Step 1

In the Chassis Manager, choose Logical Devices.

Step 2

Click Add > Standalone, and set the following parameters:

1. Provide a Device Name.

   This name is used by the chassis supervisor to configure management settings and to assign interfaces; it is not the device name used in the application configuration.

   Note	You cannot change this name after you add the logical device.

2. For the Template, choose Cisco Firepower Threat Defense.

3. Choose the Image Version.

4. Choose the Instance Type: Native.

   Container instances are not supported with the device manager.

5. Click OK.

   You see the Provisioning - device name window.

Step 3

Expand the Data Ports area, and click each interface that you want to assign to the device.

You can only assign data interfaces that you previously enabled on the Interfaces page. You will later enable and configure these interfaces in the device manager, including setting the IP addresses.

Step 4

Click the device icon in the center of the screen.

Step 5

On the General Information page, complete the following:

1. (For the Firepower 9300) Under Security Module Selection click the security module that you want to use for this logical device.

2. Choose the Management Interface.

   This interface is used to manage the logical device. This interface is separate from the chassis management port.

3. Choose the management interface Address Type: IPv4 only, IPv6 only, or IPv4 and IPv6.

4. Configure the Management IP address.

   Set a unique IP address for this interface.

5. Enter a Network Mask or Prefix Length.

6. Enter a Network Gateway address.

Step 6

On the Settings tab, complete the following:

1. In the Management type of application instance drop-down list, choose LOCALLY_MANAGED.

   Native instances also support the management center as a manager. If you change the manager after you deploy the logical device, then your configuration is erased and the device is reinitialized.

2. Enter the Search Domains as a comma-separated list.

3. The Firewall Mode only supports Routed mode.

4. Enter the DNS Servers as a comma-separated list.

5. Enter the Fully Qualified Hostname for the threat defense.

6. Enter a Password for the threat defense admin user for CLI access.

Step 7

On the Agreement tab, read and accept the end user license agreement (EULA).

Step 8

Click OK to close the configuration dialog box.

Step 9

Click Save.

The chassis deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the application instance. Check the Logical Devices page for the status of the new logical device. When the logical device shows its Status as online, you can start configuring the security policy in the application.

Step 1

Enter the following URL in your browser.

Step 2

Log in with the username admin, and the password you set when you deployed the threat defense.

Step 3

You are prompted to accept the 90-day evaluation license.

Step 1

Make sure your Smart Licensing account contains the available licenses you need.

When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart Software License account. However, if you need to add licenses yourself, use the Find Products and Solutions search field on the Cisco Commerce Workspace. Search for the following license PIDs:

Note	If a PID is not found, you can add the PID manually to your order.

• IPS, Malware Defense, and URL license combination:

  • L-FPR9K-40T-TMC=

  • L-FPR9K-48T-TMC=

  • L-FPR9K-56T-TMC=

  When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

  • L-FPR9K-40T-TMC-1Y

  • L-FPR9K-40T-TMC-3Y

  • L-FPR9K-40T-TMC-5Y

  • L-FPR9K-48T-TMC-1Y

  • L-FPR9K-48T-TMC-3Y

  • L-FPR9K-48T-TMC-5Y

  • L-FPR9K-56T-TMC-1Y

  • L-FPR9K-56T-TMC-3Y

  • L-FPR9K-56T-TMC-5Y

• Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Step 2

In the Smart Software Manager, request and copy a registration token for the virtual account to which you want to add this device.

1. Click Inventory.

   

2. On the General tab, click New Token.

   

3. On the Create Registration Token dialog box enter the following settings, and then click Create Token:

   

   • Description

   • Expire After—Cisco recommends 30 days.

   • Allow export-controlled functionality on the products registered with this token—Enables the export-compliance flag if you are in a country that allows for strong encryption. You must select this option now if you plan to use this functionality. If you enable this functionality later, you will need to re-register your device with a new product key and reload the device. If you do not see this option, your account does not support export-controlled functionality.

   The token is added to your inventory.

4. Click the arrow icon to the right of the token to open the Token dialog box so you can copy the token ID to your clipboard. Keep this token ready for later in the procedure when you need to register the threat defense.

   

   

Step 3

In the device manager, click Device, and then in the Smart License summary, click View Configuration.

Step 4

Click Register Device.

Then follow the instructions on the Smart License Registration dialog box to paste in your token:

Step 5

Click Register Device.

You return to the Smart License page. While the device registers, you see the following message:

After the device successfully registers and you refresh the page, you see the following:

Step 6

Click the Enable/Disable control for each optional license as desired.

• Enable—Registers the license with your Cisco Smart Software Manager account and enables the controlled features. You can now configure and deploy policies controlled by the license.

• Disable—Unregisters the license with your Cisco Smart Software Manager account and disables the controlled features. You cannot configure the features in new policies, nor can you deploy policies that use the feature.

• If you enabled the Cisco Secure Client license, select the type of license you want to use: Advantage, Premier, VPN Only, or Premier and Advantage.

  

After you enable features, if you do not have the licenses in your account, you will see the following non-compliance message after you refresh the page:

Step 7

Choose Resync Connection from the gear drop-down list to synchronize license information with Cisco Smart Software Manager.

Step 1

(Option 1) SSH directly to the threat defense management interface IP address.

Step 2

(Option 2) From the FXOS CLI, connect to the module CLI using a console connection or a Telnet connection.

1. Connect to the security module.

   connect module slot_number { console | telnet}

   The benefits of using a Telnet connection is that you can have multiple sessions to the module at the same time, and the connection speed is faster.

   Example:

   
   Firepower# connect module 1 console
   Telnet escape character is '~'.
   Trying 127.5.1.1...
   Connected to 127.5.1.1.
   Escape character is '~'.
   
   CISCO Serial Over LAN:
   Close Network Connection to Exit
   
   Firepower-module1> 
   
   

2. Connect to the threat defense console.

   connect ftd name

   If you have multiple application instances, you must specify the name of the instance. To view the instance names, enter the command without a name.

   Example:

   
   Firepower-module1> connect ftd FTD_Instance1
   
   ============================= ATTENTION ==============================
   You are connecting to ftd from a serial console. Please avoid
   executing any commands which may produce large amount of output.
   Otherwise, data cached along the pipe may take up to 12 minutes to be
   drained by a serial console at 9600 baud rate after pressing Ctrl-C.
   
   To avoid the serial console, please login to FXOS with ssh and use
   'connect module <slot> telnet' to connect to the security module.
   ======================================================================
   
   Connecting to container ftd(FTD_Instance1) console... enter "exit" to return to bootCLI
   > 
   
   

3. Exit the application console to the FXOS module CLI by entering exit.

   Note	For pre-6.3 versions, enter Ctrl-a, d.

4. Return to the supervisor level of the FXOS CLI.

   To exit the console:

   1. Enter ~

      You exit to the Telnet application.

   2. To exit the Telnet application, enter:

      telnet>quit

   To exit the Telnet session:

   Enter Ctrl-], .