Cisco Firepower Threat Defense for the
ASA 5506-X Series Using Firepower
Device Manager Quick Start Guide
First Published: August 10, 2016
Last Updated: June 28, 2017
1. Is This Guide for You?
This guide explains how to complete the initial configuration of your Firepower Threat Defense device using the
Firepower Device Manager web-based device setup wizard included on Firepower Threat Defense devices.
Firepower Device Manager lets you configure the basic features of the software that are most commonly used for
small networks. It is especially designed for networks that include a single device or just a few, where you do not
want to use a high-powered multiple-device manager to control a large network containing many Firepower
Threat Defense devices.
If you are managing large numbers of d evices, or if you want to use the more complex features and configurations
that Firepower Threat Defense allows, use the Firepower Management Center to configure your devices instead
of the integrated Firepower Device Manager.
Use the CLI setup wizard to configure your Firepower Threat Defense device for network connectivity and to
register the device to a Firepower Management Center as described in http://www.cisco.com/go/ftd-asa-quick.
2. Package Contents
This section lists the package contents of the chassis. Note that contents are subject to change, and your exact
contents might contain additional or fewer items.
Figure 1ASA 5506-X and 5506W-X
Cisco Systems, Inc.www.cisco.com
1
Page 2
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
3. License Requirements
1ASA 5506-X or ASA 5506W-X chassis2USB Console Cable (Type A to Type B)
3Power cable4Power supply
Figure 2ASA 5506H-X
1
3
2
4
5
403499
1ASA 5506H-X chassis2Blue Console Cable and Serial PC Terminal Adapter
(DB-9 to RJ-45)
3Power cord retention lock4Power cable
5Power supply
3. License Requirements
Firepower Threat Defense devices require Cisco Smart Licensing. Smart Licensing lets you purchase and manage
a pool of licenses centrally. Unlike product authorization key (PAK) licenses, Smart Licenses are not tied to a
specific serial number or license key. Smart Licensing lets you assess your license usage and needs at a glance.
In addition, Smart Licensing does not prevent you from using product features that you have not yet purchased.
You can start using a license immediately, as long as you are registered with the Cisco Smart Software Manager,
and purchase the license later. This allows you to deploy and use a feature, and avoid delays due to purchase order
approval.
When you purchase one or more Smart Licenses for Firepower features, you manage them in the Cisco Smart
Software Manager: http://www.cisco.com/web/ordering/smart-software-manager/index.html. The Smart
Software Manager lets you create a master account for your organization. For more information about the Cisco
Smart Software Manager, see the Cisco Smart Software Manager User Guide.
Your purchase of a Firepower Threat Defense device or Firepower Threat Defense Virtual automatically includes a
Base license. All additional licenses (Threat, Malware, or URL Filtering) are optional. For more information about
Firepower Threat Defense licensing, see the “Licensing the System” chapter of the Cisco Firepower Threat
Defense Configuration Guide for Firepower Device Manager.
2
Page 3
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
4. Deploy the Firepower Threat Defense in Your Network
4. Deploy the Firepower Threat Defense in Your Network
Note: The default configuration to use Firepower Device Manager to configure a Firepower Threat Defense device,
which includes the inside address and management address, changed in Version 6.2. See Figure 3 on page 3 for
the default topology for Version 6.2, and Figure 4 on page 4 for the default topology for Version 6.1.
About the Default Configuration (Version 6.2)
Except for the first data interface, and the Wi-Fi interface on an ASA 5506W-X, all other data interfaces on these
device models are structured into the “inside” bridge group and enabled. There is a DHCP server on the inside
bridge group. You can plug endpoints or switches into any bridged interface and endpoints get addresses on the
192.168.1.0/24 network.
For complete information about the default configuration and the options you have to configure bridged interfaces,
see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.
The following figure shows the recommended network deployment for Firepower Threat Defense on the ASA
5506-X series of appliances, including the ASA 5506W-X with the built-in wireless access point.
Figure 3Suggested Network Deployment - Version 6.2
Firepower
Threat Defense
inside bridge group
GigabitEthernet 1/2-1/8
192.168.1.1
Management Computer
DHCP from inside:192.168.1.x
The example configuration enables the above network deployment with the following behavior.
DHCP for clients on inside and wifi. There is a DHCP server on the inside bridge group. You can plug
endpoints or switches directly into one of the bridged interfaces and get addresses on the 192.168.1.0/24
network. There is a DHCP server on the wifi interface for the access point itself and all its clients.
HTTPS access is enabled on the inside bridge group, so you can open Firepower Device Manager through any
inside bridge group member interface at the default address, 192.168.1.1.
Alternatively, you can connect to Management 1/1 to set up and manage the device using the Firepower
Device Manager. There is a DHCP server on the management interface. You can plug your management
computer directly into this interface and get an address on the 192.168.45.0/24 network.
Management
Management 1/1
IP Address:
192.168.45.45
outside
GigabitEthernet 1/1
Internet
AP
wifi
GigabitEthernet 1/9 (internal)
192.168.10.1
Access Point IP address: 192.168.10.2
HTTPS access is enabled on the management interface, so you can open Firepower Device Manager through
the management interface at the default address, 192.168.45.45.
The default gateway for the management IP address is to use the data interfaces to route to the Internet. Thus,
you do not need to wire the Management physical interface to a network.
3
Page 4
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
Management Computer
DHCP from inside:192.168.45.x
Layer 2
Switch
Firepower
Threat Defense
inside
Management 1/1
IP Address:
192.168.45.45
outside
Gateway
GigabitEthernet 1/2
192.168.45.1
GigabitEthernet 1/1
wifi
GigabitEthernet 1/9 (internal)
192.168.10.1
Access Point IP address: 192.168.10.2
Management
AP
Internet
4. Deploy the Firepower Threat Defense in Your Network
Note: The physical management interface is shared between the Management logical interface and the
Diagnostic logical interface; see the “Interfaces” chapter of the Cisco Firepower Threat Defense Configuration
Guide for Firepower Device Manager.
The Firepower Threat Defense system requires Internet access for licensing and updates. The system can
obtain system database updates through the gateway for the outside interface. You do not need to have an
explicit route from the management port or network to the Internet. The default is to use internal routes
through the data interfaces.
About the Default Configuration (Version 6.1)
The default configuration assumes that you will connect the management and inside interfaces to the same
network using a switch. The inside interface is configured as a DHCP server, so you can attach your management
workstation to the same switch and get an address through DHCP on the same network. Then you can open the
Firepower Device Manager web interface.
For complete information about the default configuration, see the Cisco Firepower Threat Defense Configuration
Guide for Firepower Device Manager.
The following figure shows the recommended network deployment for Firepower Threat Defense on the ASA
5506-X series of appliances, including the ASA 5506W-X with the built-in wireless access point.
Figure 4Suggested Network Deployment - Version 6.1
Note: You must use a separate inside switch in your deployment.
The example configuration enables the above network deployment with the following behavior.
DHCP for clients on inside and wifi. The access point itself and all its clients use the ASA as the DHCP server.
Management 1/1 is used to set up and manage the device using the Firepower Device Manager, a simplified
single-device manager included on the box.
The Management interface requires Internet access for updates. When you put Management on the same
network as an inside interface, you can deploy the Firepower Threat Defense device with only a switch on the
inside and point to the inside interface as its gateway.
The physical management interface is shared between the Management logical interface and the Diagnostic
logical interface; see the “Interfaces” chapter of the Cisco Firepower Threat Defense Configuration Guide for
Firepower Device Manager.
4
Page 5
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
USB
RESET
GE MGMT
LS
SLSLS LSLS LS LS LS L
Status
Power Active
Power
12VDC, 5A
12345678
wLAN
CONSOLE
GigabitEthernet 1/1
outside, DHCP from Modem
Wifi: See
quick start guide
Internet
WAN Modem
GigabitEthernet 1/2-1/8 Bridge Group
inside, 192.168.1.1
Management Computer
DHCP from inside: 192.168.1.x
Power
12VDC, 5A
Power
Status
Active
USB
RESET
GE MGMT
LS
CONSOLE
4
3
2
1
GigabitEthernet 1/1
outside, DHCP from Modem
GigabitEthernet 1/2-1/4 Bridge Group
inside, 192.168.1.1
Management Computer
DHCP from inside: 192.168.1.x
Internet
WAN Modem
4. Deploy the Firepower Threat Defense in Your Network
Connect the Interfaces
The default configuration assumes that certain interfaces are used for the inside and outside networks. Initial
configuration will be easier to complete if you connect network cables to the interfaces based on these
expectations. To cable the above scenario on the ASA 5506-X series, see the following illustrations.
Note: The following illustrations show a simple topology using a management computer connected to the inside
network. Other topologies can be used and your deployment will vary depending on your basic logical network
connectivity, ports, addressing, and configuration requirements.
Version 6.2
Figure 5ASA 5506W-X (with Wi-Fi), 5506-X (without Wi-Fi) for Version 6.2.
Figure 6ASA 5506H-X for Version 6.2.
5
Page 6
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
USB
RESET
GE MGMT
LS
SLSLS LS LS LS LS LS L
Status
Power Active
Power
12VDC, 5A
12345678
wLAN
CONSOLE
GigabitEthernet 1/1
outside, DHCP from Modem
Management 1/1
192.168.45.45
Layer 2 Switch
Wireless Clients
(from DHCP)
192.168.10.x
WAN Modem
Management Computer
DHCP from inside:192.168.45.x
GigabitEthernet 1/2
inside, 192.168.45.1
(Gateway)
GigabitEthernet 1/9 (internal)
wifi, Access Point (from DHCP)
192.168.10.2
Internet
4. Deploy the Firepower Threat Defense in Your Network
Procedure
1. Connect the GigabitEthernet 1/1 (outside) interface to your ISP/WAN modem or other outside device. By
default, the IP address is obtained using DHCP, but you can set a static address during initial configuration.
2. Connect a local management workstation to GigabitEthernet 1/2 (or another of the inside bridge group
member interfaces).
3. Configure the workstation to obtain an IP address using DHCP. The workstation gets an address on the
192.168.1.0/24 network.
Note: You have a couple of other options for connecting the management workstation. You can also directly
connect it to the Management port. The workstation gets an address through DHCP on the 192.168.45.0/24
network. Another option is to leave your workstation attached to a switch, and attach that switch to one of the
inside ports such as GigabitEthernet1/2. However, you must ensure that no other device on the switch's
network is running a DHCP server, because it will conflict with the one running on the inside bridge group,
192.168.1.1.
Version 6.1
Figure 7ASA 5506W-X (with Wi-Fi), 5506-X (without Wi-Fi) for Version 6.1.
6
Page 7
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
Power
12VDC, 5A
Power
Status
Active
USB
RESET
GE MGMT
LS
CONSOLE
4
3
2
1
GigabitEthernet 1/1
outside, DHCP from Modem
Management 1/1
192.168.45.45
Layer 2 Switch
WAN Modem
Management Computer
DHCP from inside: 192.168.45.x
GigabitEthernet 1/2
inside, 192.168.45.1
(Gateway)
Internet
5. Power on the Firepower Threat Defense Device
Figure 8ASA 5506H-X for Version 6.1.
Procedure
1. Cable the following to a Layer 2 Ethernet switch:
— GigabitEthernet 1/2 interface (inside)
— Management 1/1 interface (for the Firepower Device Manager)
— A local management computer
Note: You can connect inside and management on the same network because the management interface acts
like a separate device that belongs only to the Firepower Device Manager.
2. Connect the GigabitEthernet 1/1 (outside) interface to your ISP/WAN modem or other outside device. By
default, the IP address is obtained using DHCP, but you can set a static address during initial configuration.
5. Power on the Firepower Threat Defense Device
Procedure
1. Attach the power cable to the Firepower Threat Defense device and connect it to an electrical outlet.
The power turns on automatically when you plug in the power cable. There is no power button.
2. Check the Power LED on the back of the Firepower Threat Defense device; if it is solid green, the device is
powered on.
3. Check the Status LED on the back of the Firepower Threat Defense device; after it is solid green, the system
has passed power-on diagnostics.
6. Launch Firepower Device Manager
When you initially log into Firepower Device Manager, you are taken through the device setup wizard to complete
the initial system configuration.
7
Page 8
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
6. Launch Firepower Device Manager
Before You Begin
Ensure that you connect a data interface to your gateway device, for example, a cable modem or router. For edge
deployments, this would be your Internet-facing gateway. For data center deployments, this would be a
back-bone router. Use the default “outside” interface identified in 4. Deploy the Firepower Threat Defense in Your
Network, page 3.
Then, connect your management computer to one of the other data ports, which are part of the inside bridge
group. Alternatively, you can connect to the Management physical interface.
The Management physical interface does not need to be connected to a network. By default, the system obtains
system licensing and database and other updates through the data interfaces, typically the outside interface, that
connect to the Internet. If you instead want to use a separate management network, you can connect the
Management interface to a network and configure a separate management gateway after you complete initial
setup.
Procedure
1. Open a browser and log into Firepower Device Manager. Assuming you did not go through initial configuration
in the CLI, open Firepower Device Manager at https://ip-address, where the address is one of the following:
— (Version 6.2 and greater) If you are connected to an inside bridge group interface: https://192.168.1.1.
— (Version 6.1) If you are connected to the Management physical interface: https://192.168.45.45.
2. Log in with the username admin, password Admin123.
3. If this is the first time logging into the system, and you did not use the CLI setup wizard, you are prompted to
read and accept the End User License Agreement and change the admin password. You must complete these
steps to continue.
4. Configure the following options for the outside and management interfaces and click Next.
Note: Your settings are deployed to the device when you click Next. The interface will be named “outside”
and it will be added to the “outside_zone” security zone. Ensure that your settings are correct.
a. Outside Interface—This is the data port that you connected to your gateway mode or router. You cannot
select an alternative outside interface during initial device setup. The first data interface is the default
outside interface.
Configure IPv4—The IPv4 address for the outside interface. You can use DHCP or manually enter a static
IP address, subnet mask, and gateway. You can also select Off to not configure an IPv4 address.
Configure IPv6—The IPv6 address for the outside interface. You can use DHCP or manually enter a static
IP address, prefix, and gateway. You can also select Off to not configure an IPv6 address.
b. Management Interface
DNS Servers—The DNS server for the system's management address. Enter one or more addresses of DNS
servers for name resolution. The default is the OpenDNS public DNS servers. If you edit the fields and want
to return to the default, click Use OpenDNS to reload the appropriate IP addresses into the fields.
Firewall Hostname
—The hostname for the system's management address.
Note: When you configure the Firepower Threat Defense device using the device setup wizard, the system
provides two default access rules for outbound and inbound traffic. You can go back and edit these access
rules after initial setup.
5. Configure the system time settings and click Next.
a. Time Zone—Select the time zone for the system.
b. NTP Time Server—Select whether to use the default NTP servers or to manually enter the addresses of
your NTP servers. You can add multiple servers to provide backups.
8
Page 9
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
7. Configure the Wireless Access Point (ASA 5506W-X)
6. Configure the smart licenses for the system.
You must have a smart license account to obtain and apply the licenses that the system requires. Initially, you
can use the 90-day evaluation license and set up smart licensing later.
To register the device now, click the link to log into your Smart Software Manager account, generate a new
token, and copy the token into the edit box.
To use the evaluation license, select Start 90 day evaluation period without registration. To later register the
device and obtain smart licenses, click the name of the device in the menu to get to the Device Dashboard,
then click the link in the Smart Licenses group.
7. Click Finish.
What to Do Next
Once you complete the device setup wizard, a pop-up presents you with your next options.
If you connected other interfaces to networks, select Configure Interfaces to configure each of the connected
interfaces.
If you want to modify the default access rules, select Configure Policy to configure and manage traffic
policies.
You can select either option, or dismiss the pop-up to return to the Device Dashboard.
7. Configure the Wireless Access Point (ASA 5506W-X)
The ASA 5506W-X includes a Cisco Aironet 702i wireless access point integrated into the device. The wireless
access point is disabled by default. Connect to the access point web interface so that you can enable the wireless
radios and configure the SSID and security settings.
The access point connects internally over the GigabitEthernet1/9 interface. All Wi-Fi clients belong to the
GigabitEthernet1/9 network. Your security policy determines how the Wi-Fi network can access any networks on
other interfaces. The access point does not contain any external interfaces or switch ports.
The following procedure explains how to configure the access point. The procedure assumes that you completed
the device setup wizard. If you instead manually configured the device, you might need to adjust the steps based
on your configuration.
For more information, see the following manuals:
For details about using the wireless LAN controller, see the Cisco Wireless LAN Controller Software
documentation.
For details about the wireless access point hardware and software, see the Cisco Aironet 700 Series
documentation.
Procedure
1. Configure and enable the wireless interface, GigabitEthernet1/9.
a. Click the device name in the menu to get to the Device Dashboard, then click the link in the Interfaces
group to open the list of interfaces.
b. Click the edit icon
c. Configure the following options.
● Interface Name—Enter a name for the interface, for example, wifi.
● Status—Click the slider to enable the interface.
() for the GigabitEthernet1/9 interface.
9
Page 10
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
7. Configure the Wireless Access Point (ASA 5506W-X)
● IPv4 Address—Select Static for the address type, then enter an address and subnet mask. For example,
192.168.10.1/24.
d. Click Save.
2. Add the Wi-Fi interface to the same security zone as the inside interface.
During device setup, you configured the inside interface and placed it in a security zone named inside_zone.
The Wi-Fi interface needs to be in the same zone so that you can reach the access point web interface.
a. Click Objects in the menu, then select Security Zones from the table of contents.
b. Click the edit icon
() for inside_zone.
c. Click + under Interfaces and select the wifi interface.
3. Configure an access control rule to allow traffic between interfaces in the inside_zone security zone.
The device setup wizard creates a rule to allow traffic to flow from the inside_zone to the outside_zone,
which allows inside users to get to the Internet. By adding the wifi interface to inside_zone, Wi-Fi users are
also included in the rule that allows Internet access.
However, the default action is to block all traffic, so you must create a rule to enable traffic between the
interfaces in the inside_zone security zone.
a. Click Policies in the menu.
b. Click + above the Access Control table to add a rule.
c. Configure at least the following options in the rule.
● Tit le—Enter a name for the rule. For example, Inside_Inside.
4. Configure the DHCP server on the wireless interface.
The DHCP server supplies IP addresses to devices that connect to the access point. It also supplies an
address to the access point itself.
a. Click the device name in the menu to get to the Device Dashboard.
b. Click System Settings > DHCP Server.
c. Click + above the DHCP server table.
d. Configure the following DHCP server properties.
● Enable DHCP Server—Click the slider to enable the DHCP server.
● Interface—Select the wifi interface.
● Address Pool—Enter the address pool for DHCP clients. For example, if you used the example address
for the wireless interface, the pool would be 192.168.10.2-192.168.10.254. The pool must be on the same
subnet as the IP address for the interface, and it cannot include the address of the interface or the
broadcast address.
e. Click Add.
5. Click the Deploy button
in the menu, then click the Deploy Now button(), to deploy your changes to the
device.
10
Page 11
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
7. Configure the Wireless Access Point (ASA 5506W-X)
Wait until the deployment finishes before you continue.
6. Configure the wireless access point.
The wireless access point obtains its address from the DHCP pool defined for the wireless interface. It should
get the first address in the pool. If you used the example addresses, this is 192.168.10.2. (Try the next address
in the pool if the first one does not work.)
a. Use a new browser window to go to the wireless access point IP address, for example,
http://192.168.10.2. The access point web interface should appear.
You must be on the inside network, or a network that can route to it, to open this address.
b. Log in with the username cisco and password Cisco.
c. On the left, click Easy Setup > Network Configuration.
d. In the Radio Configuration area, for each of the Radio 2.4GHz and Radio 5GHz sections, set at least the
following parameters and click Apply for each section.
● SSID—The Service Set Identifier. This is the name of the wireless network. Users will see this name when
selecting a wireless network for their Wi-Fi connection.
● Broadcast SSID in Beacon—Select this option.
● Universal Admin Mode: Disable.
● Security—Select whichever security option you want to use.
7. While in the wireless access point web interface, enable the radios.
a. On the left, click Summary, and then on the main page under Network Interfaces, click the link for the 2.4
GHz radio.
b. Click the Settings tab.
c. For the Enable Radio setting, click the Enable radio button, and then click Apply at the bottom of the page.
d. Repeat the process for the 5 GHz radio.
Restore the Wireless Access Point Configuration (ASA 5506W-X)
If you are unable to reach the access point, and the Firepower Threat Defense has the suggested configuration
and other networking issues are not found, then you may want to restore the access point default configuration.
You must access the Firepower Threat Defense CLI (connect to the console port, or configure Telnet or SSH
access).
Procedure
1. From the Firepower Threat Defense CLI, navigate to the system support CLI menu:
> system support diagnostic-cli
Example:
> system support diagnostic-cli
Attaching to ASA console ... Press 'Ctrl+a then d' to detach.
Type help or '?' for a list of available commands.
firepower>
2. Enter the enable command to turn on privileged commands:
firepower> enable
11
Page 12
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
7. Configure the Wireless Access Point (ASA 5506W-X)
After issuing the enable command, the system will prompt you for a password. By default, the password is
blank.
Example:
firepower> enable
Password: <by default, the password is blank>
firepower#
3. Enter the command to restore the access point default configuration:
4. See the Cisco IOS Configuration Guide for Autonomous Aironet Access Points for information about the
access point CLI.
Access the Wireless Access Point Console (ASA 5506W-X)
You can configure and monitor the wireless access point using the command-line interface (CLI), which you
access from the Firepower Threat Defense CLI (connect to the console port, or configure Telnet or SSH access).
Procedure
1. From the Firepower Threat Defense CLI, navigate to the system support CLI menu:
> system support diagnostic-cli
Example:
> system support diagnostic-cli
Attaching to ASA console ... Press 'Ctrl+a then d' to detach.
Type help or '?' for a list of available commands.
firepower>
2. Enter the enable command to turn on privileged commands:
firepower> enable
After issuing the enable command, the system will prompt you for a password. By default, the password is
blank.
Example:
firepower> enable
Password: <by default, the password is blank>
firepower#
3. Session to the access point:
firepower# session wlan console
Example:
firepower# session wlan console
opening console session with module wlan
connected to module wlan. Escape character sequence is ‘CTRL-^X’
ap>
4. See the Cisco IOS Configuration Guide for Autonomous Aironet Access Points for information about the
access point CLI.
12
Page 13
Cisco Firepower Threat Defense for the ASA 5506-X Series Using Firepower Device Manager Quick Start Guide
8. Where to Go Next
8. Where to Go Next
For more information about managing the Firepower Threat Defense with the Firepower Device Manager, see
the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, or the Firepower
Device Manager online help.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To
view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property
of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other
company. (1110R)