topic Re: Managing Cisco Firepower without FMC in Network Security

Managing Cisco Firepower without FMC

sulaimangd — Tue, 12 Mar 2019 09:40:31 GMT

Hi,

im trying to understand the following

when we say ASA with FirePower, we mean upgraded ASA boxes which have the Unified ASA Image?

What is FTD?

What is the Difference when we say ASA with FirePower and the Firepower Appliances?

and to manage a Cisco FirePower Applaince we need FMC, Right?

Thanks again.

ASA with FirePOWER means that

Marvin Rhoads — Sun, 09 Jul 2017 15:10:31 GMT

ASA with FirePOWER means that the Firepower software is running on a module (software module for all but the ASA 5585-X) in addition to the classic ASA software. That is NOT the unified image.

FTD or Firepower Threat Defense is the unified image that combines ASA and FirePOWER features in one running image. Note some ASA features are currently not supported. Notably full SSL VPN (limited support on Firepower 2100 as of this posting), clientless SSL VPN and multiple context. There are a bunch of lesser features also not included in FTD.

Firepower appliances is a term usually used to refer to the old Sourcefire (now branded Cisco) appliances like the 3D7000 and 3D8000 series. They run only Firepower software and not FTD.

There are now also Firepower 2100, 4100 and 9300 series appliances. Those run either FTD or ASA software (2100 series runs FTD only until later this year). Note when they run ASA software it is without ANY Firepower NGIPS features.

We mostly need an FMC to manage Firepower appliances. When an ASA or 2100 series appliance is running FTD it can be managed (with limited features) using the on-box Firepower Device Manager (FDM). The same idea goes for an ASA with FirePOWER service module - you can manage it completely with ASDM (as of Firepower version 6.0).

thanks marvin,

sulaimangd — Wed, 12 Jul 2017 06:24:18 GMT

thanks marvin,

so when we say for example

Cisco Firepower 4110 NGFW appliance running FXOS, so we are referring to FTD running on those boxes.

for that we need FMC to manage those devices am I right?

Thanks

Yes that's right. You do

Marvin Rhoads — Wed, 12 Jul 2017 06:28:13 GMT

Yes that's right. You do require FMC to manage FTD logical devices on a 4110 chassis.

so FXOS is the FTD?

sulaimangd — Wed, 12 Jul 2017 06:32:56 GMT

so FXOS is the FTD?

No, FX-OS or Firepower

Marvin Rhoads — Wed, 12 Jul 2017 10:42:04 GMT

No, FX-OS or Firepower eXtensible Operating System is the OS that manages the chassis resources.

You interact with it directly when you first setup the hardware and use it to deploy and assign resources (interfaces) to a logical device. Logical devices can be FTD, ASA or (for the 9300 chassis only) Radware virtual DefensePro (vDP).

FX-OS has a web-based GUI (Firepower Chassis Manager or FCM) or you can access it via cli or API to the chassis management interface.

Thanks Marvin,

sulaimangd — Sun, 16 Jul 2017 07:13:14 GMT

Thanks Marvin,

in case we have a 4110 Appliance, and its running ASA software, so this can be managed using ASDM, but we will not be able to run FTD, so it's either ASA Code or FTD code?

Sulaiman

You're welcome.

Marvin Rhoads — Sun, 16 Jul 2017 08:33:00 GMT

You're welcome.

That's correct - you run either an ASA or FTD logical device on a Firepower 4110. Never both at the same time.

The ASA looks pretty much like any other ASA when managing it with ASDM. The only differences are the few things you have to do via the FX-OS-based Firepower Chassis Manager (FCM). Those include (off the top of my head):

deploy and upgrade the image,

license features (via Smart Licensing) like 3DES-AES and AnyConnect (for ASA logical devices) and Firepower licenses for all FTD logical devices and AnyConnect (2100 series only for that bit on FTD as of 6.2.1),

allocate interfaces,

create portchannels.

Note that you need to apply the ASA 3DES-AES license via FCM using Smart Licensing before you can use ASDM to manage the ASA logical device.

About FirePower 2100 with ASA software

pablohernandez — Mon, 11 Sep 2017 17:24:22 GMT

Hi,

Regarding the FP2100 with ASA, how are the FirePower features activated? I understand that the device is running ASA code, so how do I enable the NFGW features, like AVC, IPS, etc?

Regards.

Re: You're welcome.

dvalinho — Fri, 15 Mar 2019 16:22:15 GMT

Thanks Marvin.

Got a question.

Lets assume we are migrating from an old ASA to FTD box running ASA image. Can the migration tool + FMC be used in that case?

I know it i useful in case we upgrade to FTD image but not sure when we run ASA image on FTD bix.

Re: You're welcome.

Marvin Rhoads — Sat, 16 Mar 2019 03:49:38 GMT

@dvalinho

Answered in your other thread:

https://community.cisco.com/t5/firewalls/asa-to-firepower-asa-image/td-p/3820285

Re: Managing Cisco Firepower without FMC

mohammedelmeligie1978 — Mon, 29 Aug 2022 07:25:23 GMT

Hi Marvin

How can configure FTD 4100 without FMC?

Re: Managing Cisco Firepower without FMC

Marvin Rhoads — Mon, 29 Aug 2022 12:52:19 GMT

@mohammedelmeligie1978 If you are not using FMC then first make sure the appliance is set for local management using the cli command "show managers".

Then follow this guide:

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/fdm/fptd-fdm-config-guide-700/fptd-fdm-get-started.html#concept_D737C97687844B4F90349681810352D1

Re: Managing Cisco Firepower without FMC

mohammedelmeligie1978 — Mon, 29 Aug 2022 11:39:37 GMT

Marvin,

Does ASDM support inline pairing without fmc ?

Re: Managing Cisco Firepower without FMC

Marvin Rhoads — Mon, 29 Aug 2022 12:50:59 GMT

@mohammedelmeligie1978 are you running ASA image or FTD image on your appliance?

Since you ask about ASDM that implies ASA image. Inline pairing is a mode specific to IPS which is not applicable for ASAs.

Re: Managing Cisco Firepower without FMC

mohammedelmeligie1978 — Mon, 29 Aug 2022 12:54:11 GMT

FTD , and i will configure an inline connection without fmc , is this available from FD ?

Re: Managing Cisco Firepower without FMC

mohammedelmeligie1978 — Mon, 29 Aug 2022 12:55:09 GMT

From FDM..

Re: Managing Cisco Firepower without FMC

Marvin Rhoads — Mon, 29 Aug 2022 13:21:09 GMT

Firepower Device Manager does not support Inline Pairs of interfaces. That feature requires FMC.

Re: Managing Cisco Firepower without FMC

mohammedelmeligie1978 — Mon, 29 Aug 2022 13:24:18 GMT

Thanks Marvin