cisco firepower FTD 2110 initial config

 First steps

• Laptop / console cable, network cables, racking bolts and tools
  
• Have mgmt IP assigned for it. Will also needs IP's for inside/outside other interfaces etc.
  
• Unbox and put ears on
• Record serial numbers (there is a tab at the front interfaces)
• Mount in racks and boot up
• Plug into console port with usb to serial cable going to laptop
• Mgmt interface should be plugged into VLAN where it can reach the FMC.

Default username and password

username: admin

Password: Admin123

You'll want to change that 

connect ftd
show user 

configure user password admin 

 

Add another user

You may want to add another user as a back up

configure user add myusername

Configure  management IP

• configure network ipv4 manual 192.168.100.50 255.255.255.0 192.168.100.254
• 192.168.100.50 = MGMT IP of FT
•  192.168.100.254 = GW IP
• ping system 192.168.100.254
  

Configure route (if needed)

configure network static-routes ipv4 add eth0 192.168.10.0 255.255.255.0 192.168.1.1

Add FTD to FMC

Login into to FMC web interface

Devices -> Device management -> add

Fill in IP of FTD and a key like "cisco"

Now go back to FTD cli

show managers (should be none set)

configure manager add [IP-ofFMC] cisco

Wait for it to complete

Now go back to FMC. Give some time for the new device to settle (i think auto policy deploy happens). You can now upgrade the FTD to the same software as your other FTDs.

Overview -> Dashboard -> Status

Once upgraded your FTD is ready to be configured and policy deployed. You will need to patch any interfaces like inside/outside to the correct devices/VLANs. You should make sure you have access to SSH into the mgmt interface for troubleshooting. Most management and config is done from the FMC web interfaces from here on.

issues upgrading to firepower 6.7

First you need to upgrade RAM to at least 32GB

Next you need to move all VPN's to IKEv2

In version 6.7 cisco remove old ciphers and you can't upgrade until they are all removed.

You don't want to see group 2 or group 5 anywhere in your config.

Use group 14,19,20,21 instead.

This is true for the PFS group as well, select group 21.

vpn filter ACLs not working as expected

Had issues with VPN filter ACLs

Had some thing like

permit ip host x.x.x.x any

This should have allowed my traffic but it was not working

I needed to change this to which was essentially the same but it worked. It seems you need to make rules for the vpn filter ACLs in this way

permit ip 192.168.1.0 255.255.255.0 10.150.200.0 255.255.255.0

mtu issues in wireshark

Small packets are working like ping

TCP 3 way handshake is setting up

However when we move into setting TLS / https connection its failing. This can be the MTU is too big for the MTU on the path. The TCP window will scale up as the connection goes on.

Things to try:

tracert -d x.x.x.x

See what network devices you pass through and check the MTU on those. (if you can)

On the client:

ping –l 1490 -f 8.8.8.8

Reduce 1490 by 20 until you find a working value where the pings respond.

Remember the value when the ping command is working isn't the MTU but ICMP payload. This confuses a lot of people. MTU 1500 == ICMP payload 1472 (20 Bytes for IP and 8 Bytes for ICMP, I think). You can also check the MTU's on the path

PathMTU discovery is not reliable, will investigate MSS clamping, which can be enabled on your firewall / VPN endpoints.

CMD to check the MTU in windows

netsh int ipv4 show subinterface

CMD to set MTU in windows

netsh interface ipv4 set subinterface “Local Area Connection” mtu=1458 store=persistent

ASA should set MTU 1380 by default to account for IPsec tunnels

Palo needs to be configured

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113393-asa-troubleshoot-throughput-00.html#anc14

upgrade FMC

https://www.cisco.com/c/en/us/td/docs/security/firepower/upgrade/fpmc-upgrade-guide/upgrade_firepower_threat_defense.html#id_64765

https://software.cisco.com/download/home/286291275

https://software.cisco.com/download/home/286306503/type/286306337/release/6.7.0