM. As far as I understand my only option will be CLI (or am I wrong and there is other free tool which I can use)? I've tried to find any documents about this, but all refer to FMC. Could you help please?

Re: Cisco 1010 QoS with FDM only.

Rob Ingram — Wed, 06 Oct 2021 10:15:13 GMT

@Piotr Kowalczyk

Yes, you cannot configure QoS natively using the FDM GUI, your only option is potentially to use FlexConfig, where you can use the old ASA CLI commands to deploy to the FTD.

Here is an example of the ASA QoS commands.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html

You'll need to take these commands and deploy using a FlexConfig object/policy to the FTD.

Information on using FlexConfig.

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/fdm/fptd-fdm-config-guide-700/fptd-fdm-advanced.html#concept_B3DA80CF3E4243CB90179E950335C6E6

Re: Cisco 1010 QoS with FDM only.

Piotr Kowalczyk — Wed, 06 Oct 2021 10:58:48 GMT

Rob, many thanks for your clear reply. This is my first look at Firepower NGFW image, and I'm really surprised. I mean, I've expected this will work like old ASA with some improvements, so configuration can be fully done in cli, but this doesn't seem to be a case anymore and everything has to be done through interface. Am I correct?

Re: Cisco 1010 QoS with FDM only.

Rob Ingram — Wed, 06 Oct 2021 11:08:03 GMT

@Piotr Kowalczyk

Yes, the majority of the configuration has to be defined using the Web GUI. The CLI is used for configuring the management interface settings and troubleshooting.

Local management of the FTD using FDM does not have full feature parity with an FTD managed by the FMC nor the old ASA image, yet.

Re: Cisco 1010 QoS with FDM only.

Piotr Kowalczyk — Wed, 06 Oct 2021 11:10:43 GMT

Thank you!

Re: Cisco 1010 QoS with FDM only.

Piotr Kowalczyk — Wed, 06 Oct 2021 16:01:22 GMT

Unfortunately it looks this is impossible using FlexConfig. Any ides? It wouldn't make any sense that I can't do simple QoS on the firewall...

https://community.cisco.com/t5/network-security/ftd-1010-traffic-shaping-minus-fmc/td-p/4176198

Re: Cisco 1010 QoS with FDM only.

Rob Ingram — Thu, 07 Oct 2021 09:16:03 GMT

@Piotr Kowalczyk sorry to hear that this won't work with flexconfig, if QoS doesn't work when deployed via Flexconfig then you cannot do it at all (yet). Like I said, unfortunately there still isn't full feature parity yet when using FDM to manage FTD. If QoS is a hard requirement for you then you can re-image the device to use the ASA software, you just don't get the NGFW features.

Reimage guide if you wish to reimage.

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/reimage/asa-ftd-reimage.html

Re: Cisco 1010 QoS with FDM only.

Piotr Kowalczyk — Thu, 07 Oct 2021 08:14:05 GMT

Hi Rob,

Thank you for all your help.

As I don't have support contract for this Cisco FTD 1010, could you tell me where I can download upgrade files please?

Re: Cisco 1010 QoS with FDM only.

Rob Ingram — Thu, 07 Oct 2021 09:15:34 GMT

@Piotr Kowalczyk 2 options, contact the cisco partner you purchased the hardware from and ask them to provide the ASA image or purchase a support contract.