topic Re: Cisco Firepower FPR-1120 >> Initial Setup in Network Security

Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Fri, 11 Mar 2022 13:28:07 GMT

Hi,

Have FPR-1120 (out of the box) and trying to connect but seems like User: admin and Password:Admin123 is not going to work for me.

Here is the device information:

I am connecting to Port2 and have the IP Address via DHCP as:

Have console connectivity as well:

Using https://192.168.1.1 I get the following: (even the Java is installed, but still this screen continue to mention either install local ASDM or Java etc).

When clicked on "Install SDM Launcher", authentication appears which I never succeeded to login with user name admin and password Admin123.

What might I am doing wrong?

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Fri, 11 Mar 2022 13:32:07 GMT

@amh4y0001 you are using ASA software, as you have access to the CLI create a new username and password.

username <username> password <yourpassword> privilege 15

To access ASDM and SSH you enter the commands

aaa authentication http console LOCAL

aaa authentication ssh console LOCAL

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Fri, 11 Mar 2022 21:14:15 GMT

Thanks for reply @Rob Ingram

I will check this out.

Just curios why it's not available in getting started guide
1. https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp1100/firepower-1100-gsg/ftd-fmc.html#task_ud2_kv4_ypb

2. https://www.cisco.com/c/en/us/td/docs/security/firepower/610/fdm/fptd-fdm-config-guide-610/fptd-fdm-get-started.html#id_13129

According to documentation, if connected to management port, I should get 192.168.45.x via DHCP, but in my case I get APIPA (169.x.x.x). While on the inside I have 192.168.x.x via DHCP that I am currently using.

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Fri, 11 Mar 2022 21:23:21 GMT

@amh4y0001 those docs you provided are specific to the FTD software image.

The FPR1010 hardware comes with either ASA or FTD software, your appliance is running the traditional ASA software.

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp1100/firepower-1100-gsg/asa.html

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Fri, 11 Mar 2022 22:03:35 GMT

I have FP1120, hope the same applies for 1010 as well.

Checking the guide you just mentioned.

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Fri, 11 Mar 2022 22:06:21 GMT

@amh4y0001 sorry, typo. It applies to all FPR hardware series, 1000, 2100, 4100 etc, they can all run ASA or FTD software.

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Sat, 12 Mar 2022 20:16:49 GMT

@Rob Ingram Thanks, will update this post after checking the guide you have mentioned.

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Mon, 14 Mar 2022 13:07:59 GMT

Thanks again @Rob Ingram now I have access to ASDM.

According to my understanding, for Smart Licensing I must have organizational account (as the personal account didn't really worked).?

Do you recommend a guide to the SSH configuration?

And VPN configuration as well?

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Mon, 14 Mar 2022 13:12:55 GMT

@amh4y0001 you need a smart account, this could be your own.

Here is SSH configuration, replace the networks below with the networks you wish to permit access to SSH to the ASA.

username admin password <password> privilege 15

crypto key generate rsa modulus 2048
aaa authentication ssh console LOCAL
ssh version 2
ssh 192.168.10.0 0.0.0.255 INSIDE
ssh 192.168.11.0 0.0.0.255 INSIDE
ssh timeout 30

Here is an exampe of a Remote Access VPN

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Mon, 14 Mar 2022 13:24:22 GMT

Will check the SSH example and update this post, however, regarding Smart Licensing, when I try with individual account, I get the following (see screenshot).

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Mon, 14 Mar 2022 13:29:42 GMT

@amh4y0001 just click the register a new smart account, this will be unique and attached to your personal account.

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Mon, 14 Mar 2022 18:58:31 GMT

thanks for reply.

can i use ssh 0.0.0.0 0.0.0.0 inside to enable ssh access to the inside interface from any IPv4?

And for wan ip /outside, i can specify a particular ip with following or you think it will security risk?

ssh 192.168.11.0 0.0.0.255 trust {replace it with wan /outside ip}

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Mon, 14 Mar 2022 19:15:02 GMT

@amh4y0001 yes, you could use 0.0.0.0 for inside networks, generally though most administrators permit mgmt connectivity from known trusted internal networks, even internal networks.

Up to you if you permit ssh mgmt on the outside interface from a trusted known public IP address, just don't do it for 0.0.0.0

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Thu, 17 Mar 2022 12:03:20 GMT

@Rob Ingram Have registered the smart account now but lost to find the license and activate it.

Following this guide, but I don't have any initial license or have not received an email from Cisco yet.

Do you have a reference to a more easy to go through guide assuming no initial license is available? Or should contact Cisco?

Cisco Firepower 1100 Getting Started Guide - ASA Deployment with ASDM [Cisco Firepower 1000 Series] - Cisco

Step 1

Make sure your Smart Licensing account contains the available licenses you need, including at a minimum the Standard license.

When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart Software Manager account.

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Thu, 17 Mar 2022 12:12:18 GMT

@amh4y0001 what licenses have you purchased? If you didn't purchase any additional licenses you don't need to register the device. If you purchased a support contract or the threat/ravpn licenses then you would need to registered into the smart account and should have been done by the reseller.

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Thu, 17 Mar 2022 13:33:01 GMT

I have NOT purchased any additional license.

Can I use SSH and VPN even if I do not register the device?

Re: Cisco Firepower FPR-1120 >> Initial Setup

Rob Ingram — Thu, 17 Mar 2022 14:21:34 GMT

@amh4y0001 as you are using the ASA image you get 2 free Remote Access VPN licenses. Yes you can SSH.

Re: Cisco Firepower FPR-1120 >> Initial Setup

amh4y0001 — Fri, 18 Mar 2022 08:30:50 GMT

@Rob Ingram thanks for reply, highly appreciated your posts here, otherwise I was stuck on Cisco guides for the wrong image /software.