Step 1

In the chassis manager, choose Logical Devices.

Step 2

Click Add > Standalone, and set the following parameters:

1. Provide a Device Name.

   This name is used by the chassis supervisor to configure management settings and to assign interfaces; it is not the device name used in the application configuration.

   Note	You cannot change this name after you add the logical device.

2. For the Template, choose Cisco Firepower Threat Defense.

3. Choose the Image Version.

4. Choose the Instance Type: Container or Native.

   A native instance uses all of the resources (CPU, RAM, and disk space) of the security module/engine, so you can only install one native instance. A container instance uses a subset of resources of the security module/engine, so you can install multiple container instances.

5. Click OK.

   You see the Provisioning - device name window.

Step 3

Expand the Data Ports area, and click each interface that you want to assign to the device.

You can only assign Data and Data-sharing interfaces that you previously enabled on the Interfaces page. You will later enable and configure these interfaces in the management center, including setting the IP addresses.

You can only assign up to 10 Data-sharing interfaces to a container instance. Also, each Data-sharing interface can be assigned to at most 14 container instances. A Data-sharing interface is indicated by the sharing icon ().

Hardware Bypass–capable ports are shown with the following icon: . For certain interface modules, you can enable the Hardware Bypass feature for Inline Set interfaces only (see the Firepower Management Center Configuration Guide for information about Inline Sets). Hardware Bypass ensures that traffic continues to flow between an inline interface pair during a power outage. This feature can be used to maintain network connectivity in the case of software or hardware failures. If you do not assign both interfaces in a Hardware Bypass pair, you see a warning message to make sure your assignment is intentional. You do not need to use the Hardware Bypass feature, so you can assign single interfaces if you prefer.

Step 4

Click the device icon in the center of the screen.

Step 5

On the General Information page, complete the following:

1. Under Security Module Selection, click the security module that you want to use for this logical device.

2. For a container instance, specify the Resource Profile.

   If you later assign a different resource profile, then the instance will reload, which can take approximately 5 minutes. Note that for established High Availability pairs or clusters, if you assign a different-sized resource profile, be sure to make all members the same size as soon as possible.

3. Choose the Management Interface.

   This interface is used to manage the logical device. This interface is separate from the chassis management port.

4. Choose the management interface Address Type: IPv4 only, IPv6 only, or IPv4 and IPv6.

5. Configure the Management IP address.

   Set a unique IP address for this interface.

6. Enter a Network Mask or Prefix Length.

7. Enter a Network Gateway address.

Step 6

On the Settings tab, complete the following:

1. For a native instance, in the Management type of application instance drop-down list, choose FMC.

   Native instances also support the device manager as a manager. After you deploy the logical device, you cannot change the manager type.

2. Enter the Firepower Management Center IP or hostname of the managing the management center. If you do not know the management center IP address, leave this field blank and enter a passphrase in the Firepower Management Center NAT ID field.

3. For a container instance, Permit Expert mode from FTD SSH sessions: Yes or No. Expert Mode provides the threat defense shell access for advanced troubleshooting.

   If you choose Yes for this option, then users who access the container instance directly from an SSH session can enter Expert Mode. If you choose No, then only users who access the container instance from the FXOS CLI can enter Expert Mode. We recommend choosing No to increase isolation between instances.

   Use Expert Mode only if a documented procedure tells you it is required, or if the Cisco Technical Assistance Center asks you to use it. To enter this mode, use the expert command in the threat defense CLI.

4. Enter the Search Domains as a comma-separated list.

5. Choose the Firewall Mode: Transparent or Routed.

   In routed mode, the threat defense is considered to be a router hop in the network. Each interface that you want to route between is on a different subnet. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a “bump in the wire,” or a “stealth firewall,” and is not seen as a router hop to connected devices.

   The firewall mode is only set at initial deployment. If you re-apply the bootstrap settings, this setting is not used.

6. Enter the DNS Servers as a comma-separated list.

   The threat defense uses DNS if you specify a hostname for the management center, for example.

7. Enter the Fully Qualified Hostname for the threat defense.

8. Enter a Registration Key to be shared between the management center and the device during registration.

   You can choose any text string for this key between 1 and 37 characters; you will enter the same key on the management center when you add the threat defense.

9. Enter a Password for the threat defense admin user for CLI access.

10. Choose the Eventing Interface on which events should be sent. If not specified, the management interface will be used.

    This interface must be defined as a Firepower-eventing interface.

11. For a container instance, set the Hardware Crypto as Enabled or Disabled.

    This setting enables TLS crypto acceleration in hardware, and improves performance for certain types of traffic. For more information, see the Firepower Management Center Configuration Guide. This feature is not supported for native instances. To view the percentage of hardware crypto resources allocated to this instance, enter the show hw-crypto command.

Step 7

On the Agreement tab, read and accept the end user license agreement (EULA).

Step 8

Click OK to close the configuration dialog box.

Step 9

Click Save.

The chassis deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the application instance. Check the Logical Devices page for the status of the new logical device. When the logical device shows its Status as online, you can start configuring the security policy in the application.

Step 1

Using a supported browser, enter the following URL.

Step 2

Enter your username and password.

Step 3

Click Log In.

Step 1

Make sure your Smart Licensing account contains the available licenses you need.

When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart Software License account. However, if you need to add licenses yourself, use the Find Products and Solutions search field on the Cisco Commerce Workspace. Search for the following license PIDs:

Note	If a PID is not found, you can add the PID manually to your order.

• IPS, Malware Defense, and URL license combination:

  • L-FPR9K-40T-TMC=

  • L-FPR9K-48T-TMC=

  • L-FPR9K-56T-TMC=

  When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

  • L-FPR9K-40T-TMC-1Y

  • L-FPR9K-40T-TMC-3Y

  • L-FPR9K-40T-TMC-5Y

  • L-FPR9K-48T-TMC-1Y

  • L-FPR9K-48T-TMC-3Y

  • L-FPR9K-48T-TMC-5Y

  • L-FPR9K-56T-TMC-1Y

  • L-FPR9K-56T-TMC-3Y

  • L-FPR9K-56T-TMC-5Y

• Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

• Carrier license:

  • L-FPR9K-FTD-CAR=

Step 2

If you have not already done so, register the management center with the Smart Licensing server.

Step 1

In the management center, choose Devices > Device Management.

Step 2

From the Add drop-down list, choose Add Device.

Set the following parameters:

• Host—Enter the IP address or hostname of the threat defense you want to add. You can leave this field blank if you specified both the management center IP address and a NAT ID in the threat defense initial bootstrap configuration.

  Note

  In an HA environment, when both the management centers are behind a NAT, you can register the threat defense without a host IP or name in the primary management center. However, for registering the threat defense in a secondary management center, you must provide the IP address or hostname for the threat defense.

• Display Name—Enter the name for the threat defense as you want it to display in the management center.

• Registration Key—Enter the same registration key that you specified in the threat defense initial bootstrap configuration.

• Domain—Assign the device to a leaf domain if you have a multidomain environment.

• Group—Assign it to a device group if you are using groups.

• Access Control Policy—Choose an initial policy. Unless you already have a customized policy you know you need to use, choose Create new policy, and choose Block all traffic. You can change this later to allow traffic; see Allow Traffic from Inside to Outside.

  

• Smart Licensing—Assign the Smart Licenses you need for the features you want to deploy: Malware (if you intend to use malware inspection), Threat (if you intend to use intrusion prevention), and URL (if you intend to implement category-based URL filtering). Note: You can apply an Secure Client remote access VPN license after you add the device, from the System > Licenses > Smart Licenses page.

• Unique NAT ID—Specify the NAT ID that you specified in the threat defense initial bootstrap configuration.

• Transfer Packets—Allow the device to transfer packets to the management center. When events like IPS or Snort are triggered with this option enabled, the device sends event metadata information and packet data to the management center for inspection. If you disable it, only event information will be sent to the management center, but packet data is not sent.

Step 3

Click Register, or if you want to add another device, click Register and Add Another and confirm a successful registration.

Step 1

(Option 1) SSH directly to the threat defense management interface IP address.

Step 2

(Option 2) From the FXOS CLI, connect to the module CLI using a console connection or a Telnet connection.

1. Connect to the security module.

   connect module slot_number { console | telnet}

   The benefits of using a Telnet connection is that you can have multiple sessions to the module at the same time, and the connection speed is faster.

   Example:

   
   Firepower# connect module 1 console
   Telnet escape character is '~'.
   Trying 127.5.1.1...
   Connected to 127.5.1.1.
   Escape character is '~'.
   
   CISCO Serial Over LAN:
   Close Network Connection to Exit
   
   Firepower-module1> 
   
   

2. Connect to the threat defense console.

   connect ftd name

   If you have multiple application instances, you must specify the name of the instance. To view the instance names, enter the command without a name.

   Example:

   
   Firepower-module1> connect ftd FTD_Instance1
   
   ============================= ATTENTION ==============================
   You are connecting to ftd from a serial console. Please avoid
   executing any commands which may produce large amount of output.
   Otherwise, data cached along the pipe may take up to 12 minutes to be
   drained by a serial console at 9600 baud rate after pressing Ctrl-C.
   
   To avoid the serial console, please login to FXOS with ssh and use
   'connect module <slot> telnet' to connect to the security module.
   ======================================================================
   
   Connecting to container ftd(FTD_Instance1) console... enter "exit" to return to bootCLI
   > 
   
   

3. Exit the application console to the FXOS module CLI by entering exit.

   Note	For pre-6.3 versions, enter Ctrl-a, d.

4. Return to the supervisor level of the FXOS CLI.

   To exit the console:

   1. Enter ~

      You exit to the Telnet application.

   2. To exit the Telnet application, enter:

      telnet>quit

   To exit the Telnet session:

   Enter Ctrl-], .