Cisco ASA Quick start guide

Cisco ASA Firepower Module

Easy Setup Guide

1 Preconfiguring

2 Configuring Security Policy

3 Updating Database

4 Reporting & Monitoring

You can easily set up your ASA Firepower Module

in this step-by-step guide

This guide provides information about basic configuration of security policies (ac-

cess control policies) on the Cisco ASA Firepower module, using the Cisco Adap-

tive Security Device Manager (ASDM). Before proceeding, make sure that you have

completed the initial configuration of the Cisco ASA with Firepower Services, refer

to the separate "Cisco ASA with Firepower Services Easy Setup Guide" and so on.

Some configurations in this guide require having optional licenses installed. In those

cases, "MEMO" or "Caution" columns specify the necessary licenses.

The Cisco ASA with Firepower Services ship with a base license for Application

Visibility and Control (AVC). Optional subscriptions for Next-Generation IPS

（N-

GIPS）

, Cisco Advanced Malware Protection

（AMP）

, and URL Filtering (URL) can

be added to the base configuration for advanced functionality.

●AVC

：

Supports more than 3,000 application-layer and risk-based controls that

can launch tailored intrusion prevention system (IPS) threat detection policies to

optimize security effectiveness.

●NGIPS

：

Provides highly effective threat prevention and full contextual awareness

of users, infrastructure, applications, and content to detect multivector threats

and automate defense response.

●AMP

：

Delivers inline network protection against sophisticated malware and Cisco

Threat Grid sandboxing.

●URL

：

Adds the capability to filter more than 280 million top-level domains by risk

level and more than 82 categories.

Redirect traffic to the ASA Firepower module by creating a service policy on the

ASA that identifies specific traffic that you want to send.

Preconfiguring

1-1 Before You Begin

1-2 Configuring Service Policy

11Click [Configuration].

2Click [Firewall].

Optional Licenses

Characters

Included

in SKU

NGIPS AMP URL

NGIPS License TA ●- -

AMP License AMP - ●-

URL License URL - - ●

NGIPS & AMP License TAM ● ● -

NGIPS & URL License TAC ●-●

NGIPS & AMP & URL License TAMC ●●●

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

8Click [ASA FirePOWER

Inspection].

5Click [Next].

Use the default [Global - applies

to all interfaces]. This option ap-

plies the service policy globally

to all interfaces.

3Click [Service Policy

Rules].

4Click [Add Service Policy

Rule] from the [Add] menu

bar.

6Click [Use class-default as

the traffic class].

7Click [Next].

9Click [Enable ASA Fire-

POWER for this traffic

flow].

10 Click [Permit traffic] or

[Close traffic].

The [Permit traffic] sets the

ASA to allow all traffic through,

uninspected, if the module is

unavailable. The [Close traffic]

sets the ASA to block all traffic if

the module is unavailable.

11 Click [Finish].

Cisco ASA Firepower Module Easy Setup Guide

1Preconfiguring

Create file policies to configure the system to perform malware protection and file

control as part of your overall access control configuration. The file policies that

you create here will be used in ”2-2 Configuring Access Control Policy: Visual-

ization”.

Configuring Security Policy

2-1 Configuring File Policy: Blocking Malware

1Click [ASA FirePOWER

Configuration].

2Click [Policies].

3Click [Files].

4Click [New File Policy].

The [New File Policy] pop-up

window appears.

5Enter a name for your new

policy in the [Name] field.

6Click [Store ASA Fire-

POWER Changes].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

7Click [Add File Rule].

The [Add File Rule] pop-up win-

dow appears.

8Click [Block Malware]

from the [Action] drop-

down list.

9Select one or more [File

Types].

10 Click [Add].

You can select one or more [File

Type Categories] and search for

a file type by its name or de-

scription.

11 Click [Store ASA Fire-

POWER Changes].

12 Click [Store ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

Caution

At step ❽, the rule actions [Malware Cloud Lookup].and

[Block Malware] require the NGIPS License or the AMP

License. If you donʼt have these licenses, select the rule

actions [Detect Files].or [Block Files].

●Detect Files rules allow you to log the detection of

specific file types while still allowing their transmis-

sion.

●Block File rules allow you to block specific file types.

●Malware Cloud Lookup rules allow you to log the

malware disposition of files traversing your network

based on a cloud lookup, while still allowing their

transmission.

●Block Malware rules allow you to calculate the SHA-

256 hash value of specific file types, then use a cloud

lookup process to first determine if files traversing

your network contain malware, then block files that

represent threats.

MEMO

You can set separate rules within a file policy to take different actions for different file types,

application protocols, or directions of transfer. If you want to do so, repeat the steps ❼to ⓫.

By editing the [Default Allow All Traffic] policy that the system provides by default,

configure access control rules to exert granular control over network traffic logging

and handling (visualization).

2-2 Configuring Access Control Policy: Visualization

1Click [Access Control

Policy].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Click the edit icon ( )

next to the [Default Allow

All Traffic] policy.

3Click [Add Rule].

The [Add Rule] pop-up window

appears.

4Enter a name for your new

rule in the [Name] field.

5Click [Inspection].

9Click [Log at End of Con-

nection].

10 Click [Add].

11 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

12 Click [Apply All].

6Select [Connectivity Over

Security] from the [Intru-

sion Policy] drop-down

list.

7Select the policy name of

the step 2-1 ❺from the

[File Policy] drop-down

list.

8Click [Logging].

Caution

At step ❻, the intrusion policies [Connectivity Over Security] and so on require the NGIPS Li-

cense. If you donʼt have this license, select the [None].

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

2Enter a name for your new

rule in the [Name] field.

3Select [Block] from the

[Action] drop-down list.

4Select [above rule] from

the [Insert] drop-down

list.

5Click [Applications].

6Select one or more [Avail-

able Applications].

7Click [Add to Rule].

You can select one or more

[Application Filters] and search

for a application by its name or

description.

8Click [URL].

910

9Select one or more

[Categories and URLs].

10 Select one [Reputations].

11 Click [Add to Rule].

If you do not specify a reputa-

tion level, the system defaults to

[Any], meaning all levels.

12 Click [Logging].

1Click [Add Rule].

The [Add Rule] pop-up window

appears.

Because the [Default Allow All Traffic] allows all traffic through, configure access

control rules to block specific traffic, for example, application or web traffic that is

high risk or has low business relevance.

2-3 Configuring Access Control Policy: Blocking

13 Click [Log at Beginning

and End of Connection].

14 Click [Add].

Caution

At step ❿, the URL reputation requires the URL License. And you can only select one reputa-

tion level. Selecting a reputation level also selects all reputations more severe than that level.

For example, if you configure a rule to block [Suspicious sites] (level 2), it also automatically

blocks [High Risk] (level 1) sites.

Cisco ASA Firepower Module Easy Setup Guide

2Configuring Security Policy

15 Click [Apply ASA Fire-

POWER Changes].

The [Apply Access Control Poli-

cy] pop-up window appears.

16 Click [Apply All].

As new vulnerabilities become known, Cisco releases rule updates that you can

first import onto your ASA Firepower module, then implement by applying affected

access control, network analysis, and intrusion policies.

Rule updates are cumulative, and Cisco recommends you always import the latest

update.

1Click [Updates].

2Click [Rule Updates].

Updating Database

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

3Select [Download new

Rule Update from the

Support Site] and click

two options below.

4Click [Import].

The system installs the rule up-

date.

5Click [Enable Recurring

Rule Update Imports].

The page expands to display

options for configuring recurring

imports.

6Select import frequency

and click two options be-

low.

We recommend [Daily].

7Click [Save].

8Click [Geolocation Up-

dates].

9Click [Download and install

geolocation update from

the Support Site].

10 Click [Import].

The update process begins.

The average duration of update

installation is 30 to 40 minutes.

11 Click [Enable Recurring

Weekly Updates].

The page expands to display

options for configuring recurring

imports.

12 Specify the time and day of

the week when you want

weekly GeoDB updates to

occur.

13 Click [Save].

13 12

Cisco ASA Firepower Module Easy Setup Guide

3Configuring Security Policy

The Cisco Adaptive Security Device Manager (ASDM) provides many useful report-

ing and monitoring features to assist you in the daily administration of your system.

Reporting & Monitoring

4-2 Monitoring the System

1Click [Monitoring].

2Click [ASA FirePOWER

Monitoring].

4 -1 Viewing Reports

1Click [Home].

2Click [ASA FirePOWER

Reporting].

3Click individual items to get

more detailed information.

4Click individual items to get

more detailed information.

3Click [Real Time Eventing].

Cisco ASA Firepower Module Easy Setup Guide

4Reporting & Monitoring

Table of contents

Other Cisco Network Hardware manuals

Cisco

Cisco Gigabit Switch Router Cisco 12012 User manual

Cisco

Cisco Aironet 1000 Series Manual

Cisco

Cisco S170 Web User manual

Cisco

Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet... Operator's manual

Cisco

Cisco ON100 Network Agent User manual

Cisco

Cisco Network Adapter VIP-FE-TX/4E Operator's manual

Cisco

Cisco SCE 2000 4/8xFE User manual

Cisco

Cisco ONS 15454 DWDM User manual

Cisco

Cisco NCS 1001 Guide

Cisco

Cisco NSS4100 - Gigabit Storage System Instruction Manual

Cisco

Cisco Firepower 9300 Maintenance and service guide

Cisco

Cisco Engine 611 User manual

Cisco

Cisco ONS 15454 User manual

Cisco

Cisco ATM Cable Interface Processor ACIP-SM(=) Operator's manual

Cisco

Cisco NTP-E157 Parts list manual

Cisco

Cisco NAC3350-PROF-K9 - NAC Profiler Server User manual

Cisco

Cisco ISA500 Series Instruction Manual

Cisco

Cisco MERAKI MX75 User manual

Cisco

Cisco Linksys WES610N User manual

Cisco

Cisco PRISMA II XD User manual

Cisco

Cisco Nexus 93600CD-GX Manual

Cisco

Cisco IAD2430 Series Manual

Cisco

Cisco CVPN3015-NR - VPN Concentrator 3015 User manual

Cisco

Cisco UCS X10c Installation and maintenance instructions

Popular Network Hardware manuals by other brands

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL product manual

B&B Electronics

B&B Electronics ZXT9-IO-222R2 product manual

Yudor

Yudor YDS-16 user manual

D-Link

D-Link ShareCenter DNS-320L datasheet

Samsung

Samsung ES1642dc Hardware user manual

Honeywell Home

Honeywell Home LTEM-PV Installation and setup guide

evertz

evertz 7700 Series manual

D-Link

D-Link ShareCenter DNS-343 Quick installation guide

Asante

Asante AsanteBridge 1012 user guide

FireBrick

FireBrick FB2700 user manual

Audiovox Electronics

Audiovox Electronics ARWH2T user manual

ADC

ADC DSX-1 Operational Procedures Guide

NetComm

NetComm NF2 user guide

Alcatel-Lucent

Alcatel-Lucent 5620 user guide

Dell EMC

Dell EMC XC6420 Series Solution guide

Lanner

Lanner NCA-1020A user manual

Allied Telesis

Allied Telesis AT-TN121-A Specifications

Arista

Arista CCA-ETM-Q12 quick start guide