topic This sounds like a huge step in Network Security

Firepower Threat Defense (FTD) / Sourcefire 6.2 - Released

nspasov — Tue, 12 Mar 2019 08:49:45 GMT

The 6.2 train of FirePOWER/Sourcefire was posted yesterday to on cisco.com. Some very nice new features (see below) with inter-chassis clustering and ASA migration tool being a big hits:

https://software.cisco.com/download/release.html?mdfid=286285773&flowid=77253&softwareid=286306337&release=6.2.0&relind=AVAILABLE&rellifecycle=&reltype=latest

New Feature

Description

Supported Platforms

Migration Tool

Migrating from Cisco ASA-to-Firepower Threat Defense can be a daunting task for customers with multiple access control lists (ACLs), NAT policies, and related configuration objects. The migration tool is specifically designed to assist this migration process. The tool allows you to convert ASA configurations (ACL, NAT and related objects) to Firepower Threat Defense configurations, which you can then import into the Firepower Management Center. The migration tool supports the conversion of up to 600,000 total access rule elements per ASA configuration file.

64-bit Firepower Management Center Virtual (VMware and KVM)

REST API

Firepower Version 6.2.0 allows REST clients to create and configure interfaces for Firepower Threat Defense devices via the Firepower Management Center REST API. This feature enables the Firepower Management Center to interact with various Cisco products and services, as well as those from third-party vendors. Implementation of these APIs is ideal in the following scenarios:

large enterprises who want to control policy changes in Firepower through other Cisco systems such as Application Centric Infrastructure (ACI) or through their own proprietary orchestration solutions
managed security service providers who want to adopt software defined networking, application-centric infrastructure,and network function virtualization solutions

Note

SDN controllers do not have a way to automatically insert Firepower Threat Defense devices in the traffic path.

Firepower Management Center
64-bit Firepower Management Center Virtual

Packet Tracer and Capture

The Packet Tracer and Capture offers the ability to show all the processing steps that a packet takes, the outcomes, and whether the traffic is blocked or allowed. This allows users to initiate and display output of tracing from the Firepower Management Center. The tracing information includes information from SNORT and preprocessors about verdicts and action taken while processing a packet.

Firepower Threat Defense

Table 2 New Features for Version 6.2.0: Architecture
New Feature	Description	Supported Platforms
Integrated Routing and Bridging (IRB)	Customers often want to have multiple physical interfaces configured to be part of the same VLAN. The IRB feature meets this demand by allowing users to configure bridges in routed mode, and enables the devices to perform L2 switching between interfaces (including subinterfaces).	Firepower Threat Defense on ASA 5506-X, ASA 5506W-X, or ASA 5506H-X
Inter-chassis Clustering	Clustering lets you group multiple FXOS chassis Firepower Threat Defense devices together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. In Version 6.2.0, the Firepower System supports clustering across multiple chassis (inter-chassis clustering), allowing for higher scalability. You can use the Firepower Management Center to automatically discover all nodes of a cluster.	Firepower Threat Defense on Firepower 4100 Series Firepower Threat Defense on Firepower 9300 Series
Policy Change Improvement	Deploying policy changes to a Firepower Threat Defense device can result in restarting the SNORT process and the related loss of some packets. As part of a continuing effort to address this issue, Firepower Version 6.2.0 allows you to configure actions separately for fault conditions, such as SNORT Busy/Overload or SNORT Down. This feature allows you to emphasize either continuity or security by checking a checkbox option in the Firepower Management Center.	Firepower Threat Defense (inline mode only)

Table 3 New Features for Version 6.2.0: Platform/Integration
New Feature	Description	Supported Platforms
Firepower Threat Defense on Microsoft Azure	In Firepower Version 6.2.0, Cisco Firepower Threat Defense Virtual is available in the Microsoft Azure Marketplace. This new platform enables you to secure workloads consistently across the data center and public cloud. Managed centrally by an on-premises Firepower Management Center, Firepower Threat Defense Virtual provides advanced threat protection in the Azure environment without forcing customers to backhaul traffic to the data center.	Firepower Threat Defense virtual
Firepower Threat Grid API Key Integration	This feature streamlines the process of associating a Threat Grid account with your Firepower Management Center.	Firepower Management Center 64-bit Firepower Management Center Virtual
ISE and SGT tags without Identity	Before Firepower Version 6.2.0, you had to create a realm and identity policy to perform user control-based on ISE Security Group Tag (SGT) data, even if you did not want to configure passive authentication using ISE. In Firepower Version 6.2.0, you no longer need to create a realm or identity policy to perform user control-based on ISE Security Group Tag (SGT) data.	Firepower Management Center 64-bit Firepower Management Center Virtual 7000 and 8000 Series NGIPSv ASA with FirePOWER Services Firepower Threat Defense Firepower Threat Defense Virtual

Table 4 New Features for Version 6.2.0: Platform/Integration
New Feature	Description	Supported Platforms
Site-to-Site VPN	The site-to-site VPN with PKI support is an addition to the current capability of site-to-site VPN with pre shared keys. The Firepower Device Manager (FDM) also allows you to configure site-to-site VPN with pre shared keys.	Firepower Threat Defense managed byFirepower Management Center Firepower Threat Defense Virtual
PKI Support for Firepower Management Center	Public Key Infrastructure (PKI) is required to create certificate-based trusted identities for devices establishing site-to-site VPN tunnels. This feature allows you to associate PKI certificate data with devices with the Firepower Management Center.	Firepower Threat Defense Firepower Threat Defense Virtual
User-based Indications of Compromise (IOCs)	This feature allows you to generate user-based IOCs from intrusion events, or view the associations of users and IOCs. You can also enable and disable eventing of a given IOC per user (against false positives). With this feature, you can correlate IOCs and events to both hosts and users, plus give them more visibility and alerting options on a per-user basis.	Firepower Management Center 64-bit Firepower Management Center Virtual 7000 and 8000 Series NGIPSv ASA with FirePOWER Services Firepower Threat Defense managed byFirepower Management Center Firepower Threat Defense Virtual
URL Lookups	This feature allows you to perform a bulk lookup of URLs (up to 250 URLs at a time) to obtain information, such as reputation, category, and matching policy. You can also export the results as a file of comma-separated values. The feature reduces the manual work necessary to determine if your organization is protected against a malicious URL or if you should add a custom rule for a specific IOC. You can use this feature to reduce the number of custom rules, which in turn reduces the chance of performance degradation due to extensive custom rule lists.	Firepower Management Center Virtual 64-bit Firepower Management Center Virtual
FlexConfig	The FlexConfig feature allows you use the Firepower Management Center to deploy ASA CLI template-based functionality to Firepower Threat Defense devices. This feature allows you to enable some of the most valuable ASA functions that are not currently available on Firepower Threat Defense devices. This functionality is structured as templates and objects that are stitched together in a policy. The default templates are officially supported by Cisco TAC Support. The targeted features unlocked by FlexConfig potentially include: Non-Inspection Templates: Routing (EIGRP, PBR, and IS-IS) Netflow (NSEL) export MPF connection limits, timeouts (including DCD), and Normalizer settings Platform sysopt commands Proxy ARP Neighbor Discovery (`sysopt noproxyarp` `interface`) IPv6 Prefix Delegation IPV6 WCCP VXLAN Application Layer Inspection Templates: ALGs default configuration GTPv1/v2 support Diameter inspection LISP inspection SCTP support and inspection SIP SS7 inspection	Firepower Threat Defense Firepower Threat Defense Virtual

This sounds like a huge step

Philip D'Ath — Wed, 25 Jan 2017 00:06:28 GMT

This sounds like a huge step forward.

For little firewalls, like the 5506, is there any on-board management option or do you have to use Firesight for management?

Most important new feature

Oliver Kaiser — Wed, 25 Jan 2017 08:10:30 GMT

Most important new feature imo: BVIs for ASA + FTD. Finally we can bridge between ports again and dont need an additional switch for small 5506-X deployments. 😉

As for Inter-Chassis Clustering... if anyone is brave enough to use this feature in production let me know, I would wait a little longer since there are still some ceveats associated with the central management only (FMC) approach which can get very funny when re-adding devices to FMC in case of fmc migration and bugs (like static route configuration being removed and nat config being redeployed, which will result in traffic loss and possible communication issues between fmc and your sensor).

You can use Firepower Device

Oliver Kaiser — Wed, 25 Jan 2017 08:12:03 GMT

You can use Firepower Device Manager to manage standalone devices ranging from 5506-X to 5545-X. Keep in mind that FDM has some limitations when it comes to features... If you need any details let me know.

As far as I know 6.2 release

Massimo Baschieri — Wed, 25 Jan 2017 09:39:13 GMT

As far as I know 6.2 release should have been the first release that officially supports VDI, unfortunately I cannot see any mention to it into release notes, it has not even been published a new user agent on cco, anyone has news about it?

According to my local Cisco

Oliver Kaiser — Wed, 25 Jan 2017 09:42:51 GMT

According to my local Cisco SE, TS-Agent is definetly supported with 6.2. Documentation has already been published to cisco.com but it seems like the ts-agent installer is not in cco yet. Still waiting for a response about this.

I will update this post when I get feedback

Is there any user to site VPN

Philip D'Ath — Wed, 25 Jan 2017 21:09:11 GMT

Is there any user to site VPN support in this release? It would be a real handicap not having this.

If there is, what have they supported? AnyConnect? L2TP over IPSec?

Not yet. I have read some

Oliver Kaiser — Wed, 25 Jan 2017 22:14:30 GMT

Not yet. I have read some rumors that anyconnect should be added in 6.2.1 soon, but might be posponed until 6.3

Too bad the ASA version

hoffa2000 — Thu, 26 Jan 2017 19:07:41 GMT

Too bad the ASA version requirement, if you run ASA with Firepower services, is 9.7.1 which is brand new and not everyone is keen jumping into a brand new release train just to gain new Firepower functionality. I am one of those and I'm especially crossed since I just spent alot of time jumping from ASA 9.4.x to get Firepower 6.2 support.

/Fredrim

Yes, we noticed that as well.

Philip D'Ath — Thu, 26 Jan 2017 19:11:50 GMT

Yes, we noticed that as well. We are trying it out in our lab, but because of this we probably wouldn't deploy it at a customer site for a year or so. To give the software more time to mature.

Hi I currently have a

ross_rulz — Fri, 27 Jan 2017 03:35:59 GMT

Hi I currently have a standalone 5506X ASA and I'm using the ASDM to manage the Firepower side of things. Can you point me in the right direction on how to migrate away from this to the Firepower Device Manager?

Thanks,

Ross.

@ross_rulz ,

Marvin Rhoads — Fri, 27 Jan 2017 05:31:30 GMT

ross_rulz ,

ASA with FirePOWER services module cannot be managed with FDM.

Only the integrated FTD image can use FDM. As noted, FTD does not yet have feature parity with all of the legacy ASA features - most notably remote access VPN.

Update: TS-Agent has been

Oliver Kaiser — Fri, 27 Jan 2017 10:44:48 GMT

Update: TS-Agent has been published yesterday.

https://software.cisco.com/download/release.html?i=!y&mdfid=286282812&softwareid=286271056&release=6.2.0&os

Marvin -- any time frame for

Lucas Phelps — Wed, 01 Feb 2017 21:15:19 GMT

Marvin -- any time frame for AnyConnect VPN Support?

Look forward to april. ;)

Oliver Kaiser — Wed, 01 Feb 2017 22:31:51 GMT

Look forward to april. 😉

Has anyone tried to use the

TOR-IVAR KRISTOFFERSEN — Mon, 10 Apr 2017 11:28:39 GMT

Has anyone tried to use the IPv6 Prefix Delegation feature that is supposed to work in 6.2.0 ?

I am unable to get this working, nor find some good documentation on how it should work other that that i need to know the commands to enter.

Creating a flexconfig containing the old config from my 9.7 ASA release does not work.

interface GigabitEthernet1/1
ipv6 dhcp client pd CanalDigital-Prefix

This throws an error stating "Error - Unsupported CLI"

Running ASA 5506X with FTD 6.2.0.1 and FMC 6.2.0 (build 362)

Anyone tried this and succeeded ?

Tor-Ivar Kristoffersen

Hi Just wanted to know in

Sheraz.Salim — Sat, 27 May 2017 09:39:27 GMT

Hi Just wanted to know in future the ASA line of software 8.x to 9.x will get retire and all focus will be on FTD.

seems how things going on FTD will take over the ASA and cisco will EOL ASA software?

There are no current plans to

Marvin Rhoads — Sat, 27 May 2017 10:10:42 GMT

There are no current plans to retire the ASA hardware or software as a whole line. Of course the oldest platforms and versions will naturally reach end of sales but Cisco continues to develop both hardware and software on the rich legacy of ASA.

Hi,

ssambourg — Wed, 31 May 2017 07:27:24 GMT

Hi,

Is there any update on client to site VPN support ?

6.2.1 was released 2 weeks

Oliver Kaiser — Wed, 31 May 2017 07:33:40 GMT

6.2.1 was released 2 weeks ago. AnyConnect is only available for the FP2100 platform as of now. Support for ASA 5500-X and FP4100/9300 will follow in april july with version 6.2.2.

If you interested in some limitations as of now I did a quick write up on my blog: http://dependencyhell.net/2017/05/27/AnyConnect-for-FTD/

regards

Oliver