FirePOWER Appliance 7110

Cisco FirePOWER Appliance 7110 Configuration Guide

  • Hello! I am an AI chatbot trained to assist you with the Cisco FirePOWER Appliance 7110 Configuration Guide. I’ve already reviewed the document and can help you find the information you need or explain it in simple terms. Just ask your questions, and providing more details will help me assist you more effectively!
Firepower Management Center Configuration Guide, Version 6.0.1
First Published: 2016-03-20
Last Modified: 2018-04-25
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
http://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (1721R)
©2016–2018 Cisco Systems, Inc. All rights reserved.
CONTENTS
Getting Started With Firepower 1
CHAPTER 1
Introduction to Managed Devices 1
7000 and 8000 Series Managed Devices 2
NGIPSv 2
Cisco ASA with FirePOWER Services 2
Firepower Threat Defense 3
Firepower Threat Defense Virtual 3
Introduction to the Firepower Management Center 4
Firepower Management Center Capabilities 4
Firepower System Components 4
Redundancy and Resource Sharing 5
Network Traffic Management for 7000 & 8000 Series Devices 5
Multitenancy 6
Discovery and Identity 6
Access Control 7
SSL Inspection 7
Intrusion Detection and Prevention 7
Cisco Advanced Malware Protection and File Control 8
Application Programming Interfaces 9
The Context Menu 10
Switching Domains on the Firepower Management Center 12
Firepower Online Help, How To, and Documentation 12
Top-Level Documentation Listing Pages for FMC Deployments 12
License Statements in the Documentation 14
Supported Devices Statements in the Documentation 14
Access Statements in the Documentation 15
Firepower Management Center Configuration Guide, Version 6.0.1
iii
Firepower System IP Address Conventions 15
Your User Account 17
PART I
Logging into the Firepower System 19
CHAPTER 2
Firepower System User Accounts 19
Firepower System User Interfaces 21
Web Interface Considerations 23
Session Timeout 24
Logging Into the Firepower Management Center Web Interface 24
Logging Into the Web Interface of a 7000 or 8000 Series Device 25
Logging Into the Firepower Management Center with CAC Credentials 26
Logging Into a 7000 or 8000 Series Device with CAC Credentials 27
Logging Into the CLI on 7000/8000 Series, ASA FirePOWER, and NGIPSv Devices 27
Logging Into the Command Line Interface on FTD Devices 28
Logging Out of a Firepower System Web Interface 29
Specifying User Preferences 31
CHAPTER 3
User Preferences Introduction 31
Changing Your Password 31
Changing an Expired Password 32
Specifying Your Home Page 32
Configuring Event View Settings 33
Event View Preferences 34
File Download Preferences 35
Default Time Windows 35
Default Workflows 37
Setting Your Default Time Zone 37
Specifying Your Default Dashboard 38
Firepower System Management 39
PART II
Firepower System User Management 41
CHAPTER 4
User Roles 41
Firepower Management Center Configuration Guide, Version 6.0.1
iv
Contents
Predefined User Roles 42
Custom User Roles 43
Example: Custom User Roles and Access Control 44
User Account Privileges 44
Overview Menu 44
Analysis Menu 46
Policies Menu 50
Devices Menu 53
Object Manager Menu 54
Cisco AMP 54
Deploy Configuration to Devices 54
System Menu 54
Help Menu 57
Managing User Roles 58
Activating and Deactivating User Roles 59
Creating Custom User Roles 59
Copying User Roles 60
Editing Custom User Roles 61
User Role Escalation 61
Setting the Escalation Target Role 62
Configuring a Custom User Role for Escalation 62
Escalating Your User Role 63
User Accounts 63
Managing User Accounts 64
Creating a User Account 64
Editing a User Account 65
Assigning User Roles in Multiple Domains 66
Converting a User from Internal to External Authentication 66
User Account Login Options 67
Command Line Access Levels 68
Firepower System User Authentication 70
Internal Authentication 71
External Authentication 71
LDAP Authentication 72
Firepower Management Center Configuration Guide, Version 6.0.1
v
Contents
Required Information for Creating LDAP Authentication Objects 73
CAC Authentication 74
Configuring CAC Authentication 75
Creating Basic LDAP Authentication Objects 76
Creating Advanced LDAP Authentication Objects 78
LDAP Authentication Server Fields 81
Identifying the LDAP Authentication Server 82
LDAP-Specific Fields 83
Configuring LDAP-Specific Parameters 86
LDAP Group Fields 88
Configuring Access Rights by Group 89
LDAP Shell Access Fields 90
Configuring LDAP Shell Access 91
Testing LDAP Authentication Connections 92
Troubleshooting LDAP Authentication Connections 93
RADIUS Authentication 94
Creating RADIUS Authentication Objects 95
Configuring RADIUS Connection Settings 97
Configuring RADIUS User Roles 99
Configuring RADIUS Shell Access 100
Defining Custom RADIUS Attributes 101
Testing RADIUS Authentication Connections 102
Single Sign-on (SSO) 103
Configuring SSO 103
Licensing the Firepower System 105
CHAPTER 5
About Firepower Licenses 105
License Requirements for Firepower Management Center 106
Firepower Management Center Virtual Licenses 106
Evaluation License Caveats 106
Smart vs. Classic Licenses 106
License Firepower Threat Defense Devices (FTD) 107
Smart Software Manager (CSSM) 107
Periodic Communication with the License Authority 108
Firepower Management Center Configuration Guide, Version 6.0.1
vi
Contents
Service Subscriptions for FTD Features 108
FTD License Types and Restrictions 109
Base Licenses 110
Malware Licenses for Firepower Threat Defense Devices 110
Threat Licenses 111
URL Filtering Licenses for Firepower Threat Defense Devices 112
Licensing for Export-Controlled Functionality 112
Licensing for FTD Clusters 113
Create a Smart Account to Hold Your Licenses 113
How to Configure Smart Licensing with Direct Internet Access 114
Obtain a Product License Registration Token for Smart Licensing 115
Register Smart Licenses 116
Smart Software Satellite Server Overview 117
How to Deploy a Smart Software Satellite Server 117
Assign Licenses to Multiple Managed Devices 119
View FTD Licenses and License Status 120
FTD License Status 121
Move or Remove Licenses from FTD Devices 121
Transfer FTD Licenses to a Different Firepower Management Center 122
If FTD License Status is Out of Compliance 122
Deregister a Firepower Management Center from the Cisco Smart Software Manager 123
Synchronize a Firepower Management Center with the Cisco Smart Software Manager 123
Troubleshoot FTD Licensing 124
License Classic Devices ( Firepower 7000/8000 Series, ASA FirePOWER, and NGIPSv) 124
Product License Registration Portal 125
Service Subscriptions for Firepower Features (Classic Licensing) 125
Classic License Types and Restrictions 125
Protection Licenses 127
Control Licenses 127
URL Filtering Licenses for Classic Devices 128
Malware Licenses for Classic Devices 129
VPN Licenses for 7000 and 8000 Series Devices 129
Classic Licenses in Device Stacks and High-Availability Pairs 130
View Your Classic Licenses 130
Firepower Management Center Configuration Guide, Version 6.0.1
vii
Contents
Identify the License Key 131
Generate a Classic License and Add It to the Firepower Management Center 131
How to Convert a Classic License for Use on an FTD Device 133
Assign Licenses to Managed Devices from the Device Management Page 134
License Expiration 136
Additional Information about Firepower Licensing 138
System Software Updates 139
CHAPTER 6
About Firepower Updates 139
Guidelines and Limitations for Firepower Updates 140
Upgrade Firepower System Software 140
Update the Vulnerability Database (VDB) Manually 141
Update the Geolocation Database (GeoDB) 142
Manually Update the GeoDB (Internet Connection) 143
Manually Update the GeoDB (No Internet Connection) 144
Schedule GeoDB Updates 144
Update Intrusion Rules 145
Update Intrusion Rules One-Time Manually 146
Update Intrusion Rules One-Time Automatically 147
Configure Recurring Intrusion Rule Updates 148
Best Practices for Importing Local Intrusion Rules 149
Import Local Intrusion Rules 150
Rule Update Log 150
Intrusion Rule Update Log Table 151
Viewing the Intrusion Rule Update Log 151
Fields in an Intrusion Rule Update Log 152
Viewing Details of the Intrusion Rule Update Import Log 153
Maintain Your Air-Gapped Deployment 154
Backup and Restore 155
CHAPTER 7
About Backup and Restore 155
Requirements for Backup and Restore 156
Guidelines and Limitations for Backup and Restore 157
Best Practices for Backup and Restore 158
Firepower Management Center Configuration Guide, Version 6.0.1
viii
Contents
Backing Up Firepower Appliances 160
Back up the FMC 161
Back up a Device from the FMC 162
Back up a 7000/8000 Series Device Locally 163
Create a Backup Profile 164
Restoring Firepower Appliances 165
Restore an FMC from Backup 166
Restore a 7000/8000 Series Device from Backup 167
Manage Backups and Remote Storage 167
Backup Storage Locations 169
Configuration Import and Export 171
CHAPTER 8
About Configuration Import/Export 171
Configurations that Support Import/Export 171
Special Considerations for Configuration Import/Export 172
Exporting Configurations 173
Importing Configurations 173
Import Conflict Resolution 174
Task Scheduling 177
CHAPTER 9
About Task Scheduling 177
Configuring a Recurring Task 177
Scheduled Backups 179
Schedule FMC Backups 179
Schedule Local 7000 & 8000 Series Device Backups 180
Configuring Certificate Revocation List Downloads 180
Automating Policy Deployment 181
Nmap Scan Automation 182
Scheduling an Nmap Scan 182
Automating Report Generation 184
Specify Report Generation Settings for a Scheduled Report 185
Automating Firepower Recommendations 185
Software Update Automation 186
Automating Software Downloads 187
Firepower Management Center Configuration Guide, Version 6.0.1
ix
Contents
Automating Software Pushes 188
Automating Software Installs 189
Vulnerability Database Update Automation 190
Automating VDB Update Downloads 190
Automating VDB Update Installs 191
Automating URL Filtering Updates Using a Scheduled Task 192
Scheduled Task Review 193
Task List Details 193
Viewing Scheduled Tasks on the Calendar 194
Editing Scheduled Tasks 195
Deleting Scheduled Tasks 195
FMC Database Purge 197
CHAPTER 10
Purging Data from the FMC Database 197
Device Management Basics 199
CHAPTER 11
About Device Management 199
About the Firepower Management Center 199
What Can Be Managed by a Firepower Management Center? 200
Beyond Policies and Events 200
NAT Environments 201
The Device Management Page 203
Filtering Managed Devices 203
Add Devices to the Firepower Management Center 204
Deleting Devices from the Firepower Management Center 206
Change the Manager for the Device 207
Identify a New FMC 207
Switch from Firepower Device Manager to FMC 208
Switch from FMC to Firepower Device Manager 209
Device Configuration Settings 211
General Device Settings 211
Device License Settings 211
Device System Settings 212
Device Health Settings 212
Firepower Management Center Configuration Guide, Version 6.0.1
x
Contents
Device Management Settings 212
Advanced Device Settings 213
Viewing Device Information 213
214
Editing General Device Settings 215
Enabling and Disabling Device Licenses 216
Editing Advanced Device Settings 216
Configuring Automatic Application Bypass 216
Inspecting Local Router Traffic 217
Configure Fastpath Rules (8000 Series) 218
Managing System Shut Down 219
The Interfaces Table View 220
Device Group Management 221
Adding Device Groups 222
Editing Device Groups 222
System Monitoring 225
PART III
Dashboards 227
CHAPTER 12
About Dashboards 227
Firepower System Dashboard Widgets 228
Widget Availability 228
Dashboard Widget Availability by User Role 229
Predefined Dashboard Widgets 230
The Appliance Information Widget 230
The Appliance Status Widget 231
The Correlation Events Widget 231
The Current Interface Status Widget 231
The Current Sessions Widget 232
The Custom Analysis Widget 232
The Disk Usage Widget 236
The Interface Traffic Widget 237
The Intrusion Events Widget 237
The Network Compliance Widget 238
Firepower Management Center Configuration Guide, Version 6.0.1
xi
Contents
The Product Licensing Widget 238
The Product Updates Widget 239
The RSS Feed Widget 239
The System Load Widget 239
The System Time Widget 240
The White List Events Widget 240
Managing Dashboards 240
Adding a Dashboard 241
Adding Widgets to a Dashboard 241
Configuring Widget Preferences 242
Creating Custom Dashboards 243
Custom Dashboard Options 243
Customizing the Widget Display 244
Editing Dashboards Options 245
Modifying Dashboard Time Settings 245
Renaming a Dashboard 246
Viewing Dashboards 247
Health Monitoring 249
CHAPTER 13
About Health Monitoring 249
Health Modules 250
Configuring Health Monitoring 255
Health Policies 255
Default Health Policy 256
Creating Health Policies 256
Applying Health Policies 257
Editing Health Policies 258
Deleting Health Policies 258
The Health Monitor Blacklist 259
Blacklisting Appliances 260
Blacklisting Health Policy Modules 261
Health Monitor Alerts 261
Health Monitor Alert Information 261
Creating Health Monitor Alerts 262
Firepower Management Center Configuration Guide, Version 6.0.1
xii
Contents
Editing Health Monitor Alerts 263
Deleting Health Monitor Alerts 264
Using the Health Monitor 264
Health Monitor Status Categories 265
Viewing Appliance Health Monitors 266
Running All Modules for an Appliance 267
Running a Specific Health Module 267
Generating Health Module Alert Graphs 268
Health Monitor Reports for Troubleshooting 268
Generating Appliance Troubleshooting Files 269
Downloading Troubleshooting Files 270
Health Event Views 270
Viewing Health Events 271
Viewing Health Events by Module and Appliance 271
Viewing the Health Events Table 272
Hardware Alert Details for 7000 and 8000 Series Devices 273
The Health Events Table 275
History for Health Monitoring 276
Monitoring the System 277
CHAPTER 14
About System Statistics 277
The Host Statistics Section 277
The Disk Usage Section 278
The Processes Section 278
Process Status Fields 278
System Daemons 280
Executables and System Utilities 281
The SFDataCorrelator Process Statistics Section 284
The Intrusion Event Information Section 285
Viewing System Statistics 285
System Messages 286
Message Types 286
Message Management 288
Managing System Messages 289
Firepower Management Center Configuration Guide, Version 6.0.1
xiii
Contents
Viewing Deployment Messages 290
Viewing Health Messages 290
Viewing Task Messages 291
Managing Task Messages 292
Configuring Notification Behavior 292
Deployment Management 295
PART IV
Domain Management 297
CHAPTER 15
Introduction to Multitenancy Using Domains 297
Domains Terminology 298
Domain Properties 299
Managing Domains 300
Creating New Domains 301
Moving Data Between Domains 302
Moving Devices Between Domains 303
Policy Management 305
CHAPTER 16
Policy Deployment 305
Best Practices for Deploying Configuration Changes 306
Deploy Configuration Changes 307
Redeploy Existing Configurations to a Device 308
Snort®Restart Scenarios 309
Inspect Traffic During Policy Apply 309
Snort®Restart Traffic Behavior 310
Configurations that Restart the Snort Process When Deployed or Activated 311
Changes that Immediately Restart the Snort Process 314
Policy Comparison 314
Comparing Policies 315
Policy Reports 316
Generating Current Policy Reports 316
Out-of-Date Policies 316
Performance Considerations for Limited Deployments 317
Discovery Without Intrusion Prevention 318
Firepower Management Center Configuration Guide, Version 6.0.1
xiv
Contents
Intrusion Prevention Without Discovery 318
History for Policy Management 320
Rule Management: Common Characteristics 323
CHAPTER 17
Introduction to Rules 323
Rule Condition Types 324
Rule Condition Mechanics 326
Security Zone Conditions 327
Network Conditions 328
Configuring Network Conditions 329
VLAN Conditions 330
Port and ICMP Code Conditions 331
Configuring Port Conditions 332
Application Conditions (Application Control) 333
Configuring Application Conditions and Filters 334
Application Characteristics 336
Best Practices for Application Control 337
Best Practices for Configuring Application Control 338
Application-Specific Notes and Limitations 340
Troubleshoot Application Control Rules 340
URL Conditions (URL Filtering) 342
User, Realm, and ISE Attribute Conditions (User Control) 342
User Control Prerequisites 342
Configuring User and Realm Conditions 343
Configuring ISE Attribute Conditions 344
Troubleshoot User Control 344
Searching for Rules 346
Filtering Rules by Device 346
Rule and Other Policy Warnings 347
Reusable Objects 349
CHAPTER 18
Introduction to Reusable Objects 349
The Object Manager 351
Editing Objects 352
Firepower Management Center Configuration Guide, Version 6.0.1
xv
Contents
Viewing Objects and Their Usage 353
Filtering Objects or Object Groups 353
Sorting Objects 354
Object Groups 354
Grouping Reusable Objects 355
Object Overrides 356
Managing Object Overrides 357
Allowing Object Overrides 358
Adding Object Overrides 358
Editing Object Overrides 359
Network Objects 359
Creating Network Objects 359
Port Objects 360
Creating Port Objects 361
Application Filters 362
VLAN Tag Objects 362
Creating VLAN Tag Objects 362
URL Objects 363
Creating URL Objects 363
Geolocation Objects 364
Creating Geolocation Objects 364
Security Zones 365
Creating Security Zone Objects 366
Variable Sets 366
Variable Sets in Intrusion Policies 368
Variables 368
Predefined Default Variables 369
Network Variables 371
Port Variables 372
Advanced Variables 373
Variable Reset 374
Adding Variables to Sets 374
Nesting Variables 376
Managing Variable Sets 378
Firepower Management Center Configuration Guide, Version 6.0.1
xvi
Contents
Creating Variable Sets 378
Managing Variables 379
Adding Variables 380
Editing Variables 381
Security Intelligence Lists and Feeds 382
Security Intelligence Object Quick Reference 383
Blacklist Now, Whitelist Now, and Global Lists 384
Security Intelligence Lists and Multitenancy 385
Changing the Update Frequency for Security Intelligence Feeds 386
Custom Security Intelligence Feeds 386
Creating Security Intelligence Feeds 387
Manually Updating Security Intelligence Feeds 388
Custom Security Intelligence Lists 388
Uploading New Security Intelligence Lists to the Firepower Management Center 389
Updating Security Intelligence Lists 390
Sinkhole Objects 390
Creating Sinkhole Objects 391
File Lists 391
Source Files for File Lists 392
Adding Individual SHA-256 Values to File Lists 393
Uploading Individual Files to File Lists 394
Uploading Source Files to File Lists 395
Editing SHA-256 Values in File Lists 395
Downloading Source Files from File Lists 396
Cipher Suite Lists 397
Creating Cipher Suite Lists 397
Distinguished Name Objects 398
Creating Distinguished Name Objects 399
PKI Objects 400
Internal Certificate Authority Objects 401
CA Certificate and Private Key Import 401
Importing a CA Certificate and Private Key 402
Generating a New CA Certificate and Private Key 403
New Signed Certificates 403
Firepower Management Center Configuration Guide, Version 6.0.1
xvii
Contents
Creating an Unsigned CA Certificate and CSR 403
Uploading a Signed Certificate Issued in Response to a CSR 404
CA Certificate and Private Key Downloads 405
Downloading a CA Certificate and Private Key 405
Trusted Certificate Authority Objects 406
Trusted CA Object 406
Adding a Trusted CA Object 406
Certificate Revocation Lists in Trusted CA Objects 407
Adding a Certificate Revocation List to a Trusted CA Object 407
External Certificate Objects 408
Adding External Certificate Objects 409
Internal Certificate Objects 409
Adding Internal Certificate Objects 410
SLA Monitor Objects 410
Prefix Lists 412
Configure IPv6 Prefix List 412
Configure IPv4 Prefix List 413
Route Maps 414
Access List 417
Configure Extended ACL Objects 417
Configure Standard ACL Objects 419
AS Path Objects 420
Community Lists 420
Policy Lists 422
Classic Device Configuration Basics 425
PART V
Classic Device Management Basics 427
CHAPTER 19
Remote Management Configuration (Classic Devices) 427
Configuring Remote Management on a Managed Device 428
Editing Remote Management on a Managed Device 428
Changing the Management Port 429
Interface Configuration Settings 430
The Physical Hardware View 430
Firepower Management Center Configuration Guide, Version 6.0.1
xviii
Contents
Interface Icons 430
Using the Physical Hardware View 431
Configuring Sensing Interfaces 432
Configuring HA Link Interfaces 433
Disabling Interfaces 434
Managing Cisco ASA FirePOWER Interfaces 435
MTU Ranges for 7000 and 8000 Series Devices and NGIPSv 435
Synchronizing Security Zone Object Revisions 436
IPS Device Deployments and Configuration 439
CHAPTER 20
Introduction to IPS Device Deployment and Configuration 439
Passive IPS Deployments 439
Passive Interfaces on the Firepower System 439
Configuring Passive Interfaces 440
Inline IPS Deployments 441
Inline Interfaces on the Firepower System 442
Configuring Inline Interfaces 443
Inline Sets on the Firepower System 444
Viewing Inline Sets 445
Adding Inline Sets 445
Advanced Inline Set Options 447
Configuring Advanced Inline Set Options 448
Deleting Inline Sets 449
Classic Device High Availability and Scalability 451
PART VI
7000 and 8000 Series Device High Availability 453
CHAPTER 21
About 7000 and 8000 Series Device High Availability 453
Device High Availability Requirements 454
Device High Availability Failover and Maintenance Mode 454
Configuration Deployment and Upgrade Behavior for High-Availability Pairs 455
Deployment Types and Device High Availability 455
7000/8000 Series High Availability Configuration 457
Establishing Firepower 7000/8000 Series High Availability 457
Firepower Management Center Configuration Guide, Version 6.0.1
xix
Contents
Editing Device High Availability 458
Configuring Individual Devices in a High-Availability Pair 459
Configuring Individual Device Stacks in a High-Availability Pair 459
Configuring Interfaces on a Device in a High-Availability Pair 460
Switching the Active Peer in a Device High-Availability Pair 461
Placing a High-Availability Peer into Maintenance Mode 461
Replacing a Device in a Stack in a High-Availability Pair 462
Device High Availability State Sharing 462
Establishing Device High-Availability State Sharing 464
Device High Availability State Sharing Statistics for Troubleshooting 465
Viewing Device High Availability State Sharing Statistics 467
Separating Device High-Availability Pairs 468
8000 Series Device Stacking 469
CHAPTER 22
About Device Stacks 469
Device Stack Configuration 471
Establishing Device Stacks 472
Editing Device Stacks 473
Replacing a Device in a Stack 473
Replacing a Device in a Stack in a High-Availability Pair 474
Configuring Individual Devices in a Stack 475
Configuring Interfaces on a Stacked Device 475
Separating Stacked Devices 476
Replacing a Device in a Stack 477
Firepower Threat Defense Getting Started 479
PART VII
Transparent or Routed Firewall Mode for Firepower Threat Defense 481
CHAPTER 23
About the Firewall Mode 481
About Routed Firewall Mode 481
About Transparent Firewall Mode 481
Using the Transparent Firewall in Your Network 482
Diagnostic Interface 482
Passing Traffic For Routed-Mode Features 482
Firepower Management Center Configuration Guide, Version 6.0.1
xx
Contents
/