topic Re: In addition to what Oliver in Network Security

FTD vs FMC

network@bigbenkuwait.com — Tue, 12 Mar 2019 09:01:14 GMT

Hi Guys,

To manage Cisco Firewalls (ASA or Firepower 4000), we have two ways:

1. FirePower Threat Defense software (FTD)

2. Firesight Management Center (firepower management center).

My questions:

- What is the difference between them?

- Using FTD, i can use all the security capabilities (IPS, URL, AMP...etc), correct?

- If i'm using FTD, is it enough? or still i need firesight?

Regards,

FTD is the unified firewall

Oliver Kaiser — Mon, 06 Mar 2017 23:14:39 GMT

FTD is the unified firewall image running on the firewall itself. To manage FTD there is an option for Onboard management called Firepower Device Manager (FDM) which is only available for low to midend appliances (<= ASA 5545-X)... so not suitable for your FP4100 firewall. FDM is limited in functionality, thats why its only for smaller deployments that only need a subset of features.

To manage your FP4100 running FTD you will need Firepower Management Center (FMC) which you can install using a virtual machine (KVM/VMware) or a dedicated physical appliance.

Let me know if that answers your question

Thanks for your reply.

network@bigbenkuwait.com — Mon, 06 Mar 2017 23:28:59 GMT

Thanks for your reply.

FDM for FP4100 firewall is not suitable or not supported?

If my device is ASA (<= 5545-X)

Regarding FTD or (FDM) , can it control the firewall, IPS, URL...etc?

Not supported. See FDM

Oliver Kaiser — Mon, 06 Mar 2017 23:49:08 GMT

Not supported. See FDM configuration guide.

You can manage the smaller firewalls that run FTD using the Firepower Device Manager but keep in mind that it is limited in functionality

FDM has the following limitations:

* no Security Intelligence

* no SSL Decryption

* limited threat analytics (IOCs, etc.)

* no correlation & remedation

* limited subset of configuration options (no ips tuning etc)

In addition to what Oliver

Marvin Rhoads — Tue, 07 Mar 2017 03:23:55 GMT

In addition to what Oliver said, FDM does not support FlexConfigs. Those are used to modify the features based on the original ASA code that are not yet exposed in the FMC GUI.

Slight correction - FDM can manage 5555-X and below.

Thanks for the reply,

network@bigbenkuwait.com — Tue, 07 Mar 2017 11:26:40 GMT

Thanks for the reply,

If this is the case for FTD, I'm wondering if i have ASA with FTD, how i'm going to utilize the security features such as IPS, Maleware, URL.

Can i really get the benefits of these licenses?

Regards

You can get all the basic and

Marvin Rhoads — Tue, 07 Mar 2017 11:30:50 GMT

You can get all the basic and even intermedate threat protection features those licenses provide. It's only some of the more advanced configuration and reporting bits that are missing without FMC.

A 2 device FMC license is only US$500. It's well worth the incremental investment when you compare it to what the ASA appliance and FTD licenses already cost.

Hello,

istr — Wed, 22 Mar 2017 22:17:41 GMT

Hello,

is it possible to use FDM on an ASA-5545-X with FTD 6.3, while FMC is also being used?

6.2 is the current release.

Marvin Rhoads — Thu, 23 Mar 2017 02:18:03 GMT

6.2 is the current release.

If you register the FTD device to FMC, then you cannot use FDM.

Marvin thank you for your

istr — Thu, 23 Mar 2017 09:30:59 GMT

Marvin thank you for your reply, although for some mysterious (or maybe not...) reason i cannot find your post within the thread!

Re: In addition to what Oliver

Afi GNOC — Tue, 26 Sep 2017 19:43:40 GMT

Hi,

Just wondering if I can configure HA in Firepower Device Manager, the on-box management interface? we bought two Firepower 2110 without FMC, still on the way.

I have to use on-box management, but I couldn't find the menu to configure HA in Firepower device manager

It doesn't mention the HA configuration in Firepower device manager configuration guide.

Does it mean we have to use FMC to configure HA, FDM doesn't support it? Thanks!

Re: In addition to what Oliver

Med Amine MEDIOUNI — Mon, 02 Oct 2017 12:41:11 GMT

Re: In addition to what Oliver

Marvin Rhoads — Tue, 16 Apr 2019 04:01:00 GMT

FDM cannot be used to configure or manage HA FTD appliances.

UPDATE - the above is true for <6.3. As of 6.3, the feature was added:

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/relnotes/firepower-release-notes-630/new_features.html#concept_D3A005FB2B0E45BBBDF5392C4D1DD138

Re: In addition to what Oliver

Afi GNOC — Mon, 02 Oct 2017 15:10:02 GMT

Thanks for your response and help.

Re: In addition to what Oliver

Med Amine MEDIOUNI — Mon, 02 Oct 2017 15:12:30 GMT

Many thanks Marvin

Re: 6.2 is the current release.

ataur-rahman1 — Sun, 20 May 2018 09:08:46 GMT

Dear Team

still we will not be able to configure HA or Contexts in FPR2110 by FDM and FMC is mandatory ,plz confirm

Re: 6.2 is the current release.

Marvin Rhoads — Sun, 20 May 2018 12:56:52 GMT

That is correct.

Configuration of HA FTD pair running on Firepower 2100 series currently requires FMC. We expect that to change in Fall 2018 with the release of FTD 6.3.

Multi-context FTD is not currently available on any platform no matter what management tool you are using. We do not expect Firepower 2100 series to have multi-context support anytime soon (if ever).

Re: 6.2 is the current release.

steiostb1 — Fri, 07 Dec 2018 09:25:48 GMT

Is RADIUS for management and user authentication (ex. RA-VPN) supported in FDM? I see that AD is support for user authentication for RA-VPN, but what about RADIUS?