cisco firepower management center virtual for vmware ... · vmware workstation, player, server, and...

Cisco Firepower Management Center Virtual for VMware Deployment Quick Start GuidePublished: November 10, 2015Updated: June 29, 2018

Cisco Systems, Inc. www.cisco.com

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

All printed copies and duplicate soft copies are considered un-Controlled copies and the original on-line version should be referred to for latest version.

Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationshipbetween Cisco and any other company. (1721R)

© 2018 Cisco Systems, Inc. All rights reserved.

2

http://www.cisco.com/go/offices

https://www.cisco.com/go/trademarks

https://www.cisco.com/go/trademarks

Introduction to Cisco Firepower Virtual Appliances for VMware

Cisco packages 64-bit virtual Firepower Management Centers and virtual devices for the VMware hosting environments. You can deploy 64-bit Cisco Firepower Management Center Virtual to ESXi hosts using VMware vCenter or VMware ESXi hypervisor. Virtual appliances use e1000 (1 Gbit/s) interfaces, or you can replace the default interfaces with vmxnet3 (10 Gbit/s) interfaces. You can also use VMware Tools to improve the performance and management of your virtual appliances.

Cisco Firepower Management Center Virtual can manage physical devices and Cisco ASA with FirePOWER Services (ASA FirePOWER), and physical Cisco Firepower Management Centers can manage virtual devices. However, virtual appliances do not support any of the system’s hardware-based features— Cisco Firepower Management Center Virtual does not support high availability and virtual devices do not support clustering, stacking, switching, routing, and so on. For more information on physical Firepower System appliances, see the Cisco Firepower NGFW Data Sheet.

This guide provides information about deploying, installing, and setting up the Firepower Management Center Virtual. It also assumes familiarity with the features and nomenclature of VMware products, including vSphere, vSphere Client, and (optionally) VMware Tools.

Operating Environment PrerequisitesYou can host virtual Firepower Management Centers on VMware ESXi and vSphere. For hypervisor support, see the Cisco Firepower Compatibility Guide. This guide provides Cisco Firepower software and hardware compatibility, including operating system and hosting environment requirements, for each supported Firepower version.

You can also enable VMware Tools on all supported ESXi versions. For information on the full functionality of VMware Tools, see the VMware website. For help creating a hosting environment, see the VMware documentation.

Virtual appliances use Open Virtual Format (OVF) packaging. VMware Workstation, Player, Server, and Fusion do not recognize OVF packaging and are not supported. Additionally, virtual appliances are packaged as virtual machines with Version 7 of the virtual hardware.

The computer that serves as the ESXi host must meet the following requirements:

It must have a 64-bit CPU that provides virtualization support, either Intel® Virtualization Technology (VT) or AMD Virtualization™ (AMD-V™) technology.

Virtualization must be enabled in the BIOS settings

To host virtual devices, the computer must have network interfaces compatible with Intel e1000 drivers (such as PRO 1000MT dual port server adapters or PRO 1000GT desktop adapters).

For more information, see the VMware website: http://www.vmware.com/resources/guides.html.

Each virtual appliance you create requires a certain amount of memory, CPUs, and hard disk space on the ESXi host. Do not decrease the default settings, as they are the minimum required to run the system software. However, to improve performance, you can increase a virtual appliance’s memory and number of CPUs, depending on your available resources. The following table lists the default appliance settings.

3


https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html



http://www.vmware.com/


Virtual Appliance Performance

Virtual Appliance PerformanceIt is not possible to accurately predict throughput and processing capacity for virtual appliances. A number of factors heavily influence performance, such as the:

amount of memory and CPU capacity of the ESXi host

number of total virtual machines running on the ESXi host

number of sensing interfaces, network performance, and interface speed

amount of resources assigned to each virtual appliance

level of activity of other virtual appliances sharing the host

complexity of policies applied to a virtual device

Note: VMware provides a number of performance measurement and resource allocation tools. Use these tools on the ESXi host while you run your virtual appliance to monitor traffic and determine throughput. If the throughput is not satisfactory, adjust the resources assigned to the virtual appliances that share the ESXi host.

You can enable VMware Tools to improve the performance and management of your virtual appliances. Alternatively, you can install tools (such as esxtop or VMware/third-party add-ons) on the host or in the virtualization management layer (not the guest layer) on the ESXi host to examine virtual performance. To enable VMware Tools, see the Firepower System Configuration Guide.

Guidelines and LimitationsThe following guidelines exist when deploying for VMware:

vMotion support—We recommend that you only use shared storage if you plan to use vMotion. During deployment, if you have a host cluster you can either provision storage locally (on a specific host) or on a shared host. However, if you try to vMotion the Firepower Management Center Virtual to another host, using local storage will produce an error.

The following limitations exist when deploying for VMware:

Cisco Firepower Management Center Virtual appliances do not have serial numbers. The System>Configuration page will show either None or Not Specified depending on the virtual platform.

Cloning a virtual machine is not supported.

Restoring a virtual machine with snapshot is not supported.

Restoring a backup is not supported.

INIT Respawning Error Messages

Symptom—You may see the following error message on the Firepower Management Center console running on ESXi 6 and ESXi 6.5:

"INIT: Id "fmcv1" respawning too fast: disabled for 5 minutes"

Table 1 Default Virtual Appliance Settings

Setting Default Adjustable Setting?

memory 8GB yes

virtual CPUs 4 yes, up to 8

hard disk provisioned size

250GB (Firepower Management Center Virtual)

no

4


Virtual Appliance Installation Packages for VMware

Workaround—Edit the virtual machine settings in vSphere to add a serial port while the device is powered off.

1. Right-click the virtual machine and select Edit Settings.

2. On the Virtual Hardware tab, select Serial Port from the New device drop-down menu, and click Add.

The serial port appears at the bottom of the virtual device list.

3. On the Virtual Hardware tab, expand Serial port, and select connection type Use physical serial port.

4. Uncheck the Connect at power on checkbox.

5. Click OK to save settings.

Virtual Appliance Installation Packages for VMwareCisco provides packaged virtual appliances for VMware ESXi host environments on its Support Site as compressed archive (.tar.gz) files. Cisco virtual appliances are packaged as virtual machines with Version 7 of the virtual hardware. Each archive contains the following files:

an Open Virtual Format (.ovf) template containing -ESXi- in the file name

an Open Virtual Format (.ovf) template containing -VI- in the file name

a Manifest File (.mf) containing -ESXi- in the file name

a Manifest File (.mf) containing -VI- in the file name

the Virtual Machine Disk Format (.vmdk)

You deploy a virtual appliance with a virtual infrastructure (VI) or ESXi Open Virtual Format (OVF) template:

When you deploy with a VI OVF template, you can configure Firepower System-required settings (such as the password for the admin account and settings that allow the appliance to communicate on your network) using the setup wizard in the deployment; you must deploy using a managing platform such as VMware vCenter.

VI OVF Template Deployment

The following diagram shows the general process of setting up Firepower System virtual appliances when you deploy with a VI OVF template.

When you deploy with an ESXi OVF template, you must configure settings after installation using the command line interface (CLI) on the VMware console of the virtual appliance; you can deploy using a managing platform such as VMware vCenter or you can deploy as a standalone appliance.

ESXi OVF Template Deployment

The following diagram shows the general process of setting up Firepower System virtual appliances when you deploy with a ESXi OVF template.

5


Virtual Appliance Installation Packages for VMware

Obtaining the Installation FilesBefore you install a Firepower System virtual appliance for VMware, obtain the correct archive file from the Support Site. Cisco recommends that you always use the most recent package available. Virtual appliance packages are usually associated with major versions of the system software (for example, 5.4 or 6.0).

To obtain virtual appliance archive files:

1. Using a web browser, navigate the to the Downloads area of the Cisco Support Site (https://software.cisco.com/ download/navigator.html).

2. Browse for software in the Products area, or enter a name in the Find field of the system software you want to install.

For example, to search for any Firepower archive files, enter Firepower.

3. Find the archive file that you want to download for the Firepower System virtual appliance using the following naming convention:

Cisco_Firepower_Management_Center_Virtual_VMware-X.X.X-xxx.tar.gz

where X.X.X-xxx is the version and build number of the archive file you want to download.

4. Click the archive you want to download.

Note: While you are logged into the Support Site, Cisco recommends you download any available updates for virtual appliances so that after you install a virtual appliance to a major version, you can update its system software. You should always run the latest version of the system software supported by your appliance. For Cisco Firepower Management Center Virtual, you should also download any new intrusion rule and Vulnerability Database (VDB) updates.

5. Copy the archive file to a location accessible to the workstation or server that is running the vSphere Client.

Caution: Do not transfer archive files via email; the files can become corrupted.

6. Decompress the archive file using your preferred tool and extract the installation files.

For the Cisco Firepower Management Center Virtual:

Cisco_Firepower_Management_Center_Virtual_VMware-X.X.X-xxx-disk1.vmdkCisco_Firepower_Management_Center_Virtual_VMware-ESXi-X.X.X-xxx.ovfCisco_Firepower_Management_Center_Virtual_VMware-ESXi-X.X.X-xxx.mfCisco_Firepower_Management_Center_Virtual_VMware-VI-X.X.X-xxx.ovfCisco_Firepower_Management_Center_Virtual_VMware-VI-X.X.X-xxx.mf

where X.X.X-xxx is the version and build number of the archive file you downloaded.

Note: Make sure you keep all the files in the same directory.

What to Do Next

Continue with Cisco Firepower Management Center Virtual for VMware Deployment, page 7 to deploy the virtual Firepower Management Center.

6

https://software.cisco.com/download/navigator.html

Cisco Firepower Management Center Virtual for VMware Deployment

To install a Cisco Firepower Management Center Virtual, you deploy an OVF (VI or ESXi) template to a managing platform (VMware vCenter) using a platform interface (vSphere Client):

If you deploy using a VI OVF template, you can configure Firepower System-required settings during installation. You must manage this virtual appliance using VMware vCenter.

If you deploy using an ESXi OVF template, you must configure Firepower System-required settings after installation. You can manage this virtual appliance using VMware vCenter, or use it as a standalone appliance.

After you make sure your planned deployment meets the prerequisites (described in Operating Environment Prerequisites, page 3) and download the necessary archive files, use the vSphere Client to install virtual appliances.

You have the following installation options for installing a Cisco Firepower Management Center Virtual:

Cisco_Firepower_Management_Center_Virtual_VMware-VI-X.X.X-xxx.ovfCisco_Firepower_Management_Center_Virtual_VMware-ESXi-X.X.X-xxx.ovf

where X.X.X-xxx is the version and build number of the file you want to use.

The following table lists the information required for deployment:

Table 1 VMware OVF Template

Setting ESXi or VI Action

Import/Deploy OVF Template

Both Browse to the OVF templates you downloaded in the previous procedure to use.

OVF Template Details Both Confirm the appliance you are installing (Cisco Firepower Threat Defense Virtual Appliance) and the deployment option (VI or ESXi).

Accept EULA VI only Agree to accept the terms of the licenses included in the OVF template.

Name and Location Both Enter a unique, meaningful name for your virtual appliance and select the inventory location for your appliance.

Host / Cluster Both Select the host or cluster where you want to deploy the virtual appliance.

Resource Pool Both Manage your computing resources within a host or cluster by setting them up in a meaningful hierarchy. Virtual machines and child resource pools share the resources of the parent resource pool.

Storage Both Select a datastore to store all files associated with the virtual machine.

Disk Format Both Select the format to store the virtual disks: thick provision lazy zeroed, thick provision eager zeroed, or thin provision.

Network Mapping Both Select the management interface for the virtual appliance.

Properties VI only Customize the Virtual Machine initial configuration setup.

7



Deploy Using VMware vSphere

If you deploy with a VI OVF template, the installation process allows you to perform the basic setup for a Cisco Firepower Management Center Virtual. You can specify:

a new password for the admin account

network settings that allow the appliance to communicate on your management network

If you deploy with an ESXi OVF template or if you choose not to configure with the setup wizard, you must perform the initial setup for virtual appliances using the VMware console. For detailed information on performing the initial setup, including guidance on what configurations to specify, see Setting Up a Cisco Firepower Management Center Virtual, page 12.

Deploy Using VMware vSphere, page 8 describes how to deploy a Firepower Management Center virtual appliance to the VMware vCenter.

To understand network settings see Network Settings, page 14.

Deploy Using VMware vSphereYou can use the VMware vSphere vCenter, vSphere Client, vSphere Web Client, or vSphere Hypervisor (for standalone ESXi deployment) to deploy a Firepower Management Center Virtual. You can use vSphere to deploy with either a VI or ESXi OVF template:

If you deploy using a VI OVF template, the appliance must be managed by VMware vCenter.

If you deploy using a ESXi OVF template, the appliance can be managed by VMware vCenter or deployed to a standalone host. In either case, you must configure Firepower System-required settings after installation.

Before You Begin

Download an OVF template from Cisco.com; see Obtaining the Installation Files.

Procedure

1. Using the vSphere Client, deploy the OVF template file you downloaded earlier by clicking File > Deploy OVF Template.

2. From the drop-down list, select the OVF template you want to deploy:

For the Cisco Firepower Management Center Virtual:

Cisco_Firepower_Management_Center_Virtual_VMware-VI-X.X.X-xxx.ovfCisco_Firepower_Management_Center_Virtual_VMware-ESXi-X.X.X-xxx.ovf

where X.X.X-xxx is the version and build number of the archive file you downloaded.

3. View the OVF Template Details page and click Next.

4. If license agreements are packaged with the OVF template (VI templates only), the End User License Agreement page appears. Agree to accept the terms of the licenses and click Next.

5. Optionally, edit the name and select the folder location within the inventory where the Firepower Management Center Virtual will reside, and click Next.

Note: When the vSphere Client is connected directly to an ESXi host, the option to select the folder location does not appear.

6. Select the host or cluster on which you want to deploy the Firepower Management Center Virtual and click Next.

7. Navigate to, and select the resource pool where you want to run the Firepower Management Center Virtual and click Next.

Note: This page appears only if the cluster contains a resource pool.

8. Select a storage location to store the virtual machine files, and click Next.

8


Post-Installation Configuration

On this page, you select from datastores already configured on the destination cluster or host. The virtual machine configuration file and virtual disk files are stored on the datastore. Select a datastore large enough to accommodate the virtual machine and all of its virtual disk files.

9. Select the disk format to store the virtual machine virtual disks, and click Next.

When you select Thick Provisioned, all storage is immediately allocated. When you select Thin Provisioned, storage is allocated on demand as data is written to the virtual disks.

10. Associate the Firepower Management Center Virtual management interface with a VMware network on the Network Mapping screen.

Select a network by right-clicking the Destination Networks column in your infrastructure to set up the network mapping and click Next.

11. If user-configurable properties are packaged with the OVF template (VI templates only), set the configurable properties and click Next.

12. Review and verify the settings on the Ready to Complete window.

13. Optionally, check the Power on after deployment option to power on the Firepower Management Center Virtual, then click Finish.

Note: If you choose not to power on after deployment, you can do so later from the VMware console; see Initializing a Virtual Appliance, page 11.

14. After the installation is complete, close the status window.

15. After you complete the wizard, the vSphere Web Client processes the VM; you can see the “Initialize OVF deployment” status in the Global Information area Recent Tasks pane.

When it is finished, you see the Deploy OVF Template completion status.

The Cisco Firepower Management Center Virtual instance then appears under the specified data center in the Inventory. Booting up the new VM could take up to 30 minutes.

Note: To successfully register the Firepower Management Center Virtual with the Cisco Licensing Authority, the Firepower Management Center requires Internet access. You might need to perform additional configuration after deployment to achieve Internet access and successful license registration.

What to Do Next

Determine if you need to modify the virtual appliance’s hardware and memory settings; see Post-Installation Configuration, page 9.

Post-Installation Configuration After you install a virtual appliance, confirm that the virtual appliance’s hardware and memory settings meet the requirements for your deployment. Do not decrease the default settings, as they are the minimum required to run the system software. However, to improve performance, you can increase a virtual appliance’s memory and number of CPUs, depending on your available resources. The following table lists the default appliance settings.

9


Post-Installation Configuration

Verifying Virtual Machine Properties

Use the VMware Virtual Machine Properties dialog box to adjust the host resource allocation for the selected virtual machine. You can change CPU, memory, disk, and advanced CPU resources from this tab. You can also change the power-on connection setting, the MAC address, and the network connection for the virtual Ethernet adapter configuration for a virtual machine.

Procedure

1. Right-click the name of your new virtual appliance, then select Edit Settings from the context menu, or click Edit virtual machine settings from the Getting Started tab in the main window.

2. Make sure the Memory, CPUs, and Hard disk 1 settings are set no lower than the defaults, as described in Default Virtual Appliance Settings, page 4.

The memory setting and the number of virtual CPUs for the appliance are listed on the left side of the window. To see the hard disk Provisioned Size, click Hard disk 1.

3. Optionally, increase the memory and number of virtual CPUs by clicking the appropriate setting on the left side of the window, then making changes on the right side of the window.

4. Confirm the Network adapter 1 settings are as follows, making changes if necessary:

a. Under Device Status, enable the Connect at power on check box.

b. Under MAC Address, manually set the MAC address for your virtual appliance’s management interface.

Manually assign the MAC address to your virtual appliance to avoid MAC address changes or conflicts from other systems in the dynamic pool.

Additionally, for virtual Cisco Firepower Management Centers, setting the MAC address manually ensures that you will not have to re-request licenses from Cisco if you ever have to reimage the appliance.

c. Under Network Connection, set the Network label to the name of the management network for your virtual appliance.

5. Click OK.

What to Do Next

Initialize the virtual appliance; see Initializing a Virtual Appliance, page 11.

Optionally, before you power on the appliance, you can create an additional management interface; see the Cisco Firepower NGIPSv Quick Start Guide for VMware.

Figure 1 Default Virtual Appliance Settings for Firepower Management Center Virtual

Setting Default Adjustable Setting?

memory 8GB yes

virtual CPUs 4 yes, up to 8

hard disk provisioned size

250GB (Cisco Firepower Management Center)

no

Smart License Classic License Supported Devices Supported Domains Access

Any Any Any Any Admin

10

Cisco Firepower Management Center Virtual for VMware Setup

After you install a Cisco Firepower System virtual appliance, you must complete a setup process that allows the new appliance to communicate on your trusted management network. You must also change the administrator password and accept the end user license agreement (EULA).

The setup process also allows you to perform many initial administrative-level tasks, such as setting the time, registering and licensing devices, and scheduling updates. The options you choose during setup and registration determine the default interfaces, inline sets, zones, and policies that the system creates and applies.

The purpose of these initial configurations and policies is to provide an out-of-the-box experience and to help you quickly set up your deployment, not to restrict your options. Regardless of how you initially configure a virtual appliance, you can change its configuration at any time using the Cisco Firepower Management Center. In other words, choosing a detection mode or access control policy during setup, for example, does not lock you into a specific device, zone, or policy configuration.

Regardless of how you deploy, begin by powering on the appliance to initialize it. After initialization completes, log in using the VMware console and complete the setup.

If you deploy with the VI OVF template, you can perform the network configuration using the wizard in the deployment. If you choose not to use the setup wizard or you deploy with the ESXi OVF template, configure network settings using a script. After your network is configured, complete the setup process using a computer on your management network to browse to the Cisco Firepower Management Center’s web interface.

Note: If you are deploying multiple appliances, set up your Firepower NGIPSv appliances first, then their managing Firepower Management Center. The initial setup process for a device allows you to preregister it to a Firepower Management Center; the setup process for a Firepower Management Center allows you to add and license preregistered managed devices.

Initializing a Virtual Appliance

After you install a virtual appliance, initialization starts automatically when you power on the virtual appliance for the first time.

Caution: Startup time depends on a number of factors, including server resource availability. It can take up to 40 minutes for the initialization to complete. Do not interrupt the initialization or you may have to delete the appliance and begin again.

Use the following procedure to initialize a virtual appliance.

Procedure

1. Power on the appliance.

In the vSphere Client, right-click the name of your imported virtual appliance from the inventory list, then select Power > Power On from the context menu.

2. Monitor the initialization on the VMware console tab.


Any Any Any Any Admin

11



Setting Up a Cisco Firepower Management Center Virtual

What to Do Next

Continue with Setting Up a Cisco Firepower Management Center Virtual, page 12 to complete the setup.

Setting Up a Cisco Firepower Management Center VirtualThe steps required to set up a Cisco Firepower Management Center Virtual depend on whether you deployed with a VI OVF template or an ESXi OVF template:

If you deployed with a VI OVF template and used the setup wizard, log into the Firepower Management Center Virtual using the password you set when you configured the Firepower System-required settings, then use the Firepower System to set local appliance configurations, add licenses and devices, and apply policies to monitor and manage traffic. See the Firepower System Configuration Guide for more information.

If you deployed with an ESXi OVF template or did not configure Firepower System-required settings when deploying with a VI OVF template deployment, setting up a Firepower Management Center Virtual is a two-step process. After you initialize the Firepower Management Center Virtual, run a script at the VMware console that helps you configure the appliance to communicate on your management network. Then, complete the setup process using a computer on your management network to browse to the appliance’s web interface.

If you deploy the Firepower Management Center Virtual with the ESXi OVF template and deploy all the virtual devices with the VI OVF template, you can register all the devices at the same time to the Firepower Management Center Virtual through the one page setup wizard. See Initial Setup Page: Cisco Firepower Management Center Virtual, page 13 for more information.

Automating Firepower Management Center Virtual Network Settings

After you initialize a new Cisco Firepower Management Center Virtual, you must configure settings that allow the appliance to communicate on your management network. Complete this step by running a script at the VMware console.

The Firepower System provides a dual stack implementation for both IPv4 and IPv6 management environments. First, the script prompts you to configure (or disable) IPv4 management settings, then IPv6. For IPv6 deployments, you can retrieve settings from a local router. You must provide the IPv4 or IPv6 management IP address, netmask or prefix length, and default gateway.

When following the script’s prompts, for multiple-choice questions, your options are listed in parentheses, such as (y/n). Defaults are listed in square brackets, such as [y]. Press Enter to confirm a choice.

Before You Begin

Initialize the device as described in Initializing a Virtual Appliance, page 11.

Procedure

1. Log into the Firepower Management Center Virtual at the VMware console using admin as the username and the password for the admin account that you specified in the setup wizard when you deployed with a VI OVF template.

If you did not change the password using the wizard, or you are deploying with an ESXi OVF template, use Admin123 as the password.

2. At the admin prompt, run the following script:

sudo /usr/local/sf/bin/configure-network

3. Follow the script’s prompts. First configure (or disable) IPv4 management settings, then IPv6. If you manually specify network settings, you must:


Any Any Management Center Global only Admin

12



— enter IPv4 addresses, including the netmask, in dotted decimal form. For example, you could specify a netmask of 255.255.0.0.

— enter IPv6 addresses in colon-separated hexadecimal form. For an IPv6 prefix, specify the number of bits; for example, a prefix length of 112.

4. Confirm that your settings are correct.

If you entered settings incorrectly, type n at the prompt and press Enter. You can then enter the correct information. The VMware console may display messages as your settings are implemented.

5. Log out of the appliance.

What to Do Next

Continue with Initial Setup Page: Cisco Firepower Management Center Virtual, page 13 to complete the setup using the Cisco Firepower Management Center’s web interface.

Initial Setup Page: Cisco Firepower Management Center Virtual

For Cisco Firepower Management Center Virtual, you must complete the setup process by logging into the appliance’s web interface and specifying initial configuration options on a setup page. You must change the administrator password, specify network settings if you have not already, and accept the EULA.

The setup process also allows you to register and license devices. Before you can register a device, you must complete the setup process on the device itself, as well as add the Firepower Management Center as a remote manager, or the registration will fail.

Procedure

1. From a computer on your management network, direct a supported browser to https://MC_name/, where MC_name is the host name or IP address you assigned to the Firepower Management Center’s management interface in the previous procedure.

2. Log in using admin as the username and the password for the admin account that you specified in the setup wizard with a VI OVF template deployment. If you did not change the password using the wizard, use Admin123 as the password.

The setup page appears. See the following sections for information on completing the setup:

Change Password, page 14

Network Settings, page 14

Time Settings, page 14

Recurring Rule Update Imports, page 14

Recurring Geolocation Updates, page 15

Automatic Backups, page 15

License Settings, page 15

License Settings, page 15

End User License Agreement, page 16

3. When you are finished, click Apply.

The Firepower Management Center Virtual is configured according to your selections.


Any Any Management Center Global only Admin

13



4. Use the Task Status page (System > Monitoring > Task Status) to verify that the initial setup was successful.

The page auto-refreshes every ten seconds. Monitor the page until it lists a status of Completed for any initial device registration and policy apply tasks. If, as part of setup, you configured an intrusion rule or geolocation update, you can also monitor those tasks.

The Cisco Firepower Management Center is ready to use. See the Firepower System Configuration Guide for more information on configuring your deployment.

What to Do Next

Continue with Next Steps, page 17.

Change Password

You must change the password for the admin account. This account has Administrator privileges and cannot be deleted. Cisco recommends that you use a strong password that is at least eight alphanumeric characters of mixed case and includes at least one numeric character. Avoid using words that appear in a dictionary.

Network Settings

A Cisco Firepower Management Center’s network settings allow it to communicate on your management network. Because you already used a script to configure the network settings, this section of the page should be pre-populated.

If you want to change the pre-populated settings, remember that the Firepower System provides a dual stack implementation for both IPv4 and IPv6 management environments. You must specify the management network protocol (IPv4, IPv6, or Both). Depending on your choice, the setup page displays various fields where you must set the IPv4 or IPv6 management IP address, netmask or prefix length, and default gateway:

For IPv4, you must set the address and netmask in dotted decimal form (for example: a netmask of 255.255.0.0).

For IPv6 networks, you can select the Assign the IPv6 address using router autoconfiguration check box to automatically assign IPv6 network settings. Otherwise, you must set the address in colon-separated hexadecimal form and the number of bits in the prefix (for example: a prefix length of 112).

You can also specify up to three DNS servers, as well as the host name and domain for the device.

Time Settings

You can set the time for a Firepower Management Center either manually or via network time protocol (NTP) from an NTP server.

You can also specify the time zone used on the local web interface for the admin account. Click the current time zone to change it using a pop-up window. Firepower Management Center

Note that any managed devices must be in time synchronization with the managing Firepower Management Center. Because the Firepower Management Center is not supported as an NTP source, we recommend that you use a physical NTP server to set your time.

Caution: If you set up a Firepower Management Center Virtual on VMware with manual time, it will (by default) take time from the host. Although you can configure an ESX/ESXi host as an NTP server, it is not a VMware best practice to do so. VMware considers it best practice to have your ESX/ESXi hosts configured to an authoritative time (NTP) server.

Recurring Rule Update Imports

As new vulnerabilities become known, the Cisco Vulnerability Research Team (VRT) releases intrusion rule updates. Rule updates provide new and updated intrusion rules and preprocessor rules, modified states for existing rules, and modified default intrusion policy settings. Rule updates may also delete rules and provide new rule categories and system variables.

If you plan to perform intrusion detection and prevention in your deployment, Cisco recommends that you Enable Recurring Rule Update Imports.

14



You can specify the Import Frequency, as well as configure the system to perform an intrusion Policy Reapply after each rule update. To perform a rule update as part of the initial configuration process, select Install Now.

Note: Rule updates may contain new binaries. Make sure your process for downloading and installing rule updates complies with your security policies. In addition, rule updates may be large, so make sure to import rules during periods of low network use.

Recurring Geolocation Updates

You can use virtual Cisco Firepower Management Centers to view geographical information about the routed IP addresses associated with events generated by the system, as well as monitor geolocation statistics in the dashboard and Context Explorer.

The Cisco Firepower Management Center’s geolocation database (GeoDB) contains information such as an IP address’s associated Internet service provider (ISP), connection type, proxy information, and exact location. Enabling regular GeoDB updates ensures that the system uses up-to-date geolocation information. If you plan to perform geolocation-related analysis in your deployment, Cisco recommends that you Enable Recurring Weekly Updates.

You can specify the weekly update frequency for the GeoDB. Click the time zone to change it using a pop-up window. To download the database as part of the initial configuration process, select Install Now.

Note: GeoDB updates may be large and may take up to 45 minutes to install after download. You should update the GeoDB during periods of low network use.

Automatic Backups

The Firepower Management Center provides a mechanism for archiving data so configurations can be restored in case of failure. As part of the initial setup, you can Enable Automatic Backups.

Enabling this setting creates a scheduled task that creates a weekly backup of the configurations on the Firepower Management Center.

License Settings

You can license a variety of features to create an optimal Firepower System deployment for your organization. You use the Firepower Management Center to manage licenses for itself and the devices it manages. The license types offered by the Firepower System depend upon the type of device you want to manage:

For Firepower, ASA FirePOWER, and NGIPSv devices, you must use Classic Licenses.

By default, your Firepower Management Center can perform domain control, host, application, and user discovery, as well as decrypting and inspecting SSL- and TLS-encrypted traffic. Feature-specific classic licenses allow your managed devices to perform a variety of functions. For complete information about licensing, see the Firepower System Configuration Guide or the online help in the Firepower Management Center.

Device Registration

A virtual Cisco Firepower Management Center can manage any device, physical or virtual, currently supported by the Firepower System. You can add most pre-registered devices to the Firepower Management Center during the initial setup process. However, if a device and the Firepower Management Center are separated by a NAT device, you must add it after the setup process completes.

When you register a managed device to a Firepower Management Center, leave the Apply Default Access Control Policies check box enabled if you want to automatically apply access control policies to devices upon registration. Note that you cannot choose which policy the Firepower Management Center applies to each device, only whether to apply them. The policy that is applied to each device depends on the detection mode you chose when configuring the device, as listed in the following table.

15


Enabling VMware Tools

An exception occurs if you previously managed a device with a Firepower Management Center and you changed the device’s initial interface configuration. In this case, the policy applied by this new Firepower Management Center page depends on the changed (current) configuration of the device. If there are interfaces configured, the Firepower Management Center applies the Default Intrusion Prevention policy, otherwise, the Firepower Management Center applies the Default Access Control policy.

For more information on detection modes on virtual devices, see the Cisco NGIPSv Quick Start Guide for VMware; for physical devices, see the Firepower System Installation Guide.

Note: If a device is incompatible with an access control policy, the policy apply fails. This incompatibility could occur for multiple reasons, including licensing mismatches, model restrictions, passive vs inline issues, and other misconfigurations. If the initial access control policy apply fails, the initial network discovery policy apply also fails. After you resolve the issue that caused the failure, you must manually apply access control and network discovery policies to the device. For more information about issues that could cause access control policy apply to fail, see the Firepower System Configuration Guide.

To add a device, type its Hostname or IP Address, as well as the Registration Key you specified when you registered the device. Remember this is a simple key that you specified, and is not the same as a license key.

Then, use the check boxes to add licensed capabilities to the device. Note that you can only select licenses you have already added to the Cisco Firepower Management Center. Also, you cannot enable certain licenses until you enable others. For example, you cannot enable Control on a device until you first enable Protection.

Because of architecture and resource limitations, not all licenses are supported on all managed devices. However, the setup page does not prevent you from enabling unsupported licenses on managed devices. This is because the Cisco Firepower Management Center does not determine the device model until later. The system cannot enable an invalid license, and attempting to enable an invalid license does not decrement your available license count.

After you enable licenses, click Add to save the device’s registration settings and, optionally, add more devices. If you selected the wrong options or mis-typed a device name, click Delete to remove it. You can then re-add the device.

End User License Agreement

Read the EULA carefully and, if you agree to abide by its provisions, select the check box. Make sure that all the information you provided is correct, and click Apply.

The Cisco Firepower Management Center is configured according to your selections. You are logged into the web interface as the admin user, which has the Administrator role. Continue with step 3. in Initial Setup Page: Cisco Firepower Management Center Virtual, page 13 to complete the initial setup of the Firepower Management Center.

Enabling VMware ToolsVMware Tools is a suite of utilities installed in the operating system of a virtual machine to enhance the performance of the virtual machine and to make possible many of the ease-of-use features of VMware products. The system supports the following plugins on all virtual appliances:

guestInfo

powerOps

Table 1 Default Access Control Policy Applied Per Detection Mode

Detection Mode Default Access Control Policy

Inline Default Intrusion Prevention

Passive Default Intrusion Prevention

Access Control Default Access Control

Network Discovery Default Network Discovery

16


Next Steps

timeSync

vmbackup

snapshot

For more information on the supported plugins and full functionality of VMware Tools, see the VMware website (http://www.vmware.com/).

After you setup your virtual appliance, you can enable VMware Tools on your virtual appliances on your managed device using the command line interface (CLI) or on your virtual Firepower Management Center using your browser. For more information; see Configuring VMware Tools on a Firepower Management Center Virtual, page 17.

Configuring VMware Tools on a Firepower Management Center Virtual

You can select or clear a check box on the Configuration menu using the web interface. You cannot enable VMware Tools on a virtual Cisco Firepower Management Center using the CLI.

To enable or disable VMware Tools on a Cisco Firepower Management Center Virtual:

1. Using a web browser, log into your Cisco Firepower Management Center and select System > Configuration > VMware Tools, then select or clear the Enable VMware Tools check box and click Save.

Next StepsAfter you complete the initial setup process for a virtual appliance and verify its success, Cisco recommends that you complete various administrative tasks that make your deployment easier to manage. You should also complete any tasks you skipped during the initial setup, such as device registration and licensing. For detailed information on any of the tasks described in the following sections, as well as information on how you can begin to configure your deployment, see the Firepower System Configuration Guide.

Individual User Accounts

After you complete the initial setup, the only user on the system is the admin user, which has the Administrator role and access. Users with that role have full menu and configuration access to the system, including via the shell or CLI. Cisco recommends that you limit the use of the admin account (and the Administrator role) for security and auditing reasons.

Creating a separate account for each person who will use the system allows your organization not only to audit actions and changes made by each user, but also to limit each person’s associated user access role or roles. This is especially important on the Cisco Firepower Management Center, where you perform most of your configuration and analysis tasks. For example, an analyst needs access to event data to analyze the security of your network, but may not require access to administrative functions for the deployment.

The system includes ten predefined user roles designed for a variety of administrators and analysts. You can also create custom user roles with specialized access privileges.

Health and System Policies

By default, all appliances have an initial system policy applied. The system policy governs settings that are likely to be similar for multiple appliances in a deployment, such as mail relay host preferences and time synchronization settings. Cisco recommends that you use the Firepower Management Center to apply the same system policy to itself and all the devices it manages.


Any Any Management Center Virtual

Any Admin

17


Next Steps

By default, the Firepower Management Center also has a health policy applied. A health policy, as part of the health monitoring feature, provides the criteria for the system continuously monitoring the performance of the appliances in your deployment. Cisco recommends that you use the Firepower Management Center to apply a health policy to all the devices it manages.

Software and Database Updates

You should update the system software on your appliances before you begin any deployment. Cisco recommends that all the appliances in your deployment run the most recent version of the Firepower System. If you are using them in your deployment, you should also install the latest intrusion rule updates, VDB, and GeoDB.

Caution: Before you update any part of the Firepower System, you must read the release notes or advisory text that accompanies the update. The release notes provide important information, including supported platforms, compatibility, prerequisites, warnings, and specific installation and uninstallation instructions.

18

Cisco Firepower Virtual Appliances for VMware Deployment Examples

Using virtual devices and virtual Cisco Firepower Management Centers allows you to deploy security solutions within your virtual environment for increased protection of both physical and virtual assets. Virtual devices and virtual Cisco Firepower Management Centers enable you to easily implement security solutions on the VMware platform. Virtual devices also make it easier to deploy and manage devices at remote sites where resources may be limited.

In these examples, you can use a physical or virtual Cisco Firepower Management Center to manage your physical or virtual devices. You can deploy on a IPv4 or IPv6 network. You can also configure multiple management interfaces on the Cisco Firepower Management Center to isolate and monitor two different networks, or to separate internal and event traffic on a single network. Note that virtual devices do not support multiple management interfaces.

You can configure a second management interface on your virtual Cisco Firepower Management Center to improve performance or to manage traffic separately on two different networks. Configure an additional interface and an additional virtual switch to connect the second management interface to a managed device on the second network. To add a second management interface to your virtual appliance, see VMware vSphere (http://vmware.com). For more information about multiple management interfaces, see Managing Devices in the Firepower System Configuration Guide.

Caution: Cisco strongly recommends that you keep your production network traffic and your trusted management network traffic on different network segments. You must take precautions to ensure the security of the appliances and the management traffic data stream.

Typical Firepower System DeploymentIn a physical appliance environment, a typical Firepower System deployment uses physical devices and a physical Cisco Firepower Management Center. The following graphic displays a sample deployment. You can deploy Device_A and Device_C in an inline configuration and Device_B in a passive configuration, as shown below.

19


http://vmware.com

http://vmware.com


Virtual Firepower Appliance Deployments on VMware

You can configure port mirroring on most network switches to send a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection. Also called Switch Port Analyzer or SPAN by a major network equipment provider, port mirroring allows you to monitor network traffic. Note that Device_B monitors the traffic between Server_A and Server_B via a SPAN port on the switch between Server_A and Server_B.


Adding Virtualization and a Virtual DeviceYou can replace the physical internal servers in our Typical Firepower System Deployment, page 19 by using virtual infrastructure. In the following example, you can use an ESXi host and virtualize Server_A and Server_B.

You can use a virtual device to monitor the traffic between Server_A and Server_B.

The virtual device sensing interface must connect to a switch or port group that accepts promiscuous mode traffic, as shown below.

20



Note: To sense all traffic, allow promiscuous mode traffic on the virtual switches or port groups where the device sensing interfaces connect.

Although our example shows only one sensing interface, two sensing interfaces are available by default on your virtual device. The virtual device management interface connects to your trusted management network and your Cisco Firepower Management Center.

Using the Virtual Device for Inline DetectionYou can provide a secure perimeter around virtual servers by passing traffic through your virtual device’s inline interface set. This scenario builds on the Typical Firepower System Deployment, page 19 and on the example shown in Adding Virtualization and a Virtual Device, page 20.

First, create a protected virtual switch and connect it to your virtual servers. Then, connect the protected switch through your virtual device to the external network. For more information, see the Firepower System Configuration Guide.

21



Note: To sense all traffic, allow promiscuous mode traffic on the virtual switches or port groups where the device sensing interfaces connect.

The virtual device monitors and drops any malicious traffic to Server_A and Server_B, depending on your intrusion policy.

Adding a Cisco Firepower Management Center VirtualYou can deploy a Cisco Firepower Management Center Virtual on an ESXi host and connect it to the virtual network as well as the physical network, as shown below. This scenario builds on the Typical Firepower System Deployment, page 19 and on the example shown in Using the Virtual Device for Inline Detection, page 21.

The connection from a Firepower Management Center Virtual through NIC2 to the trusted management network allows the Firepower Management Center Virtual to manage both physical and virtual devices.

Because Cisco virtual appliances are preconfigured with the required application software, they are ready to run when deployed on an ESXi host. This diminishes complex hardware and software compatibility issues so you can accelerate your deployment and concentrate on the benefits of a Firepower System. You can deploy virtual servers, a Firepower Management Center Virtual, and a virtual device on an ESXi host and manage the deployment from the Firepower Management Center Virtual, as shown below.

22



Your sensing connection on your virtual device must be allowed to monitor network traffic. The virtual switch, or the port group on that switch to which the virtual interface connects, must accept promiscuous mode traffic. This permits the virtual device to read packets intended for other machines or network devices. In the example, the P Port Group is set to accept promiscuous mode traffic.

Your virtual appliance management connections are more typical, non-promiscuous mode connections. The virtual Firepower Management Center provides command and control for the virtual device. The connection through the ESXi host’s Network Interface Card (NIC2 in our example) allows you to access the virtual Firepower Management Center. See Automating Firepower Management Center Virtual Network Settings, page 12 and the Cisco NGIPSv Quick Start Guide for VMware for information on setting up the Firepower Management Center Virtual and the virtual device management connections.

Using a Remote Office DeploymentA virtual device is an ideal way to monitor a remote office with limited resources. You can deploy a virtual device on an ESXi host and monitor local traffic, as shown below.

23



Your sensing connection on your virtual device must be allowed to monitor network traffic. To do this, the virtual switch, or port group on the switch to which the sensing interface connects, must accept promiscuous mode traffic. This permits the virtual device to read packets intended for other machines or network devices. In our example, all of vSwitch3 is set to accept promiscuous mode traffic. VSwitch3 is also connected through NIC3 to the SPAN port so that it can monitor traffic as it passes through the remote office’s switch.

Your virtual device must be managed by a Firepower Management Center. The connection through the ESXi host’s Network Interface Card (NIC2 in our example) allows you to access the virtual device with a remote Firepower Management Center.

When deploying devices in disparate geographic locations, you must take precautions to ensure the security of the devices and the data stream by isolating the devices from unprotected networks. You can do this by transmitting the data stream from the device over a VPN or another secure tunneling protocol.

24

Cisco Firepower Virtual Appliances for VMware Troubleshooting

This section provides information about the most common setup issues, as well as where to submit questions or obtain assistance.

Time SynchronizationIf your health monitor indicates that the clock setup for your virtual appliance is not synchronized, check your system policy time synchronization settings. Cisco recommends that you synchronize your virtual appliances to a physical NTP server. Do not synchronize your managed devices (virtual or physical) to a Virtual Cisco Firepower Management Center. To ensure your time synchronization is set up correctly, see Synchronizing Time in the Firepower System Configuration Guide. After you determine that the clock setup for your virtual appliance is correct, contact your ESXi host administrator and ensure that the server’s time configuration is correct.

Caution: If you set up a Firepower Management Center Virtual on VMware with manual time, it will (by default) take time from the host. Although you can configure an ESX/ESXi host as an NTP server, it is not a VMware best practice to do so. VMware considers it best practice to have your ESX/ESXi hosts configured to an authoritative time (NTP) server.

Performance IssuesIf you are having performance issues, remember that there are several factors that affect your virtual appliance. See Virtual Appliance Performance, page 4 for a list of the factors that may affect your performance. To monitor ESXi host performance, you can use your vSphere Client and the information found under the Performance tab.

Connectivity IssuesYou can view and confirm connectivity for the management and sensing interfaces using the vSphere Client.

Using vSphere ClientYou can use vSphere Client to confirm that the management connection and sensing interfaces are properly connected.

Management Connection

During initial setup, it is important to ensure that network adapter connects at power on. If you do not, the initial management connection setup cannot properly complete and ends with the message:

ADDRCONF (NETDEV_UP): eth0: link is not ready

To ensure that the management connection is connected:

1. Right-click the name of the virtual appliance in the vSphere Client and select Edit Settings. Select Network adapter 1 in the Hardware list and make sure the Connect at power on check box is selected.

25



Inline Interface Configurations

When the initial management connection completes properly, check the /var/log/messages directory for this message:

ADDRCONF (NETDEV_CHANGE): eth0: link becomes ready

Sensing Interfaces

During initial setup, it is important to ensure that sensing interfaces connect at power on.

To ensure that the sensing interfaces connect at power on:

1. Right-click the name of the virtual device in the vSphere Client and select Edit Settings. Select Network adapter 2 and Network adapter 3 in the Hardware list. Make sure the Connect at power on check box is selected for each adapter in use.

You must connect your virtual device sensing interfaces to a virtual switch or virtual switch group that accepts promiscuous mode traffic. If it is not, your device can detect only broadcast traffic.

What to Do Next

See the Cisco NGIPSv Quick Start Guide for VMware for information on how to ensure your sensing interfaces detect all exploits.

Inline Interface ConfigurationsYou can verify that your inline interfaces are symmetrical and that traffic is flowing between them. To open the VMware console to your virtual device, use the vSphere Client.

To ensure that the inline sensing interfaces are configured properly:

1. At the console, log in as a user with CLI Configuration (Administrator) privileges.

2. Type expert to display the shell prompt.

3. Enter the command: cat /proc/sf/sfe1000.*

A text file appears with information similar to this example:

SFE1000 driver for eth1 is Fast, has link, is bridging, not MAC filtering, MAC timeout 7500, Max Latency 0. 39625470 packets received. 0 packets dropped by user. 13075508 packets sent.0 Mode 1 LB Total 0 Bit 000.....SFE1000 driver for eth2 is Fast, has link, is bridging, not MAC filtering, MAC timeout 7500, Max Latency 0. 13075508 packets received. 0 packets dropped by user. 39625470 packets sent.0 Mode 1 LB Total 0 Bit 00

Note that the number of packets received on eth1 matches those sent from eth2 and those sent from eth1 match those received on eth2.

4. Log out of the virtual device.

5. Optionally, and if direct routing to the protected domain is supported, ping the protected virtual appliance where the inline interface of the virtual device is connected.

Pings return to indicate there is connectivity through the inline interface set of the virtual device.

26


For Assistance

For AssistanceThank you for using Cisco products.

Cisco Support

If you have any questions or require assistance with the Cisco ASA appliances, please contact Cisco Support:

Visit the Cisco Support Site at http://www.cisco.com/cisco/web/support/index.html.

Email Cisco Support at [email protected].

Call Cisco Support at 1.408.526.7209 or 1.800.553.2447.

27

http://www.cisco.com/cisco/web/support/index.html


For Assistance

28

cisco firepower management center virtual for vmware ... · vmware workstation, player, server, and...

Documents