Firepower Management Center Virtual

[VCsupport17]

Hello Community,

I am new with ASA firewall and we have bought Cisco ASA 5516-X firewall with firepower threat defense licenses. We also have purchase Cisco Firepower Management Center (VMware) license.

I want to start to deploy our firewall and don't know where to start with.

I have this guides so far to look into:

http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/vmware/fmcv/FMCv-quick.pdf

http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/5508X/ftd-fdm-5508x-qsg.html

http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/5508X/ftd-fmc-5508x-qsg.html

Can anybody help me where can I obtain the vmware file for the Firepower Management Center Virtual.

Please provide me the download link.

Thank you.

[Philip D'Ath · Accepted solution]

You can download it from here.  Grab version 6.2.

https://software.cisco.com/download/release.html?mdfid=286259687&softwareid=286271056&release=SEU&relind=AVAILABLE&rellifecycle=&reltype=latest

You will probably need a Cisco maintenance contract registered against your account, like SmartNet, to be able to download it.

[VCsupport17]

Hello Philip,

Thank you for providing the link.

As of now i don't have the service contract yet. For the meantime we will install and configure the firewall. Is it possible to deploy the firewall and will work without the Firepower management center?

Thank you.

[Philip D'Ath]

You can configure the ASA portion.  The Firepower module usually ships with older software on it, and it is quickest to re-image the module with current software, than to go through the long upgrade process.

[VCsupport17]

But basically the ASA firewall will work without Firepower management center?

What is the purpose of Firepower management center?

Thanks.

[Philip D'Ath]

Yes, the ASA will work without the Firepower Management Center.

The Firepower Management Center is only used to manage the Firepower module inside of the ASA.

[VCsupport17]

Thanks Philip for clarification.

[VCsupport17]

Hi Philip,

I have another query.

Our Cisco ASA 5516-X with product ID ASA5516-FTD-K9 and have license L-ASA5516T-TMC-1Y for threat defense, malware protection and URL filtering 1 year subscription.

On the licenses we have, we can enable also VPN site-to-site?

Can you give me other feature that we can enable on the ASA based on the license we have?

Thank you.

[Philip D'Ath]

I didn't realise they had started offering bundles like that.

You can run "classic" ASA with Firepower on the built in module, or throw away the ASA software and run entirely Firepower (and it is called FTD or Firepower Threat Defence in this mode).  You can also convert between the two, but it does take some time.

The ASA software has rich VPN support and debugging tools.  Firepower 6.2 has just gained site to site VPN support.  Although workable the VPN support and debugging tools are still pretty weak.

So if you only need basic site to site VPNs, stay as you are.  If you need to do anything tricky with VPNs, or need user to site VPN support, convert back to running the ASA software.

[Marvin Rhoads]

If you have the ASA 5516-X with FTD image pre-installed then you have the option of using either local management (FirePOWER Device Manager or FDM is what Cisco calls the GUI) or FirePOWER Management Center (FMC). You can only use one or the other for a given FTD device - not both.

As Philip noted, FTD 6.2 does give you site-site VPN. You do not get remote access SSL VPN (AnyConnect) for end users.

Using FDM for management a simpler but less full-featured option. You have to build the policies locally and they cannot be shared across multiple ASAs. You historical log retention is quite limited, you cannot configure advanced features (like protocol inspections and some routing) with FlexConfigs, etc.