topic Re: New Cisco Firepower FPR 1120 Configuration in Network Security

New Cisco Firepower FPR 1120 Configuration

ssan239 — Tue, 06 Jun 2023 13:01:59 GMT

Hi Team,

We have got new Cisco Firepower FPR 1120 which is the replacement FTD for our ASA 5545. We need to configure the FTD as same as ASA. ASA do not have any Mgmt interface configured. So we need to manage the LAN interface of FTD as the Mgmt interface. Also we need to manage the FTD locally not via FMC.

What will be our first step. How can we use the Firepower Migration tool for the FTD which is managed locally?

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp1100/firepower-1100-gsg/ftd-fmc.html

I was going through the link above but that is again for the device managed via FMC.

Is there any link which i go through. Also if i manage the device locally it is managing with the FDM itself right? Also if i am managing locally can i use CLI for any configuration of the device?

Please add some inputs on this. Need to get it done by Thursday please suggest.

Regards,

Sanjay S

Re: New Cisco Firepower FPR 1120 Configuration

MHM Cisco World — Tue, 06 Jun 2023 13:06:44 GMT

Migrate tool can not use for migrate from FW mgmt by fdm to FW mgmt by fmc

Re: New Cisco Firepower FPR 1120 Configuration

Rob Ingram — Tue, 06 Jun 2023 13:08:57 GMT

@ssan239 if you are using FDM to manage the device locally, then you cannot use the Firepower Migration Tool.

You can use the CDO tool to migrate the ASA configuration to FDM. https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide-CDO/ASA2FTD_Using_CDO/m_how_to_implement_migration.html

If you need it done by Thursday, it might be quicker to configure the device from scratch.

99.9% of the configuration of the FTD must be performed using the FDM GUI. CLI is primarily used to configure the mgmt interface and diagnostics/troubleshooting.

Re: New Cisco Firepower FPR 1120 Configuration

MHM Cisco World — Tue, 06 Jun 2023 13:14:34 GMT

CDO can help you migrate your Adaptive Security Appliance (ASA) to an FDM-managed device. CDO provides the ASA to FDM Migration wizard to help you migrate your ASA's running configuration to an FDM template.

Note:- if you use cdo then ftd will mgmt by fdm only not fmc.

Re: New Cisco Firepower FPR 1120 Configuration

ssan239 — Tue, 06 Jun 2023 13:41:37 GMT

Thank you Rob for the information.

Is there any other way to manage FTD other than FMC and FDM? Based on my understanding there are only 2 way one is via FMC and the other is locally that is nothing but FDM, is my understanding correct?

Also Can i use the LAN interface to manage the FPR1120 as ASA config do not have specific Mgmt interface?

Regards,

Sanjay S

Re: New Cisco Firepower FPR 1120 Configuration

Rob Ingram — Tue, 06 Jun 2023 13:46:21 GMT

@ssan239 there are 4 ways:

Local = FDM
Central (On-premise) = FMC
Central (Cloud) = CDO or cdFMC (Cloud delivered FMC)

You can manage the FDM using the dedicated mgmt interface or data (LAN) interface.

Re: New Cisco Firepower FPR 1120 Configuration

MHM Cisco World — Tue, 06 Jun 2023 13:47:09 GMT

Using CLI' I will check the available command if you try using CLI.

Thanks

MHM

Re: New Cisco Firepower FPR 1120 Configuration

ssan239 — Tue, 06 Jun 2023 14:36:49 GMT

Getting better understanding now. Thanks Rob.

You can manage the FDM using the dedicated mgmt interface or data (LAN) interface.

Is there any document on how to configure this?

Re: New Cisco Firepower FPR 1120 Configuration

Rob Ingram — Tue, 06 Jun 2023 14:42:05 GMT

@ssan239

https://www.cisco.com/c/en/us/td/docs/security/firepower/720/fdm/fptd-fdm-config-guide-720/fptd-fdm-get-started.html

Post initial configuration you can navigate to System Settings > Management Access > Data Interfaces and permit access on additional data interfaces as required.

Re: New Cisco Firepower FPR 1120 Configuration

ssan239 — Tue, 06 Jun 2023 15:27:56 GMT

Great! looks simple. Thanks alot Rob for the help 🙂

Re: New Cisco Firepower FPR 1120 Configuration

MHM Cisco World — Tue, 06 Jun 2023 15:47:12 GMT

You can sure use mgmt interface but for data interface for fdm I think you need management only for this interface to connect fdm to fpr.

Just want to notice you

Thanks

MHM

Re: New Cisco Firepower FPR 1120 Configuration

Rob Ingram — Tue, 06 Jun 2023 16:29:36 GMT

@MHM Cisco World that's incorrect, this is FDM, it sounds like you are confusing this with ASA with Firepower Module. Not the same thing.

Re: New Cisco Firepower FPR 1120 Configuration

MHM Cisco World — Tue, 06 Jun 2023 16:38:39 GMT

I know this FPR and that why I mention he must config management only for data interface use to connect to fdm.

I will be sure check Cisco doc. And share cisco recommends here.

Thanks

MHM

Re: New Cisco Firepower FPR 1120 Configuration

Rob Ingram — Tue, 06 Jun 2023 16:44:07 GMT

@MHM Cisco World wrote:

I know this FPR and that why I mention he must config management only for data interface use to connect to fdm.

You do not have to configure management only for a data interface, it's a data interface it can used for management and data (transit) traffic at the same time (as per the example I provided from a live FDM FPR1010 device).

The dedicated management interface does not need to be used at all, if not required - its optional.

Re: New Cisco Firepower FPR 1120 Configuration

ssan239 — Wed, 07 Jun 2023 11:59:44 GMT

Hi Rob,

I am unsure that we have a CDO tenancy. When i click on initial login hyperlink it is diverting to the below page.

https://docs.defenseorchestrator.com/Welcome_to_Cisco_Defense_Orchestrator/Basics_of_Cisco_Defense_Orchestrator/0010_Initial_Login

Not really sure where to login to get the migration config for the FTD. We do have Cisco account where we mange the licenses and stuff. Not really sure if the same account we can use? If so where to login for this CDO?

Regards,

Sanjay S

Re: New Cisco Firepower FPR 1120 Configuration

Rob Ingram — Wed, 07 Jun 2023 12:04:25 GMT

@ssan239 unfortunately its not free, you need a CDO license for that appliance.....however there is a 30 day trial license you could try and use that.

https://www.cisco.com/c/en/us/products/security/defense-orchestrator/free-trial.html

Re: New Cisco Firepower FPR 1120 Configuration

ssan239 — Wed, 07 Jun 2023 13:13:14 GMT

Thanks again Rob.

In that case if i go with managing the FTD via FMC, then if i need to use the data interface as the management interface is it possible? Is there an option?

Re: New Cisco Firepower FPR 1120 Configuration

Rob Ingram — Wed, 07 Jun 2023 13:18:05 GMT

@ssan239 yes you can manage the FTD from the FMC over a data interface, since version 6.7 - the management interface is optional.

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/relnotes/firepower-release-notes-670/m_features_functionality.html

Re: New Cisco Firepower FPR 1120 Configuration

MHM Cisco World — Wed, 07 Jun 2023 13:17:14 GMT

as I know FMC need to connect to mgmt interface, what I think you have FMC in different site and you need to access FTD via FMC and hence the mgmt interface must be reachable by FMC ?
if that right then connect mgmt to INside of FTD and FTD will Forword mgmt traffic to FMC

Re: New Cisco Firepower FPR 1120 Configuration

MHM Cisco World — Wed, 07 Jun 2023 13:30:52 GMT

You can alternatively manage the FTD using a data interface instead of the Management interface.
@Rob Ingram correct in FMC 6.7 you can use data interface
Firepower Management Center Configuration Guide, Version 6.7 - Interface Overview for Firepower Threat Defense [Cisco Secure Firewall Management Center] - Cisco