fmc - // A Networking Blog

Firepower Threat Defense – Interfaces and Zones

Our WAN/Outside will be our untrusted traffic.
We will use DHCP to get an IP address leased from the internet service provider.

Our LAN interface will be for our internal (inside) traffic.
We will use a static IP address and this port will be a routed interface that is connected to a routed port on our Cisco switch.
You can have different designs and use sub interfaces with dot1q trunking but I prefer to use as much layer 3 that I can.

We are using OSPF for our routing protocol.
We will advertise all of our inside networks and keep everything in the backbone.
We are going to be a normal router, we don’t need stub or not-so-stubby – we are an internal router.
We don’t need to worry about range or virtual links.

A network object represents one or more IP addresses. Network objects are used in various places, including access control policies, network variables, intrusion rules, identity rules, network discovery rules, event searches, reports, and so on.
It is a good idea to create objects for each VLAN
If possible creating objects for individual devices may be required.
It is a good idea to be as granular as possible because this will allow for flexibility and scalability to your rules offering more insights on what is happening within your network.

After the individual objects are created we will create a network group object that will encompass all of our internal network.
This group object will be used throughout our policy creation.

Port objects or groups represent different protocols. You can use port objects and groups in various places in the systems web interface, including access control policies, identity rules, network discovery rules, port variables, and event searches.
Just like our network objects we can create layer4 tcp/udp objects that will be used in the same manner.
You can also add service ports in the ACP when creating access control policies but they will not have a descriptive name.

Interface objects segment your network to help you manage and classify traffic flow. An interface object simply groups interfaces. These groups may span multiple devices; you can also configure multiple interface objects on a single device.
FTD is a zone based system creating security zones allows for easier management.

Application filters help you perform application control by organizing applications according to basic characteristics: type, risk, business relevance, category, and tags.

This can be used as a way to block web sites if you don’t have a license for URL filtering (This feature is included with the base license.
Add the selected filters.
You can choose the applications you want selected if you don’t want to choose all.
Add to Rule.
Save the new application filter.

Variables represent values commonly used in intrusion rules to identify source and destination IP addresses and ports.You can also use variables in intrusion policies to represent IP addresses in rule suppressions, adaptive profile updates, and dynamic rule states.
Now we will edit our HOME_NET variable from ‘any’ to our network group object we created earlier.
This will help give a better insight and more security.

Update the new group object into the Included Networks list to remove the ‘any’ object.

After saving the new object we can see it has been applied and our new variable set has been created.

Health policies and alerts are an important part of managing devices.
At the top right corner of FMC we can see that their is currently an alert which is being generated because I am using a demo license.
The FMC is making a ‘call’ every 5 minutes and Cisco is replying that I’m not worthy!
Let’s disable that since this is a lab environment and you would not want to do this for production but I’m annoyed with seeing red.

The monitor gives us a break down of the health monitors that are hitting counters.

Disable the Smart licensing status monitor by selecting off and then saving the configuration.

The SNMP/SYSLOG alerts should now be live once we have selected all modules we want, the severity at which they are defined and the alerts we choose.

Setting up a syslog server prevents allowing another user on the FMC to delete the logs. This also keeps a backup of your logs.
Set the ‘send audit to syslog’ as enabled
enter in the sys log serves IP address for the host.
Change the faility to SYSLOG
Set severity to what you would like.
Test the syslog server and then Save once verified it’s working.

You will be greeted with a Sucess message after the configuration change has took affect.

Create a login banner with whatever login greeting you would like.
It is a good idea to display an authorization warning for the login banner or any message you would like users to see once logged into the FMC.
Save the login banner once completed.