Cisco announces the availability of Firepower 6.3.0. In addition to the new features (summarised in the table below), the Firepower 6.3.0 release includes these significant enhancements to user experience: How-To widget on the Firepower Management Center web interface : This provides walkthroughs to help you navigate through on-boarding tasks on the FMC web interface, after installing a new Firepower Management Center. These walkthroughs guide you to perform the steps required to achieve a task by taking you through each step, one after the other irrespective of the various UI screens that you may have to navigate, to complete the task. The How To widget is enabled by default. Licensing: Licensing content has been refined and we have introduced a comprehensive  start-to-finish “recipe” for licensing FTD devices managed by FMC, including links to additional information here: How to License Firepower Threat Defense Devices Managed by Firepower Management Center   Configuration Example: We added a configuration example that  explains how to set up a Firepower Management Center Version 6.2.3 device to manage a Firepower Threat Defense Version 6.2.3 device to provide inspection and security for a sample network that includes an inside network and outside network (that is, the internet). Best Practices Information: We have added Best practices information to eStreamer integration in the Firepower System Event Streamer Integration Guide, Version 6.3.0 Firepower Management Center Upgrade Guide Logging across the Firepower Management Center Config Guide New Features in FMC/Firepower Version 6.3.0 This table summarizes the new features available in Firepower Version 6.3 when configured using a   Firepower Management Center .   Feature  Description Hardware   ISA 3000  with FirePOWER Services   ISA 3000   with FirePOWER Services is supported in Version 6.3. Although   ISA 3000   with FirePOWER Services was also supported in Version 5.4.x, you cannot upgrade to Version 6.3. You must reimage. Supported Platforms: ISA 3000 Licensing   Export-controlled features for approved customers Customers whose Smart Accounts are not otherwise eligible to use restricted functionality can purchase term-based licenses, with approval. New/Modified Screens:   System  >  Licenses  >  Smart Licenses Supported Platforms:   FMC ,   FTD Specific License Reservation for approved customers   Customers can use Specific License Reservation to deploy Smart Licensing in an air-gapped network. The   FMC   reserves licenses from your virtual account for a specified duration without accessing the Cisco Smart Software Manager or Smart Software Satellite Server. New/Modified Screens:   System  >  Licenses  >  Specific Licenses Supported Platforms:   FMC ,   FTD Interface Features   Hardware bypass support on the Firepower 2100 for supported network modules   Firepower 2100 devices now support hardware bypass functionality when using the hardware bypass network modules. New/Modified Screens:   Devices  >  Device Management  >  Interfaces  >  Edit Physical Interface Supported Platforms: Firepower 2100 Support for data EtherChannels in On mode  You can now set data and data-sharing EtherChannels to either Active LACP mode or to On mode. Other types of EtherChannels only support Active mode. New/Modified Firepower Chassis Manager Screens:   Interfaces  >  All Interfaces  >  Edit Port Channel  >  Mode New/Modified FXOS commands:   set port-channel-mode Supported Platforms: Firepower 4100/9300  Access Control   Update interval for URL category and reputation data  You can now force URL data to expire. There is a tradeoff between security and performance. A shorter interval means you use more current data, while a longer interval can make web browsing faster for your users. Upgrading to Version 6.3 does not change system behavior. The setting defaults to disabled (the current behavior), meaning that cached URL data does not expire. New/Modified Screens:   System  >  Integration  >  Cisco CSI  >  Cached URLs Expire  setting  IAB enabled by default  Intelligent Application Bypass (IAB) is now enabled by default in new access control policies, using predefined settings. Upgrading to Version 6.3 does not change existing access control policies. New/Modified Screens:   Policies  >  Access Control   >  create new policy  > Advanced  tab  High Availability and Scalability   Multi-instance capability for Firepower 4100/9300 with FTD     You can now deploy multiple logical devices, each with a Firepower Threat Defense container instance, on a single security engine/module. Formerly, you could only deploy a single native application instance. To provide flexible physical interface use, you can create VLAN subinterfaces in FXOS and also share interfaces between multiple instances. Resource management lets you customize performance capabilities for each instance. You can use high availability using a container instance on 2 separate chassis. Clustering is not supported. Note: Multi-instance capability is similar to ASA multiple context mode, although the implementation is different. Multiple context mode is not available for FTD. New/Modified Firepower Chassis Manager Screens:New/Modified FMC Screens:   Devices  >  Device Management   >  edit device > Interfaces tab Overview  >  Devices Interfaces  >  All Interfaces  >  Add New  drop-down menu > Subinterface Interfaces  >  All Interfaces  >  Type Logical Devices  >  Add Device Platform Settings  >  Mac Pool Platform Settings  >  Resource Profiles New/Modified FXOS Commands:   connect ftd   name   ,   connect module telnet   ,   create bootstrap-key PERMIT_EXPERT_MODE   , create resource-profile   ,   create subinterface   ,   scope auto-macpool   ,   set cpu-core-count   ,   set deploy-type   ,   set port-type data-sharing   ,   set prefix   ,   set resource-profile-name   ,   set vlan   ,   scope app-instance ftd   name   ,   show cgroups container   ,   show interface   ,   show mac-address   ,   show subinterface   ,   show tech-support module app-instance   ,   show version Supported Platforms: Firepower 4100/9300 Cluster control link customizable IP Address for the Firepower 4100/9300   By default, the cluster control link uses the 127.2.0.0/16 network. You can now set the network when you deploy the cluster in FXOS. The chassis auto-generates the cluster control link interface IP address for each unit based on the chassis ID and slot ID: 127.2.chassis_id.slot_id. However, some networking deployments do not allow 127.2.0.0/16 traffic to pass. Therefore, you can now set a custom /16 subnet for the cluster control link in FXOS except for loopback (127.0.0.0/8) and multicast (224.0.0.0/4) addresses. New/Modified Firepower Chassis Manager Screens:   Logical Devices  >  Add Device  >  Cluster Information New/Modified Options:   CCL Subnet IP   field New/Modified FXOS Commands:   set cluster-control-link network Supported Platforms: Firepower 4100/9300 Improved FTD cluster addition to the FMC   You can now add any unit of a cluster to the   FMC , and the other cluster units are detected automatically. Formerly, you had to add each cluster unit as a separate device, and then group them into a cluster with the   FMC . Adding a cluster unit is also now automatic. Note that you must delete a unit manually. New/Modified Screens: Devices  >  Device Management  > Add  drop-down menu  > Device > Add Device  dialog box Devices  >  Device Management  > Cluster  tab  > General  area  > Cluster Registration Status > Current Cluster Summary  link  > Cluster Status  dialog box Supported Platforms: Firepower 4100/9300  Encryption and VPN   SSL hardware acceleration      Additional   Firepower Threat Defense   devices now support SSL hardware acceleration. Also, this option is now enabled by default. Upgrading to Version 6.3 automatically enables SSL hardware acceleration on eligible devices. Using SSL hardware acceleration if you are not decrypting traffic can affect performance. We recommend you disable SSL hardware acceleration on devices that are not decrypting traffic. Supported Platforms: Firepower 2100 series, Firepower 4100/9300  RA VPN: RADIUS Dynamic Authorization or Change of Authorization (CoA) You can now use RADIUS servers for user authorization of RA VPN and firewall cut-through-proxy sessions, using dynamic access control lists (ACLs) or ACL names per user. Supported Platforms:   FTD  Events, Logging, and Analysis   Cisco Security Packet Analyzer   Integration   You can integrate with   Cisco Security Packet Analyzer   to examine events and display analysis results, or download results for further analysis. New/Modified Screens: System  >  Integration  >  Packet Analyzer Analysis  >  Advanced  >  Packet Analyzer Queries Query Packet Analyzer  when right-clicking on an event in the dashboard or event viewer Contextual cross-launch You can right-click an event in the dashboard or event viewer to look up related information in predefined or custom, public or private URL-based resources. New/Modified Screens:   Analysis  >  Advanced  >  Contextual Cross-Launch Unified syslog configuration Previously, you configured event logging via syslog in multiple places, depending on the event type. In Version 6.3, you now configure syslog messaging in the access control policy. These configurations affect connection and intrusion event logging for the access control, SSL, prefilter, and intrusion policies, as well as for Security Intelligence. For   Firepower Threat Defense   devices, some syslog platform settings now apply to connection and intrusion event messages. For a list, see the "Platform Settings for Firepower Threat Defense" chapter in the   Configuration Guide. Supported Platforms: Varies Fully-qualified syslog messages for connection and intrusion events   The format of syslog messages for connection, security intelligence, and intrusion events have the following changes: Messages from   Firepower Threat Defense   devices now include event type identification numbers. Fields with empty or unknown values are no longer included, so messages are shorter and important data is less likely to be truncated. Timestamps now use the ISO 8601 timestamp format as specified in the RFC 5425 syslog format (optional for FTD, required for Classic). Other syslog improvements for FTD devices You can send all syslog messages from the same interface (data or management), using the same IP address, using TCP or UDP protocol. Note that secure syslog is supported on data ports only. You can also use the RFC 5424 format for message timestamps. Supported Platforms:   FTD   Administration and Troubleshooting     HTTPS Certificates  The default HTTPS server certificate provided with the system now expires in three years. If your appliance uses a default server certificate that was generated before you upgraded to Version 6.3, the server certificate will expire 20 years from when it was first generated. If you are using the default HTTPS server certificate the system now provides the ability to renew it. New/Modified Screens:   System  >  Configuration  >  HTTPS Certificate  >  Renew HTTPS Certificate  button New/Modified Classic CLI Commands:   show http-cert-expire-date   ,   system renew-http-cert   new_key Supported Platforms: Physical   FMC s,   7000 and 8000 Series   devices IPv4 range, subnet, and IPv6 support for SNMP hosts You can now use IPv4 range, IPv4 subnet, and IPv6 host network objects to specify the SNMP hosts that can access a   Firepower Threat Defense   device. New/Modified Screens:   Devices   >   Platform Settings   >   create or edit FTD policy   > SNMP > Hosts   tab Supported Platforms:   FTD   Access control using fully qualified domain names (FQDN) You can now create fully qualified domain name (FQDN) network objects and use them in access control and prefilter rules. To use FQDN objects, you must also configure DNS server groups and DNS platform settings, so that the system can resolve the domain names. New/Modified Screens: Objects  >  Object Management  >  Network Objects  >  Object Management  >  DNS Server Group Devices  >  Platform Settings   >  create or edit FTD policy  > DNS Supported Platforms:   FTD CLI for the   FMC    An CLI for the FMC supports a small set of basic commands (change password, show version, reboot/restart, and so on). By default the FMC CLI is disabled, and logging into   FMC   using SSH accesses the Linux shell. New/Modified Classic CLI Commands: The   system lockdown-sensor   command has changed to   system lockdown   . This command now works for both devices and FMCs. New/Modified Screens:   System  >  Configuration  >  Console Configuration  >  Enable CLI Access  check box Supported Platforms:   FMC , including   FMCv Improved login security    Added FMC user configuration settings to improve login security: Track Successful Logins : Track the number of successful logins each   FMC account has performed within a specific time period. Password Reuse Limit : Track an FMC user's password history to prevent reuse. Max Number of Login Failures   and   Set Time in Minutes to Temporarily Lockout Users : Limit the number of times in a row an FMC user can enter incorrect web interface login credentials before being temporarily blocked. New/Modified Screens:   System  >  Configuration   > User Configuration Supported Platforms:   FMC   Limit SSH login failures on devices   When a user accesses any device via SSH and fails three successive login attempts, the device terminates the SSH session. Supported platforms: Managed devices   Copy device configurations You can copy device configurations and policies from one device to another. New/Modified Screens:   Devices  >  Device Management  >  edit the device  > General  area  > Get/Push Device Configuration  icons.   Backup/restore FTD device configurations    You can use the FMC web interface to back up configurations for some FTD devices. New/Modified Screens:   System  >  Tools  >  Backup/Restore New/Modified CLI Commands:   restore Supported Platforms: All physical   FTD   devices,   FTDv   on VMware Skip deploying to up-to-date devices when you schedule deploy tasks When you schedule a task to deploy configuration changes, you can now opt to   Skip Deployment for up-to-date devices . This performance-enhancing setting is enabled by default. The upgrade process automatically enables this option on existing scheduled tasks. To continue to force a scheduled deploy to up-to-date devices, you must edit the scheduled task. New/Modified Screens:   System  >  Tools  >  Scheduling  >  add or edit a task  >  choose  Job Type  of  Deploy Policies New health modules New health modules alert you when: Threat Data Updates on Devices : Threat identification data on managed devices fails to update. Realm : A user is reported to the   FMC   without being downloaded, or a user logs into a domain that corresponds to a realm not known to the   FMC . New/Modified Screens: System > Health > Policy System > Health > Monitor Supported Platforms:   FMC  Configurable packet capture size  You can now store up to 10 GB of packet captures. New/Modified CLI Commands:   file-size   ,   show capture Supported Platforms: Firepower 4100/9300  Firepower Management Center REST API             New objects     The FMC REST API supports new objects for site-to-site VPN topology and HA device failover. New objects for site-to-site VPN topology: ftds2svpns, endpoints, ipsecsettings, advancedsettings, ikesettings, ikev1ipsecproposals, ikev1policies, ikev2ipsecproposals, ikev2policies New objects for HA device failover: failoverinterfacemacaddressconfigs, monitoredinterfaces Bulk overrides   You can now perform bulk overrides on specific objects. For a full list, see the   Cisco Firepower Management Center REST API Quick Start Guide .    New Features in Firepower Device Manager/ FTD  Version 6.3.0   The following table lists the new features available in  FTD  6.3.0 when configured using Firepower Device Manager:   Features Description High availability configuration.   You can configure two devices as an active/standby high availability pair. A high availability or failover setup joins two devices so that if the primary device fails, the secondary device can take over. This helps you keep your network operational in case of device failure. The devices must be of the same model, with the same number and type of interfaces, and they must run the same software version. You can configure high availability from the  Device  page. Support for passive user identity acquisition.   You can configure identity policies to use passive authentication. Passive authentication gathers user identity without prompting the user for username and password. The system obtains the mappings from the identity sources you specify, which can be Cisco Identity Services Engine (ISE)/Cisco Identity Services Engine Passive Identity Connector (ISE PIC), or logins from remote access VPN users. Changes include supporting passive authentication rules in  Policies  >  Identity , and ISE configuration in  Objects  >  Identity Sources . Local user support for remote access VPN and user identity.   You can now create users directly through Firepower Device Manager. You can then use these local user accounts to authenticate connections to a remote access VPN. You can use the local user database as either the primary or fallback authentication source. In addition, you can configure passive authentication rules in the identity policy so that local usernames are reflected in the dashboards and so they are available for traffic matching in policies. We added the  Objects  >  Users  page, and updated the remote access VPN wizard to include a fallback option. Changed default behavior for VPN traffic handling in the access control policy ( sysopt connection permit-vpn  ). The default behavior for how VPN traffic is handled by the access control policy has changed. Starting in 6.3, the default is that all VPN traffic will be processed by the access control policy. This allows you to apply advanced inspections, including URL filtering, intrusion protection, and file policies, to VPN traffic. You must configure access control rules to allow VPN traffic. Alternatively, you can use FlexConfig to configure the  sysopt connection permit-vpn  command, which tells the system to bypass the access control policy (and any advanced inspections) for VPN-terminated traffic Support for FQDN-based network objects and data interface support for DNS lookup. You can now create network objects (and groups) that specify a host by fully-qualified domain name (FQDN) rather than a static IP address. The system looks up the FQDN-to-IP address mapping periodically for any FQDN object that is used in an access control rule. You can use these objects in access control rules only.   We added the DNS Group object to the objects page, changed the  System Settings  >  DNS Server  page to allow group assignment to data interfaces, and the access control rule to allow for FQDN network object selection. In addition, the DNS configuration for the management interface now uses DNS groups instead of a set list of DNS server addresses. Support for TCP syslog and the ability to send diagnostic syslog messages through the management interface. In previous releases, diagnostic syslog messages (as opposed to connection and intrusion messages) always used a data interface. You can now configure syslog so that all messages use the management interface. The ultimate source IP address depends on whether you use the data interfaces as the gateway for the management interface, in which case the IP address will be the one from the data interface. You can also configure syslog to use TCP instead of UDP as the protocol.   We made changes to the Add/Edit dialog box for syslog servers from  Objects  >  Syslog Servers . External Authentication and Authorization using RADIUS for Firepower Device Manager Users. You can use an external RADIUS server to authenticate and authorize users logging into Firepower Device Manager. You can give external users administrative, read-write, or read-only access. Firepower Device Manager can support 5 simultaneous logins; the sixth session automatically logs off the oldest session. You can forcefully end a Firepower Device Manager user session if necessary. We added RADIUS server and RADIUS server group objects to the  Objects  >  Identity Sources  page for configuring the objects. We added the  AAA Configuration  tab to  Device  >  System Settings  >  Management Access , for enabling use of the server groups. In addition, the  Monitoring  >  Sessions  page lists the active users and lets an administrative user end a session. Pending changes view and deployment improvements The deployment window has changed to provide a clearer view of the pending changes that will be deployed. In addition, you now have the option to discard changes, copy changes to the clipboard, and download changes in a YAML formatted file. You can also name deployment jobs so they are easier to find in the audit log. Audit Log    You can view an audit log that records events such as deployments, system tasks, configuration changes, and administrative user login and logout. We added the  Device  >  Device Administration  >  Audit Log page.   Ability to export the configuration You can download a copy of the device configuration for record keeping purposes. However, you cannot import this configuration into a device. This feature is not a replacement for backup/restore. We added the  Device  >  Device Administration  >  Download Configuration  page. Improvements to URL filtering for unknown URLs.      If you perform category-based URL filtering in access control rules, users might access URLs whose category and reputation are not defined in the URL database. Previously, you needed to manually enable the option to look up the category and reputation for these URLs from Cisco Collective Security Intelligence (CSI). Now, that option is enabled by default. In addition, you can now set the time-to-live (TTL) for the lookup results, so that the system can refresh the category/reputation for each unknown URL. We updated the  Device  >  System Settings  >  URL Filtering Preferences  page.  Security Intelligence logging is now enabled by default The Security Intelligence policy was introduced in 6.2.3, with logging disabled by default. Starting with 6.3.0, logging is enabled by default. If you upgrade from 6.2.3, your logging settings are preserved, either enabled or disabled. Enable logging if you want to see the results of policy enforcement. Passive mode interfaces     You can configure an interface in passive mode. When acting passively, the interface simply monitors the traffic from the source ports in a monitoring session configured on the switch itself (for hardware devices) or on the promiscuous VLAN (for  Firepower Threat Defense Virtual ). You can use passive mode to evaluate how the  Firepower Threat Defense Virtual  device would behave if you deployed it as an active firewall. You can also use passive interfaces in a production network if you need IDS (intrusion detection system) services, where you want to know about threats, but you do not want the device to actively prevent the threats. You can select passive mode when editing physical interfaces and when you create security zones. Smart CLI enhancements for OSPF, and support for BGP.     The Smart CLI OSPF configuration has been enhanced, including new Smart CLI object types for standard and extended ACLs, route maps, AS Path objects, IPv4 and IPv6 prefix lists, policy lists, and standard and expanded community lists. In addition, you can now use Smart CLI to configure BGP routing. You can find these features on the  Device  >  Advanced Configuration  page. Enhancements for ISA 3000 devices     You can now configure the following features for the ISA 3000: alarms, hardware bypass, and backup and restore using the SD card. You use FlexConfig to configure the alarms and hardware bypass. For the SD card, we updated the backup/restore pages in Firepower Device Manager.   Support for ASA 5506-X, 5506W-X, 5506H-X, and 5512-X removed starting with  FTD  6.3     You cannot install Firepower Threat Defense 6.3 or subsequent releases on the ASA 5506-X, 5506W-X, 5506H-X, and 5512-X. The final supported  FTD  release for these platforms is 6.2.3.   FTD  REST API version 2 (v2).   The  FTD  REST API for software version 6.3 has been incremented to version 2. You must replace v1 in the API URLs with v2. The v2 API includes many new resources that cover all features added in software version 6.3. Please re-evaluate all existing calls, as changes might have been mode to the resource models you are using. To open the API Explorer, where you can view the resources, change the end of the Firepower Device Manager URL to  /#/api-explorer  after logging in. Web analytics for providing product usage information to Cisco.     You can enable web analytics, which provides anonymous product usage information to Cisco based on page hits. This information can help Cisco determine feature usage patterns and help Cisco improve the product. All usage data is anonymous and no sensitive data is transmitted. Web analytics is enabled by default. We added Web Analytics to the  Device  >  System Settings  >  Cloud Services  page. Installing a Vulnerability Database (VDB) update no longer restarts Snort.  When you install a VDB update, the installation itself no longer restarts Snort. However, Snort continues to restart during the next configuration deployment. Deploying an Intrusion Rules (SRU) database update no longer restarts Snort. After you install an intrusion rules (SRU) update, you must deploy the configuration to activate the new rules. The deployment of the SRU update no longer causes a Snort restart.   For more information refer to the Firepower 6.3 release notes.                                             ... View more

Cisco announces the availability of ASA 9.10(1):   New features in this release: Feature Description Platform Features ASAv VHD custom images for Azure You can now create your own custom ASAv images on Azure using a compressed VHD image available from Cisco. To deploy using a VHD image, you upload the VHD image to your Azure storage account. Then, you can create a managed image using the uploaded disk image and an Azure Resource Manager template. Azure templates are JSON files that contain resource descriptions and parameter definitions. ISA 3000 support for FirePOWER module Version 6.3 The previous supported version was FirePOWER 5.4. Firewall Features Feature Description Cisco Umbrella support You can configure the device to redirect DNS requests to Cisco Umbrella, so that your Enterprise Security policy defined in Cisco Umbrella can be applied to user connections. You can allow or block connections based on FQDN, or for suspicious FQDNs, you can redirect the user to the Cisco Umbrella intelligent proxy, which can perform URL filtering. The Umbrella configuration is part of the DNS inspection policy. New/Modified commands: umbrella, umbrella-global, token, public-key, timeout edns, dnscrypt, show  service-policy  inspect  dns   detail GTP inspection enhancements for MSISDN and Selection Mode filtering, anti-replay, and user spoofing protection You can now configure GTP inspection to drop Create PDP Context messages based on Mobile Station International Subscriber Directory Number (MSISDN) or Selection Mode. You can also implement anti-replay and user spoofing protection. New/Modified commands: anti-replay, gtp-u-header-check, match msisdn, match selection-mode Default idle timeout for TCP state bypass The default idle timeout for TCP state bypass connections is now 2 minutes instead of 1 hour. Support for removing the logout button from the cut-through proxy login page If you configure the cut-through proxy to obtain user identity information (the AAA authentication listener), you can now remove the logout button from the page. This is useful in case where users connect from behind a NAT device and cannot be distinguished by IP address. When one user logs out, it logs out all users of the IP address. New/Modified commands: aaa  authentication  listener   no-logout-button Also in 9.8(3). Trustsec SXP connection configurable delete hold down timer The default SXP connection hold down timer is 120 seconds. You can now configure this timer, between 120 to 64000 seconds. New/Modified commands: cts sxp delete-hold-down period, show cts sxp connection brief, show cts sxp connections Also in 9.8(3). Support for offloading NAT'ed flows in transparent mode. If you are using flow offload (the flow-offload enable and set connection advanced-options flow-offload commands), offloaded flows can now include flows that require NAT in transparent mode. Support for transparent mode deployment for a Firepower 4100/9300 ASA logical device You can now specify transparent or routed mode when you deploy the ASA on a Firepower 4100/9300. New/Modified FXOS commands: enter bootstrap-key FIREWALL_MODE, set value routed, set value transparent VPN Features  Feature Description Support for legacy SAML authentication If you deploy an ASA with the fix for CSCvg65072 , then the default SAML behavior is to use the embedded browser, which is not supported on AnyConnect 4.4 or 4.5. Therefore, to continue to use AnyConnect 4.4 or 4.5, you must enable the legacy external browser SAML authentication method. Because of security limitations, use this option only as part of a temporary plan to migrate to AnyConnect 4.6 (or later). This option will be deprecated in the near future. New/Modified commands: saml external-browser Also in 9.8(3). DTLS 1.2 support for AnyConnect VPN remote access connections. DTLS 1.2, as defined in RFC- 6347, is now supported for AnyConnect remote access in addition to the currently supported DTLS 1.0 (1.1 version number is not used for DTLS.) This applies to all ASA models except the 5506; and applies when the ASA is acting as a server only, not a client. DTLS 1.2 supports additional ciphers, as well as all current TLS/DTLS cyphers, and a larger cookie size. New/Modified commands: show run ssl, show vpn-sessiondb detail anyconnectssl cipher, ssl server-version High Availability and Scalability Features Cluster control link customizable IP Address for the Firepower 4100/9300 By default, the cluster control link uses the 127.2.0.0/16 network. You can now set the network when you deploy the cluster in FXOS. The chassis auto-generates the cluster control link interface IP address for each unit based on the chassis ID and slot ID: 127.2.chassis_id.slot_id. However, some networking deployments do not allow 127.2.0.0/16 traffic to pass. Therefore, you can now set a custom /16 subnet for the cluster control link in FXOS except for loopback (127.0.0.0/8) and multicast (224.0.0.0/4) addresses. New/Modified FXOS commands: set cluster-control-link network Parallel joining of cluster units per Firepower 9300 chassis For the Firepower 9300, this feature ensures that the security modules in a chassis join the cluster simultaneously, so that traffic is evenly distributed between the modules. If a module joins very much in advance of other modules, it can receive more traffic than desired, because the other modules cannot yet share the load. New/Modified commands: unit parallel-join Cluster interface debounce time now applies to interfaces changing from a down state to an up state When an interface status update occurs, the ASA waits the number of milliseconds specified in the health-check monitor-interface debounce-time command or the ASDM Configuration > Device Management > High Availability and Scalability > ASA Cluster screen before marking the interface as failed and the unit is removed from the cluster. This feature now applies to interfaces changing from a down state to an up state. For example, in the case of an EtherChannel that transitions from a down state to an up state (for example, the switch reloaded, or the switch enabled an EtherChannel), a longer debounce time can prevent the interface from appearing to be failed on a cluster unit just because another cluster unit was faster at bundling the ports. We did not modify any commands. Active/Backup High Availability for ASAv on Microsoft Azure Government Cloud The stateless Active/Backup solution that allows for a failure of the active ASAv to trigger an automatic failover of the system to the backup ASAv in the Microsoft Azure public cloud is now available in the Azure Government Cloud. New or modified command: failover cloud Monitoring > Properties > Failover > Status Monitoring > Properties > Failover > History Interface Features show interface ip brief and show ipv6 interface output enhancement to show the supervisor association for the Firepower 2100/4100/9300 For the Firepower 2100/4100/9300, the output of the command is enhanced to indicate the supervisor association status of the interfaces. New/Modified commands: show interface ip brief, show ipv6 interface The set lacp-mode command was changed to set port-channel-mode on the Firepower 2100 The set lacp-mode command was changed to set port-channel-mode to match the command usage in the Firepower 4100/9300. New/Modified FXOS commands: set port-channel-mode Administrative and Troubleshooting Features Support for NTP Authentication on the Firepower 2100 You can now configure SHA1 NTP server authentication in FXOS. New/Modified FXOS commands: enable ntp-authentication, set ntp-sha1-key-id, set ntp-sha1-key-string New/Modified Firepower Chassis Manager screens: Platform Settings > NTP New/Modified options: NTP Server Authentication: Enable check box, Authentication Key field, Authentication Value field Packet capture support for matching IPv6 traffic without using an ACL If you use the match keyword for the capture command, the any keyword only matches IPv4 traffic. You can now specify any4 and any6 keywords to capture either IPv4 or IPv6 traffic. The any keyword continues to match only IPv4 traffic. New/Modified commands: capture match Support for public key authentication for SSH to FXOS on the Firepower 2100 You can set the SSH key so you can use public key authentication instead of/as well as password authentication. New/Modified FXOS commands: set sshkey Support for GRE and IPinIP encapsulation When you do a packet capture on interface inside, the output of the command is enhanced to display the GRE and IPinIP encapsulation on ICMP, UDP, TCP, and others. New/Modified commands: show capture Support to enable memory threshold that restricts application cache allocations You can restrict application cache allocations on reaching certain memory threshold so that there is a reservation of memory to maintain stability and manageability of the device. New/Modified commands: memory threshold enable, show run memory threshold,clear conf memory threshold Support for RFC 5424 logging timestamp You can enable the logging timestamp as per RFC 5424 format. New/Modified command: logging timestamp Support to display memory usage of TCB-IPS Shows application level memory cache for TCB-IPS New/Modified command: show memory app-cache   Related Documents: CLI Configuration General Operations CLI Configuration—Cisco ASA Series General Operations CLI Configuration Guide, 9.10 Firewall CLI Configuration—Cisco ASA Series Firewall CLI Configuration Guide, 9.10 VPN CLI Configuration—Cisco ASA Series VPN CLI Configuration Guide, 9.10 ASDM Configuration General Operations ASDM Configuration—Cisco ASA Series General Operations ASDM Configuration Guide, 7.10 Firewall ASDM Configuration—Cisco ASA Series Firewall ASDM Configuration Guide, 7.10 VPN ASDM Configuration—Cisco ASA Series VPN ASDM Configuration Guide, 7.10 ... View more

The Cisco ASA provides advanced stateful firewall and VPN concentrator functionality. It has long been the industry standard for firewalls. For more information on this product, see   http:/​/​www.cisco.com/​go/​asa. Firepower Threat Defense  provides unified next-generation firewall and next-generation IPS functionality. In addition to the IPS features available on Firepower Software models, firewall and platform features include Site-to-Site VPN, robust routing, NAT, clustering, and other optimizations in application visibility and access control.   Firepower Threat Defense   also supports Advanced Malware Protection (AMP) and URL filtering. For more information on this product, see   http:/​/​www.cisco.com/​go/​ngfw. Cisco's Migration Tool allows you to convert specific features in an ASA configuration to the equivalent features in an   Firepower Threat Defense   configuration using the easy to use wizard based Migration Tool. Download the Migration Tool here . Release notes here. ... View more

The Cisco vulnerability database (VDB) is a database of known vulnerabilities to which hosts may be susceptible, as well as fingerprints for operating systems, clients, and applications. The system uses the VDB to help determine whether a particular host increases your risk of compromise. The Cisco Talos Security Intelligence and Research Group (Talos) issues periodic updates to the VDB.   The Cisco Firepower Application Detector Reference contains the release notes and information about the application detectors supported in the VDB release. For each application listed in the reference, you can find the following information: Description—A brief description of the application. Categories—A general classification for the application that describes its most essential function. Example categories include web services provider, e-commerce, ad portal, and social networking. Tags—Predefined tags that provide additional information about the application. Example tags include webmail, SSL protocol, file sharing/transfer, and displays ads. An application can have zero, one, or more tags. Risk—The likelihood that the application is used for purposes that might be against your organisation’s security policy. The risk levels are Very High, High, Medium, Low, and Very Low. Business Relevance—The likelihood that the application is used within the context of your organisation’s business operations, as opposed to recreationally. The relevance levels are Very High, High, Medium, Low, and Very Low. See the Cisco Firepower Application Detector Reference for each listed VDB Release here:  Cisco Vulnerability Database Library for Firepower System. You can request a new application detector by opening a support case.   You can also build your own app detector; for more information, see Application Detection in the Firepower Management Center Config Guide. ... View more

Cisco TMEs Goran and Minako run you through a short lab with exercises across Enabling Cisco Advanced Security in Cisco APIC. the exercise include: Connect and run scripts to build out your tenant with security services Change FTD service graph to unmanaged mode, and use device package manually to provision the same configuration to the FTD Change FTDv to EPG-attached NGFW service with no contract Apply malware protection to FTDv service graph on app-to-db contract Run Rapid Threat Containment with APIC Firepower remediation package Enable dynamic update to EPG feature on out-to-web contract Study the mechanics and benefits of the ASA PBR service graph Watch this lab session and several more on the Cisco Security TME YouTube channel. ... View more

Cisco's video portal hosts an extensive selection of  Cisco videos. Among other things, you have videos by Cisco experts on a variety of our products. Our experts introduce you to our product portfolio, walk you through product 101s, give you a peek into deployment designs etc. On the Portal home page, click Products > Security to access all the videos in the Security product portfolio. Enter the product keyword in the Search bar: Firepower, NGFW, Firepower Management Center, Threat Defense are all valid keywords. Choose from the selection of videos that appear. Recommended for your viewing : NGFW Demo and the FMC 101 ... View more

Official Firepower 6.2.3 Release Notes New Features in Firepower Management Center/Firepower Version 6.2.3 The following table lists the new features available in Firepower Version 6.2.3 when configured using a Firepower Management Center. Feature Description Firepower Management Center High Availability Messaging The Firepower Management Center high availability pairs have improved UI messaging. The UI now displays interim status messages while Firepower Management Center pairs are being established and rephrased UI messaging to be more intuitive. Firepower Threat Defense High Availability Hardening Version 6.2.3 introduces the following features for Firepower Threat Defense devices in high availability: Whenever active or standby Firepower Threat Defense devices in a high availability pair restart, the Firepower Management Center may not display accurate high availability status for either managed device. However, the status may not upgrade on the Firepower Management Center because the communication between the Firepower Threat Defense and the Firepower Management Center is not established yet. The Refresh Node Status option on the Devices > Device Management page allows you to refresh the high availability node status to obtain accurate information about the active and standby device in a high availability pair. The Devices > Device Management page of the Firepower Management Center UI has a new Switch Active Peer icon. Version 6.2.3 includes a new REST API object, Device High Availability Pair Services , that contains four functions: DELETE ftddevicehapairs PUT ftddevicehapairs POST ftddevicehapairs GET ftddevicehapairs Firepower Management Center REST API Improvements The new Firepower Management Center REST APIs support the use of CRUD (create, retrieve, upgrade, and delete) operations for NAT rules, static routing configuration, and corresponding objects while migrating from ASA FirePOWER to Firepower Threat Defense. Newly introduced APIs for NAT: NAT rules Firepower Threat Defense NAT policies Auto NAT rules Manual NAT rules When deploying Firepower Threat Defense devices in Cisco ACI, APIs enable APIC controller to add proper static routes in place, along with other configuration settings that are needed for a particular service graph. It also enables PBR service graph insertion, which is currently the most flexible way of inserting Firepower Threat Defense in ACI. Newly introduced APIs for Static Route: IPv4 static routes IPv6 static routes SLA monitors Upgrade Package Push You can now copy (or push) an upgrade package from the Firepower Management Center to a managed device before you run the actual upgrade. This is useful because you can push during times of low bandwidth use, outside of the upgrade maintenance window. When you push to high availability, clustered, or stacked devices, the system sends the upgrade package to the active/master/primary first, then to the standby/slave/secondary. New/Modified screens: System > Updates SSL Hardware Acceleration Certain Firepower managed device models support SSL encryption and decryption acceleration in hardware, greatly improving performance. SSL hardware acceleration is disabled by default for all appliances that support it. The following hardware models support SSL acceleration: Firepower 9300 Series Cisco Firepower 4100 series Cisco Success Network Cisco Success Network enablement provides usage information and statistics to Cisco which are essential for Cisco to help improve the product and provide effective technical support. Web Analytics Tracking By default, in order to improve Firepower products, Cisco collects non-personally-identifiable usage data, including but not limited to pages viewed, the time spent on a page, browser versions, product versions, user location, and management IP addresses or hostnames of your Firepower Management Center appliances. You can opt out of this tracking on the System > Configuration page. Support for VMware ESXi 6.5 Firepower Threat Defense Virtual, Firepower Management Center Virtual, and Firepower NGIPS Virtual are now supported on VMware ESXi 6.5. Firepower Threat Defense Support on ISA3000 You can now run Firepower Threat Defense on the ISA 3000 series, using either the Firepower Device Manager or Firepower Management Center for management. Note that the ISA 3000 supports the Threat license only. It does not support the URL Filtering or Malware licenses. Thus, you cannot configure features that require the URL Filtering or Malware licenses on an ISA 3000. Special features for the ISA 3000 that were supported with the ASA, such as Hardware Bypass, Alarm ports, and so on, are not supported with Firepower Threat Defense in this release. Firepower Threat Defense Serviceability Version 6.2.3 improves the show fail over CLI command. The new keyword, -history , details to help troubleshooting. Show fail over history displays failure reason along with its specific details. Show fail over history details displays fail over history from the peer unit. Note   This command includes fail over state changes and the reason for the state change for the peer unit. Firepower Threat Defense VPN Improvement Non-blocking work flow for certificate enrollment operation allows certificate enrollment on multiple Firepower Threat Defense devices in parallel: The administrator can now choose to have the Remote Access VPN Policy wizard enroll certificates for all devices in the policy by checking Enroll the selected certificate object on the target devices check box in the Access & Certificate step. If this is chosen, only deployment needs to be done after the wizard finishes. This is selected by default. Administrators no longer have to initiate Remote Access VPN certificate enrollment on devices one at a time. The enrollment process for each device is now independent and can be done in parallel. In the event of a PKS12 certificate enrollment failure, the administrator no longer needs to re-upload the PKS12 file again to retry enrollment, since it is now stored in the certificate enrollment object. Automatically rejoin the Firepower Threat Defense cluster after an internal failure Formerly, many internal error conditions caused a cluster unit to be removed from the cluster, and you were required to manually rejoin the cluster after resolving the issue. Now, a unit will attempt to rejoin the cluster automatically at the following intervals: 5 minutes, 10 minutes, and then 20 minutes. Internal failures include: application sync timeout; inconsistent application statuses; and so on. New/Modified command: show cluster info auto-join Supported platforms: Firepower Threat Defense on the Firepower 4100 Firepower Threat Defense on the Firepower 9300 Cluster Control Available in FXOS By default, the cluster control link uses the 127.2.0.0/16 subnet. Each unit receives an auto-generated address based on the chassis and slot number. For example, for chassis ID 1, slot 1, the Firepower chassis assigns 127.2. 1.1 . However, some networking deployments do not allow 127.2.0.0/16 traffic to pass. Therefore, you can now set a custom /16 subnet for the cluster control link in FXOS; the same auto-generation is used for each unit IP address. New/Modified FXOS command: set ccl subnet New/Modified Firepower Chassis Management screen: Logical Devices > Add Device Supported Platforms: Firepower Threat Defense on the Firepower 4100 Firepower Threat Defense on the Firepower 9300 External Authentication added for Firepower Threat Defense SSH Access You can now configure external authentication for SSH access to the Firepower Threat Defense using LDAP or RADIUS. New/Modified screen: Devices > Platform Settings > External Authentication Supported platforms: Firepower Threat Defense Enhanced Vulnerability Database (VDB) Installation The Firepower Management Center now warns you before you install a VDB that installing restarts the Snort process, interrupting traffic inspection and, depending on how the managed device handles traffic, possibly interrupting traffic flow. You can cancel the install until a more convenient time, such as during a maintenance window. These warnings can appear: After you download and manually install a VDB. When you create a scheduled task to install the VDB. When the VDB installs in the background, such as during a previously scheduled task or as part of a Firepower software upgrade. Policy Deploy Restart Improvements As an enhancement in Version 6.2.3, the configurations that restart the Snort process have been reduced. For Firepower Threat Defense devices, the managing UI now warns you before you deploy if the configuration deployment restarts the Snort process, interrupting traffic inspection and, depending on how the managed device handles traffic, possibly interrupting traffic flow. Traffic Drop on Policy Apply Version 6.2.3 adds the configure snort preserve-connection {enable | disable} command to the Firepower Threat Defense CLI. This command determines whether to preserve existing connections on routed and transparent interfaces if the Snort process goes down. When disabled, all new or existing connections are dropped when Snort goes down and remain dropped until Snort resume. When enabled, connections that were already allowed remain established, but new connections cannot be established until Snort is again available. Note that you cannot permanently disable this command on a Firepower Threat Defense device managed by Firepower Device Manager ; existing connections may drop when the settings revert to default during the next configuration deployment. New Features in Firepower Device Manager/ Firepower Threat Defense Version 6.2.3 The following table lists the new features available in Firepower Threat Defense 6.2.3 when configured using Firepower Device Manager. Feature Description SSL/TLS Decryption You can decrypt SSL/TLS connections so that you can inspect the contents of the connection. Without decryption, encrypted connections cannot be effectively inspected to identify intrusion and malware threats, or to enforce compliance with your URL and application usage polices. We added the Policies > SSL Decryption page and Monitoring > SSL Decryption dashboard. Attention: Identity policies that implement active authentication automatically generate SSL decryption rules. If you upgrade from a release that does not support SSL decryption, the SSL decryption policy is automatically enabled if you have this type of rule. However, you must specify the certificate to use for Decrypt-Resign rules after completing the upgrade. Please edit the SSL decryption settings immediately after upgrade. Security Intelligence Blacklisting From the new Policies > Security Intelligence page you can configure a Security Intelligence policy, which you can use to drop unwanted traffic based on source/destination IP address or destination URL. Any allowed connections will still be evaluated by access control policies and might eventually be dropped. You must enable the Threat license to use Security Intelligence. We also renamed the Policies dashboard to Access And SI Rules , and the dashboard now includes Security Intelligence rule-equivalents as well as access rules. Intrusion Rule Tuning You can change the action for intrusion rules within the pre-defined intrusion policies you apply with your access control rules. You can configure each rule to drop or generate events (alert) matching traffic, or disable the rule. You can change the action for enabled rules only (those set to drop or alert); you cannot enable a rule that is disabled by default. To tune intrusion rules, choose Policies > Intrusion . Automatic Network Analysis Policy (NAP) Assignment based on Intrusion Policy In previous releases, the Balanced Security and Connectivity network analysis policy was always used for preprocessor settings, regardless of the intrusion policy assigned to a specific source/destination security zone and network object combination. Now, the system automatically generates NAP rules to assign the same-named NAP and intrusion policies to traffic based on those criteria. Note that if you use Layer 4 or 7 criteria to assign different intrusion policies to traffic that otherwise matches the same source/destination security zone and network object, you will not get perfectly matching NAP and intrusion policies. You cannot create custom network analysis policies. Drill-down reports for the Threats, Attackers, and Targets dashboards You can now click into the Threats, Attackers, and Targets dashboards to view more detail about the reported items. These dashboards are available on the Monitoring page. Because of these new reports, you will lose reporting data for these dashboards when upgrading from a pre-6.2.3 release. Web Applications Dashboard The new Web Applications dashboard shows the top web applications, such as Google, that are being used in the network. This dashboard augments the Applications dashboard, which provides protocol-oriented information, such as HTTP usage. New Zones dashboard replaces the Ingress Zone and Egress Zone dashboards. The new Zones dashboard shows the top security zone pairs for traffic entering and then exiting the device. This dashboard replaces the separate dashboards for Ingress and Egress zones. New Malware Dashboard The new Malware dashboard shows the top Malware action and disposition combinations. You can drill down to see information on the associated file types. You must configure file policies on access rules to see this information. Self-signed internal certificates, and Internal CA certificates You can now generate self-signed internal identity certificates. You can also upload or generate self-signed internal CA certificates for use with SSL decryption policies. Configure these features on the Objects > Certificates page. Ability to edit DHCP server settings when editing interface properties You can now edit settings for a DHCP server configured on an interface at the same time you edit the interface properties. This makes it easy to redefine the DHCP address pool if you need to change the interface IP address to a different subnet. The Cisco Success Network sends usage and statistics data to Cisco to improve the product and provide effective technical support You can connect to the Cisco Success Network to send data to Cisco. By enabling Cisco Success Network, you are providing usage information and statistics to Cisco which are essential for Cisco to provide you with technical support. This information also allows Cisco to improve the product and to make you aware of unused available features so that you can maximize the value of the product in your network. You can enable the connection when you register the device with the Cisco Smart Software Manager, or later at your choice. You can disable the connection at any time. Cisco Success Network is a cloud service. The Device > System Settings > Cloud Management page is renamed Cloud Services . You can configure Cisco Defense Orchestrator from the same page. Firepower Threat Defense Virtual for Kernel-based Virtual Machine (KVM) hypervisor device configuration You can configure Firepower Threat Defense on Firepower Threat Defense Virtual for KVM devices using Firepower Device Manager. Previously, only VMware was supported. Note   You must install a new 6.2.3 image to get Firepower Device Manager support. You cannot upgrade an existing virtual machine from an older version and then switch to Firepower Device Manager. ISA 3000 (Cisco 3000 Series Industrial Security Appliances) device configuration You can configure Firepower Threat Defense on ISA 3000 devices using Firepower Device Manager. Note that the ISA 3000 supports the Threat license only. It does not support the URL Filtering or Malware licenses. Thus, you cannot configure features that require the URL Filtering or Malware licenses on an ISA 3000. Optional deployment on update of the rules database or VDB When you update the intrusion rules database or VDB, or configure an update schedule, you can prevent the immediate deployment of the update. Because the update restarts the inspection engines, there is a momentary traffic drop during the deployment. By not deploying automatically, you can choose to initiate the deployment at a time when traffic drops will be least disruptive. Note   A VDB download can also restart Snort all by itself, and then again cause a restart on deployment. You cannot stop the restart on download. Improved messages that indicate whether a deployment restarts Snort. Also, a reduced need to restart Snort on deployment Before you start a deployment, Firepower Device Manager indicates whether the configuration updates require a Snort restart. Snort restarts result in the momentary dropping of traffic. Thus, you now know whether a deployment will not impact traffic and can be done immediately, or will impact traffic, so that you can deploy at a less disruptive time. In addition, in prior releases, Snort restarted on every deployment. Now, Snort restarts for the following reasons only: you enable or disable SSL decryption policies an updated rules database or VDB was downloaded you changed the MTU on one or more physical interface (but not subinterface) CLI console in Firepower Device Manager You can now open a CLI Console from Firepower Device Manager. The CLI Console mimics an SSH or console session, but allows a subset of commands only: show , ping , traceroute , and packet-tracer . Use the CLI Console for troubleshooting and device monitoring. Support for blocking access to the management address You can now remove all management access list entries for a protocol to prevent access to the management IP address. Previously, if you removed all entries, the system defaulted to allowing access from all client IP addresses. On upgrade to 6.2.3, if you previously had an empty management access list for a protocol (HTTPS or SSH), the system creates the default allow rule for all IP addresses. You can then delete these rules as needed. In addition, Firepower Device Manager will recognize changes you make to the management access list from the CLI, including if you disable SSH or HTTPS access. Ensure that you enable HTTPS access for at least one interface, or you will not be able to configure and manage the device. Smart CLI and FlexConfig for configuring features using the device CLI Smart CLI and FlexConfig allows you to configure features that are not yet directly supported through Firepower Device Manager policies and settings. Firepower Threat Defense uses ASA configuration commands to implement some features. If you are a knowledgeable and expert user of ASA configuration commands, you can configure these features on the device using the following methods: Smart CLI—(Preferred method.) A Smart CLI template is a pre-defined template for a particular feature. All of the commands needed for the feature are provided, and you simply need to select values for variables. The system validates your selection, so that you are more likely to configure a feature correctly. If a Smart CLI template exists for the feature you want, you must use this method. In this release, you can configure OSPFv2 using the Smart CLI. FlexConfig—The FlexConfig policy is a collection of FlexConfig objects. The FlexConfig objects are more free-form than Smart CLI templates, and the system does no CLI, variable, or data validation. You must know ASA configuration commands and follow the ASA configuration guides to create a valid sequence of commands. Caution   Cisco strongly recommends using Smart CLI and FlexConfig only if you are an advanced user with a strong ASA background and at your own risk. You may configure any commands that are not blacklisted. Enabling features through Smart CLI or FlexConfig may cause unintended results with other configured features. Firepower Threat Defense REST API, and an API Explorer You can use a REST API to programmatically interact with a Firepower Threat Defense device that you are managing locally through Firepower Device Manager. There is an API Explorer that you can use to view object models and test the various calls you can make from a client program. To open the API Explorer, log into Firepower Device Manager, and then change the path on the URL to /#/api-explorer, for example, https://ftd.example.com/#/api-explorer . ... View more

Cisco Live is not just Cisco's annual customer conference, where partners and customers learn new technologies, discuss business trends, share ideas and network. It is also the industry's premier education and training event for IT, networking, and communications professionals. You can register for free to use the Cisco Live On-demand Library to access these really cool  Next Generation Firewall session videos and presentations . Take a look at these: A Deep Dive into using the Firepower Manager: The Firepower Manager  is the beating heart of leveraging a Next Generation security architecture. However, most users only leverage the smallest capabilities as an event viewer and policy manager. This session takes a deeper-dive into how the Firepower Manager works and can significantly improve your security and business capabilities. This session examines how the system actually reduces the amount of time required to respond to events, how to create your own custom correlations to monitor for indications of compromise that are unique to your network, how to automate security response and integrate Cisco technologies with the rest of your security framework, and how to maximise reporting to demonstrate security effectiveness and the value you bring to your business. Firepower Threat Defence: Advanced Capabilities, Deployment and Troubleshooting Options: This session captures the capabilities of Firepower Threat Defence that make it an extremely capable Next Generation Firewall. The session will help you look under the hood and learn more about the advanced features available on Firepower Threat Defence. In addition to providing some recommendations around the best practices while using these features, the session will also help you understand the best deployment options to effectively secure your networks. One of the key takeaways will be the understanding of how the various features are brought together and what options are available to you for troubleshooting any problems you may face while deploying Firepower Threat Defence. NGFW Clustering Deep Dive: T his advanced session provides a comprehensive overview of the clustering capability in Adaptive Security Appliance (ASA) and Firepower Threat Defence (FTD) security applications. In addition to the functional deep dive into clustering design and operation, this presentation will discuss specific deployment scenarios and share best practices for a successful deployment of an ASA or FTD cluster. Several case studies involving currently supported network designs as well future plans will be discussed. Familiarity with standalone ASA and FTD capabilities as well as the overall firewall feature set is required. ... View more

If you have questions or want to discuss this content, please ask us by replying to this document or starting a new discussion. Quick Links to NGFW Resources Next Generation Firewalls: Getting Started What is a Firewall? Next Generation Firewall Demo Next-Generation Firewalls at a glance Choosing a Firewall Tips for choosing a Firewall Who is the Competition? Competitive Comparison Case Studies Customer Success Stories Cisco's Next Generation Firewall Resources Next-Generation Firewall Resource Center Release Notes Cisco Firepower Management Center Cisco Firepower eXtensible Operating System Cisco Adaptive Security Appliance Compatibility Information Cisco Firepower Cisco Firepower eXtensible Operating System Cisco Adaptive Security Appliance Navigating the Next Generation Firewall Documentation Set Cisco Firepower Documentation Cisco FXOS Documentation Cisco ASA Series Documentation Next Generation Firewalls: Licensing Cisco Smart Software Licensing Frequently Asked Questions (FAQ) about Firepower Licensing Cisco Firepower System Feature Licenses Next Generation Firewalls: Releases by Platform Hardware   Videos Device Introduction Cisco Firepower 2100 Series Cisco Firepower 9000 Series Cisco ASA with Firepower Services Cisco Firepower Management Center Firepower Design Workshop Playlist Cisco NGFW Design Chalk Talks   Devices Cisco Next Generation Firewall Interactive Library Cisco NGFW 3D Model Library Cisco Next Generation Firewall Hardware Configuration selector helps you find the firewall that works best for your business. Cisco NGFW 3D Configuration Selector Data Sheets Cisco Firepower NGFW Cisco ASA with Firepower Services Cisco Firepower Management Center Hardware Devices Cisco Firepower 2100 Series Cisco Firepower 4100 Series Cisco Firepower 9000 Series Cisco ASA 5500-X with FirePOWER Services Cisco Firepower Management Center   Documentation Hardware Installation Guides Cisco Firepower 2100 Series Cisco Firepower 4100 Series Cisco Firepower 9300 Series Cisco ASA 5506-X, ASA 5506W-X, and ASA 5506H-X Cisco ASA 5508-X and ASA 5516-X Cisco ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X Cisco ASA 5585-X Cisco Firepower Management Center 750, 1500, 2000, 3500, and 4000 Cisco Firepower Management Center 1000, 2500, and 4500   Quick Start Guide/ Getting Started Guides Firepower 2100 Series Cisco Firepower Threat Defense for the Firepower 2100 Series Using Firepower Management Center Cisco Firepower Threat Defense for the Firepower 2100 Series Using Firepower Device Manager Cisco ASA for Firepower 2100 Series   Firepower 4100 Cisco Firepower Threat Defense for Firepower 4100 Cisco ASA for Firepower 4100   Firepower 9300 Cisco Firepower Threat Defense for Firepower 9300 Cisco ASA for Firepower 9300   Adaptive Security Appliance Cisco Firepower Threat Defense for ASA using Firepower Management Center ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X ASA 5506-X Series   Cisco Firepower Threat Defense for ASA Using Firepower Device Manager ASA 5506-X Series ASA 5508-X and 5516-X Series ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X   Cisco ASA with FirePOWER Services ASA 5506-X, ASA 5506W-X, ASA 5506H-X ASA 5508-X and ASA 5516-X ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X   Cisco ASA 5585-X   Firepower Management Center Cisco Firepower Management Center for Models 750, 1500, 2000, 3500, and 4000 Cisco Firepower Management Center for Models 1000, 2500, and 4500   Virtual   Videos Cisco Advanced Security for Private Cloud Playlist Cisco NGFWv and ASAv for Private Cloud Cisco Advanced Security for Public Cloud Playlist Cisco NGFWv and ASAv for Public Cloud   Documentation Virtual Devices – Deployment/ Quick Start Guides Firepower NGFW Virtual (also known as Firepower Threat Defense Virtual device) Cisco Firepower Threat Defense Virtual for the AWS Cloud Cisco Firepower Threat Defense Virtual Using Firepower Device Manager for VMware Cisco Firepower Threat Defense Virtual for KVM Cisco Firepower Threat Defense Virtual for VMware Cisco Firepower Threat Defense Virtual Using Firepower Device Manager for KVM Deployment Quick Start Guide Cisco Firepower Threat Defense Virtual for the Microsoft Azure Cloud   Firepower Management Center Virtual Appliance Cisco Firepower Management Center Virtual for VMware Cisco Firepower Management Center Virtual for the AWS Cloud Cisco Firepower Management Center Virtual for KVM Deployment   Cisco NGIPS Virtual Appliance Cisco Firepower NGIPSv Quick Start Guide for VMware Software   Videos Firepower Management Center Playlist Cisco Firepower Management Center Configuring Firepower Management Center Features Playlist Cisco Firepower Management Center Features Firepower Device Manager Playlist Cisco Firepower Device Manager Firepower eXtensible Operating System Playlist Cisco Firepower FXOS Firepower NGFW platform – FTD Application Cisco Firepower NGFW-FTD Application Firepower NGFW platform – ASA Application Cisco Firepower NGFW-ASA Application Cisco Advanced Security in ACI Integrating ASA, Firepower NGIPS and NGFW into the Application Centric Infrastructure   Documentation Cisco's Vulnerability Database with links to Firepower Application Detector References   Cisco Vulnerability Database Library for Firepower System Cisco Firepower Management Center Configuration Guides 6.4.0 6.3.0 6.2.3 6.2.2 6.2.1 6.2 6.1 6.0.1 6.0 Cisco Firepower Device Manager Configuration Guides 6.4.0 6.3.0 6.2.3 6.2.2 6.2.1 6.2 6.1 Cisco Adaptive Security Appliance Configuration Guides Cisco ASA with FirePOWER Service Local Management Configuration Guide 6.4.0 6.3.0 6.2.3 6.2.2 6.2 6.1 6.0 Cisco ASA 9.10/ASDM 7.10 for Firepower 9300 General Operations CLI Firewall CLI Configuration VPN CLI Configuration General Operations ASDM Configuration Firewall ASDM Configuration VPN ASDM Configuration Cisco ASA 9.9/ASDM 7.9 for Firepower 9300 Configuration Guide General Operations CLI Firewall CLI Configuration VPN CLI Configuration General Operations ASDM Configuration Firewall ASDM Configuration VPN ASDM Configuration   Cisco ASA 9.8/ASDM 7.8 for Firepower 9300 Configuration Guide General Operations CLI Firewall CLI Configuration VPN CLI Configuration General Operations ASDM Configuration Firewall ASDM Configuration VPN ASDM Configuration  Cisco ASA 9.7/ASDM 7.7 for Firepower 9300 Configuration Guide General Operations CLI Configuration Firewall CLI Configuration VPN CLI Configuration General Operations ASDM Configuration Firewall ASDM Configuration VPN ASDM Configuration Cisco ASA 9.6/ASDM 7.6 for Firepower 9300 Configuration Guide General Operations CLI Configuration Firewall CLI Configuration VPN CLI Configuration General Operations ASDM Configuration Firewall ASDM Configuration VPN ASDM Configuration  Cisco ASA 9.5/ASDM 7.5 for Firepower 9300 Configuration Guide General Operations CLI Configuration Firewall CLI Configuration VPN CLI Configuration   Cisco ASA 9.4/ASDM 7.4 for Firepower 9300 Configuration Guide General Operations CLI Configuration Firewall CLI Configuration General Operations ASDM Configuration Firewall ASDM Configuration Guide Cisco FXOS Configuration Guides Cisco FXOS Firepower Chassis Manager Configuration Guide 2.6.1 2.4.1 2.3.1 2.2.2 2.2.1 2.1.1 2.0.1 1.1.4 1.1.3 1.1.2 1.1.1 Cisco FXOS CLI Configuration Guide 2.6.1 2.4.1 2.3.1 2.2.2 2.2.1 2.1.1 2.0.1 1.1.4 1.1.3 1.1.2 1.1.1 Command Reference Guides Cisco Firepower Threat Defense   Cisco Adaptive Security Appliance A - H Commands I - R Commands S Commands T - Z Commands and IOS Commands for the ASASM API Guides REST API Quick Start Guides 6.4.0 6.3.0 6.2.3 6.2.2 6.2.1 6.2 6.1   Firepower Threat Defense REST API Guide   Firepower System Database Access Guides 6.3 6.2 6.1 6.0   Firepower System eStreamer Integration Guides 6.3.0 6.2.3 6.2.2 6.2.1 6.2 6.1 6.0   Firepower System Host Input API Guide v6.0   Firepower System Remediation API Guide v6.0   Cisco FXOS REST API Developer Guide Next Generation Firewalls: Migrating from Adaptive Security Appliance to Firepower Threat Defense Videos Firepower Management Center Migration Tool ASA to FTD Policy Migration Process Documentation Cisco Firewall Migration Options   Migration Tool Migrating ASA to FTD with the Firepower Migration Tool 1.1.0 Migration Tool Release Notes Release Notes 1.1.0 Release Notes 1.0.x Migrating from the Cisco ASA 5500 to the Cisco Adaptive Security Virtual Appliance   (LEGACY) Cisco ASA to Firepower Threat Defense Migration Guide 6.2.2 6.2.1 6.2 Next Generation Firewalls: Upgrade Upgrading the Firepower Management Center Firepower Management Center Upgrade Guide Upgrading the Adaptive Security Appliance (ASA) Cisco ASA Upgrade Guide Reimaging Guide Reimage the Cisco ASA or Firepower Threat Defense Device Next Generation Firewalls: Support, Troubleshooting, Best Practices Syslog Guides Cisco ASA Series Syslog Messages Cisco Firepower Threat Defense Syslog Messages   Troubleshooting guides Cisco Firepower 2100 Series Faults and Error Messages Cisco FXOS Troubleshooting Guide for the Firepower 2100 Series Running Firepower Threat Defense Cisco Firepower eXtensible Operating System Faults and Error Messages 2.4.1 2.3.1 2.2.2 2.2.1 2.1.1 2.0.1 1.1.4 1.1.3 1.1.2 1.1.1 Cisco Firepower eXtensible Operating System Management Information Base (MIB) Reference Cisco FXOS MIB Reference Guide Configuration Examples and Troubleshooting Technotes Configuration Examples and TechNotes Troubleshooting TechNotes – Firepower Management Center Troubleshooting TechNotes - FirePOWER Service, FireSIGHT System, and AMP Recommendations and common practices for the policy and device management in Cisco Firepower Threat Defense Cisco Firepower Threat Defense (FTD) Common Practices Guide Best Practices and Troubleshooting guide for practical knowledge on Cisco Firepower Next Generation Security Technologies. Configuration and Troubleshooting Best Practices for the Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Advanced Malware Protection (AMP), (Author: Nazmul Rajib, ISBN: 9781587144806)     Next Generation Firewalls: YouTube and Social Media YouTube Cisco Security TME Managing Cisco Advanced Security Securing Networks with Cisco Firepower Threat Defense Cisco’s Security Channel Jason Maynard Blogs Cisco Security Blogs Next Generation Firewalls: Official EOL/EOS Announcements Firepower 8000 Series  Firepower 7000 Series Firesight Management Center Firepower Management Center ASA with Firepower Services ... View more