Cisco Firepower 4100, Firepower 9300 Firepower Security Appliance Configuration Guide

Logical Devices
• About Logical Devices, page 1
• Create a Standalone Logical Device, page 3
• Deploy a Cluster, page 7
• Configure Service Chaining, page 23
• Manage Logical Devices, page 27
About Logical Devices
When you create a logical device, the Firepower 4100/9300 chassis supervisor deploys the logical device by
downloading the specified software version and pushing the bootstrap configuration and management interface
settings to the specified security module/engine, or in the case of an intra-chassis cluster, to all security modules
installed in the Firepower chassis.
You can create either of the following two types of logical devices:
• Standalone—You can create a standalone logical device for each security module/engine installed in
the Firepower chassis.
• Cluster—Clustering lets you group multiple security modules together as a single logical device. A
cluster provides all the convenience of a single device (management, integration into a network) while
achieving the increased throughput and redundancy of multiple devices. Multiple module devices, like
the Firepower 9300, support intra-chassis clustering.
Note
On an Firepower 4100/9300 chassis that supports multiple security modules, you can only create one type
of logical device, standalone or cluster. In other words, if you have three security modules installed, you
cannot create a standalone logical device on one security module and then create a cluster using the
remaining two logical devices.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
1
Logical Devices
Logical Devices Page
Note
If you are configuring standalone logical devices, you must install the same software type on all modules
in the chassis; different software types are not supported at this time. Note that modules can run different
versions of a particular device type, but all modules must be configured as the same type of logical device.
Logical Devices Page
Use the Logical Devices page of the Firepower Chassis Manager to create, edit, and delete logical devices.
The Logical Devices page includes an informational area for the logical device(s) installed on each Firepower
4100/9300 chassis security module/engine.
The header for each logical device area provides the following information:
• The unique name of the logical device.
• The name of the main application installed on the security module/engine, either ASA or FTD.
• The logical device mode, either Standalone or Clustered.
• Status—Shows the state of the logical device:
◦ok—The logical device configuration is complete.
◦incomplete-configuration—The logical device configuration is incomplete.
Each logical device area provides the following information:
• Security Module—Shows the security module.
• Ports—Shows the ports assigned to the application instance.
• Application—Shows the application running on the security module.
• Version—Shows the software version number of the application running on the security module.
Note
Updates to Firepower Threat Defense logical devices are done using Firepower
Management Center and are not reflected on the Logical Devices > Edit and System
> Updates pages in Firepower Chassis Manager. On these pages, the version shown
indicates the software version (CSP image) that was used to create the Firepower Threat
Defense logical device.
• Management IP—Shows the local IP address assigned as the logical device Management IP.
• Management URL—Shows the management URL assigned to the application instance.
• Gateway—Shows the network gateway address assigned to the application instance.
• Management Port—Shows the management port assigned to the application instance.
• Status—Shows the state of the application instance:
◦Online—The application is running and operating.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
2
Logical Devices
Create a Standalone Logical Device
◦Offline—The application is stopped and inoperable.
◦Installing—The application installation is in progress.
◦Not Installed—The application is not installed.
◦Install Failed—The application installation failed.
◦Starting—The application is starting up.
◦Start Failed—The application failed to start up.
◦Started—The application started successfully, and is waiting for app agent heartbeat.
◦Stopping—The application is in the process of stopping.
◦Stop Failed—The application was unable to be brought offline.
◦Not Responding—The application is unresponsive.
◦Updating—The application software upgrade is in progress.
◦Update Failed—The application software upgrade failed.
◦Update Succeeded—The application software upgrade succeeded.
Create a Standalone Logical Device
You can create a standalone logical device for each security module/engine installed in the Firepower chassis.
Create a Standalone ASA Logical Device
You can create a standalone logical device for each security module/engine installed in the Firepower 4100/9300
chassis. On multiple module devices, like the Firepower 9300, you cannot create standalone logical devices
if you have a cluster configured. You will need to delete the cluster before you can configure a standalone
device.
Note
Optionally, you can install the third-party Radware DefensePro virtual platform as a DDoS detection and
mitigation service that sits in front of the ASA firewall on the security module (see About Service Chaining,
on page 23).
Note
You must install the same software type on all modules in a chassis; different software types are not
supported at this time. Note that modules can run different versions of a particular device type, but all
modules must be configured as the same type of logical device.
Before You Begin
• If the security module/engine that you want to use for the logical device already has a logical device
configured on it, you must first delete the existing logical device (see Delete a Logical Device, on page
28).
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
3
Logical Devices
Create a Standalone ASA Logical Device
• Download the application image you want to use for the logical device from Cisco.com (see Downloading
Images from Cisco.com) and then upload that image to the Firepower 4100/9300 chassis (see Uploading
an Image to the Firepower Security Appliance).
• Configure a management interface to use with the logical device.
• You can only deploy a routed firewall mode ASA from the Firepower 4100/9300 chassis. To change
the ASA to transparent firewall mode, complete this procedure, and then see Change the ASA to
Transparent Firewall Mode, on page 28.
Procedure
Step 1
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have
been configured, a message stating so is shown instead.
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Click Add Device to open the Add Device dialog box.
For the Device Name, provide a name for the logical device.
For the Template, choose Cisco Adaptive Security Appliance.
For the Image Version, choose the ASA software version.
For the Device Mode, click the Standalone radio button.
Click OK.
You see the Provisioning - device name window.
Step 8
Step 9
Expand the Data Ports area, and click each port that you want to assign to the device.
Click the device icon in the center of the screen.
The ASA Configuration dialog box appears.
Step 10 On the General Information tab, complete the following:
a) On multiple module devices, like the Firepower 9300, choose the security module that you want to use
for this logical device by clicking on it under Security Module Selection.
b) Select the management interface to use with the logical device from the Management Interface drop-down
list.
c) Under DEFAULT, configure the management interface:
This information is used to configure a management interface in the security module/engine configuration.
This management IP address is also the IP address you will use to connect to ASDM.
1 Select the type of address from the Address Type drop-down list.
2 In the Management IP field, configure a local IP address.
3 Enter a Network Mask or Prefix Length.
4 Enter a Network Gateway address.
Step 11 On the Settings tab, enter a password for the "admin" user in the Password field.
Step 12 Click OK to close the ASA Configuration dialog box.
Step 13 Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
4
Logical Devices
Create a Standalone Threat Defense Logical Device
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software
version and pushing the bootstrap configuration and management interface settings to the specified security
module/engine.
Create a Standalone Threat Defense Logical Device
You can create a standalone logical device for each security module/engine installed in the Firepower 4100/9300
chassis. On multiple module devices, like the Firepower 9300, you cannot create standalone logical devices
if you have a cluster configured. You will need to delete the cluster before you can configure a standalone
device.
Note
You must install the same software type on all modules in a chassis; different software types are not
supported at this time. Note that modules can run different versions of a particular device type, but all
modules must be configured as the same type of logical device.
Before You Begin
• If the security module/engine that you want to use for the logical device already has a logical device
configured on it, you must first delete the existing logical device (see Delete a Logical Device, on page
28).
• Download the application image you want to use for the logical device from Cisco.com (see Downloading
Images from Cisco.com) and then upload that image to the Firepower 4100/9300 chassis (see Uploading
an Image to the Firepower Security Appliance).
• Configure a management interface to use with the logical device. You must also configure at least one
Data type interface. Optionally, you can also create a firepower-eventing interface to carry all event
traffic (such as web events).
Procedure
Step 1
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have
been configured, a message stating so is shown instead.
Step 2
Step 3
Click Add Device to open the Add Device dialog box.
For the Device Name, provide a name for the logical device.
This name is used by the Firepower 4100/9300 chassis supervisor to configure management settings and to
assign interfaces; it is not the device name used in the security module/engine configuration.
Step 4
Step 5
Step 6
Step 7
For the Template, choose Cisco Firepower Threat Defense.
For the Image Version, choose the Threat Defense software version.
For the Device Mode, click the Standalone radio button.
Click OK.
You see the Provisioning - device name window.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
5
Logical Devices
Create a Standalone Threat Defense Logical Device
Step 8
Expand the Data Ports area, and click each port that you want to assign to the device.
Hardware Bypass-capable ports are shown with the following icon:
. If you do not assign both interfaces
in a Hardware Bypass pair, you see a warning message to make sure your assignment is intentional. You do
not need to use the Hardware Bypass feature, so you can assign single interfaces if you prefer.
Step 9
Click the device icon in the center of the screen.
The configuration dialog box appears.
Step 10 On the General Information tab, complete the following:
a) On multiple module devices, like the Firepower 9300, choose the security module that you want to use
for this logical device by clicking on it under Security Module Selection.
b) Select the management interface to use with the logical device from the Management Interface drop-down
list.
If you assign a Hardware Bypass-capable interface as the Management interface, you see a warning message
to make sure your assignment is intentional.
c) Under Management, configure the management interface:
1 Select the type of address from the Address Type drop-down list.
2 In the Management IP field, configure a local IP address.
3 Enter a Network Mask or Prefix Length.
4 Enter a Network Gateway address.
Step 11 On the Settings tab, complete the following:
a) In the Registration Key field, enter the key to be shared between Firepower Management Center and the
device during registration.
b) In the Password field, enter a password for the device.
c) In the Firepower Management Center IP field, enter the IP address of the managing Firepower
Management Center.
d) In the Search Domains field, enter a comma-separated list of search domains for the device.
e) Choose the firewall mode: Transparent or Routed.
f) In the DNS Servers field, enter a comma-separated list of DNS servers for the device to use.
g) In the Fully Qualified Hostname field, enter a fully qualified name for the Threat Defense device.
h) Choose the interface on which Firepower events should be sent. If not specified, the management interface
will be used.
To specify an interface to use for Firepower events, you must configure an interface as a firepower-eventing
interface. For more information, see About Firepower Security Appliance Interfaces.
Step 12 On the Agreement tab, read and accept the end user license agreement (EULA).
Step 13 Click OK to close the configuration dialog box.
Step 14 Click Save.
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software
version and pushing the bootstrap configuration and management interface settings to the specified security
module/engine.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
6
Logical Devices
Deploy a Cluster
Deploy a Cluster
Clustering lets you group multiple devices together as a single logical device. A cluster provides all the
convenience of a single device (management, integration into a network) while achieving the increased
throughput and redundancy of multiple devices. The Firepower 9300, which includes multiple modules,
supports intra-chassis clustering where you group all modules within a single chassis into a cluster. You can
also use inter-chassis clustering, where multiple chassis are grouped together; inter-chasis clustering is the
only option for single module devices like the Firepower 4100 series.
Note
The Firepower Threat Defense does not support a cluster across multiple chassis (inter-chassis); only
intra-chassis clustering is supported.
About Clustering on the Firepower 4100/9300 Chassis
The cluster consists of multiple devices acting as a single logical unit. When you deploy a cluster on the
Firepower 4100/9300 chassis, it does the following:
• Creates a cluster-control link (by default, port-channel 48) for unit-to-unit communication. For
intra-chassis clustering (Firepower 9300 only), this link utilizes the Firepower 9300 backplane for cluster
communications. For inter-chassis clustering, you need to manually assign physical interface(s) to this
EtherChannel for communications between chassis.
• Creates the cluster bootstrap configuration within the application.
When you deploy the cluster, the Firepower 4100/9300 chassis supervisor pushes a minimal bootstrap
configuration to each unit that includes the cluster name, cluster control link interface, and other cluster
settings. Some parts of the bootstrap configuration may be user-configurable within the application if
you want to customize your clustering environment.
• Assigns data interfaces to the cluster as Spanned interfaces.
For intra-chassis clustering, spanned interfaces are not limited to EtherChannels, like it is for inter-chassis
clustering.The Firepower 9300 supervisor uses EtherChannel technology internally to load-balance
traffic to multiple modules on a shared interface, so any data interface type works for Spanned mode.
For inter-chassis clustering, you must use Spanned EtherChannels for all data interfaces.
Note
Individual interfaces are not supported, with the exception of a management interface.
• Assigns a management interface to all units in the cluster.
The following sections provide more detail about clustering concepts and implementation.
Primary and Secondary Unit Roles
One member of the cluster is the primary unit. The primary unit is determined automatically. All other members
are secondary units.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
7
Logical Devices
About Clustering on the Firepower 4100/9300 Chassis
You must perform all configuration on the primary unit only; the configuration is then replicated to the
secondary units.
Cluster Control Link
The cluster control link is automatically created using the Port-channel 48 interface. For intra-chassis clustering,
this interface has no member interfaces. For inter-chassis clustering, you must add one or more interfaces to
the EtherChannel. This Cluster type EtherChannel utilizes the Firepower 9300 backplane for cluster
communications for intra-chassis clustering.
For a 2-member inter-chassis cluster, do not directly connect the cluster control link from one chassis to the
other chassis. If you directly connect the interfaces, then when one unit fails, the cluster control link fails, and
thus the remaining healthy unit fails. If you connect the cluster control link through a switch, then the cluster
control link remains up for the healthy unit.
Cluster control link traffic includes both control and data traffic.
Size the Cluster Control Link for Inter-Chassis Clustering
If possible, you should size the cluster control link to match the expected throughput of each chassis so the
cluster-control link can handle the worst-case scenarios.
Cluster control link traffic is comprised mainly of state update and forwarded packets. The amount of traffic
at any given time on the cluster control link varies. The amount of forwarded traffic depends on the
load-balancing efficacy or whether there is a lot of traffic for centralized features. For example:
• NAT results in poor load balancing of connections, and the need to rebalance all returning traffic to the
correct units.
• When membership changes, the cluster needs to rebalance a large number of connections, thus temporarily
using a large amount of cluster control link bandwidth.
A higher-bandwidth cluster control link helps the cluster to converge faster when there are membership changes
and prevents throughput bottlenecks.
Note
If your cluster has large amounts of asymmetric (rebalanced) traffic, then you should increase the cluster
control link size.
Cluster Control Link Redundancy for Inter-Chassis Clustering
The following diagram shows how to use an EtherChannel as a cluster control link in a Virtual Switching
System (VSS) or Virtual Port Channel (vPC) environment. All links in the EtherChannel are active. When
the switch is part of a VSS or vPC, then you can connect Firepower 4100/9300 chassis interfaces within the
same EtherChannel to separate switches in the VSS or vPC. The switch interfaces are members of the same
EtherChannel port-channel interface, because the separate switches act like a single switch. Note that this
EtherChannel is device-local, not a Spanned EtherChannel.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
8
Logical Devices
About Clustering on the Firepower 4100/9300 Chassis
Cluster Control Link Reliability for Inter-Chassis Clustering
To ensure cluster control link functionality, be sure the round-trip time (RTT) between units is less than 20
ms. This maximum latency enhances compatibility with cluster members installed at different geographical
sites. To check your latency, perform a ping on the cluster control link between units.
The cluster control link must be reliable, with no out-of-order or dropped packets; for example, for inter-site
deployment, you should use a dedicated link.
Cluster Control Link Network
The Firepower 4100/9300 chassis auto-generates the cluster control link interface IP address for each unit
based on the chassis ID and slot ID: 127.2.chassis_id.slot_id. You cannot set this IP address manually, either
in FXOS or within the application. The cluster control link network cannot include any routers between units;
only Layer 2 switching is allowed. For inter-site traffic, Cisco recommends using Overlay Transport
Virtualization (OTV).
Management Network
We recommend connecting all units to a single management network. This network is separate from the cluster
control link.
Management Interface
You can assign a Management type interface to the cluster. This interface is a special individual interface as
opposed to a Spanned interface. The management interface lets you connect directly to each unit.
For the ASA, the Main cluster IP address is a fixed address for the cluster that always belongs to the current
primary unit. You also configure a range of addresses so that each unit, including the current primary unit,
can use a Local address from the range. The Main cluster IP address provides consistent management access
to an address; when a primary unit changes, the Main cluster IP address moves to the new primary unit, so
management of the cluster continues seamlessly. The Local IP address is used for routing, and is also useful
for troubleshooting. For example, you can manage the cluster by connecting to the Main cluster IP address,
which is always attached to the current primary unit. To manage an individual member, you can connect to
the Local IP address. For outbound management traffic such as TFTP or syslog, each unit, including the
primary unit, uses the Local IP address to connect to the server.
For the Firepower Threat Defense, assign a management IP address to each unit on the same network. Use
these IP addresses when you add each unit to the Management Center.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
9
Logical Devices
About Clustering on the Firepower 4100/9300 Chassis
Spanned EtherChannels
You can group one or more interfaces per chassis into an EtherChannel that spans all chassis in the cluster.
The EtherChannel aggregates the traffic across all the available active interfaces in the channel. A Spanned
EtherChannel can be configured in both routed and transparent firewall modes. In routed mode, the
EtherChannel is configured as a routed interface with a single IP address. In transparent mode, the IP address
is assigned to the BVI, not to the bridge group member interface. The EtherChannel inherently provides load
balancing as part of basic operation.
Inter-Site Clustering
For inter-site installations, you can take advantage of clustering as long as you follow the recommended
guidelines.
You can configure each cluster chassis to belong to a separate site ID.
Site IDs work with site-specific MAC addresses and IP addresses. Packets sourced from the cluster use a
site-specific MAC address and IP address, while packets received by the cluster use a global MAC address
and IP address. This feature prevents the switches from learning the same global MAC address from both
sites on two different ports, which causes MAC flapping; instead, they only learn the site MAC address.
Site-specific MAC addresses and IP address are supported for routed mode using Spanned EtherChannels
only.
Site IDs are also used to enable flow mobility using LISP inspection.
See the following sections for more information about inter-site clustering:
• Sizing the Data Center Interconnect—Prerequisites for Clustering, on page 11
• Inter-Site Guidelines—Guidelines for Clustering, on page 12
• Inter-Site Examples—Examples for Inter-Site Clustering, on page 20
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
10
Logical Devices
Prerequisites for Clustering
Prerequisites for Clustering
Inter-Chassis Hardware and Software Requirements
All chassis in a cluster:
• For the Firepower 4100 series: All chassis must be the same model. For the Firepower 9300: All security
modules must be the same type. You can have different quantities of installed security modules in each
chassis, although all modules present in the chassis must belong to the cluster including any empty slots.
• Must run the identical FXOS software except at the time of an image upgrade.
• Must include the same interface configuration for interfaces you assign to the cluster, such as the same
Management interface, EtherChannels, active interfaces, speed and duplex, and so on. You can use
different network module types on the chassis as long as the capacity matches for the same interface
IDs and interfaces can successfully bundle in the same spanned EtherChannel. Note that all data interfaces
must be EtherChannels in inter-chassis clustering.
• Must use the same NTP server. Do not set the time manually.
• ASA: Each FXOS chassis must be registered with the License Authority or satellite server. There is no
extra cost for secondary units. For permanent license reservation, you must purchase separate licenses
for each chassis. For Firepower Threat Defense, all licensing is handled by the Firepower Management
Center.
Switch Prerequisites for Inter-Chassis Clustering
• Be sure to complete the switch configuration and successfully connect all the EtherChannels from the
chassis to the switch(es) before you configure clustering on the Firepower 4100/9300 chassis.
• For a list of supported switches, see Cisco FXOS Compatibility.
Sizing the Data Center Interconnect for Inter-Site Clustering
You should reserve bandwidth on the data center interconnect (DCI) for cluster control link traffic equivalent
to the following calculation:
If the number of members differs at each site, use the larger number for your calculation. The minimum
bandwidth for the DCI should not be less than the size of the cluster control link for one member.
For example:
• For 4 members at 2 sites:
◦4 cluster members total
◦2 members at each site
◦5 Gbps cluster control link per member
Reserved DCI bandwidth = 5 Gbps (2/2 x 5 Gbps).
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
11
Logical Devices
Guidelines for Clustering
• For 6 members at 3 sites, the size increases:
◦6 cluster members total
◦3 members at site 1, 2 members at site 2, and 1 member at site 3
◦10 Gbps cluster control link per member
Reserved DCI bandwidth = 15 Gbps (3/2 x 10 Gbps).
• For 2 members at 2 sites:
◦2 cluster members total
◦1 member at each site
◦10 Gbps cluster control link per member
Reserved DCI bandwidth = 10 Gbps (1/2 x 10 Gbps = 5 Gbps; but the minimum bandwidth should not
be less than the size of the cluster control link (10 Gbps)).
Guidelines for Clustering
Models
• ASA on the Firepower 9300—Supported for intra-chassis, inter-chassis, and inter-site clustering.
• ASA on the Firepower 4100 series—Supported for inter-chassis and inter-site clustering.
• Firepower Threat Defense on the Firepower 9300—Supported for intra-chassis clustering.
• Radware DefensePro—Supported for intra-chassis clustering with the ASA.
Switches for Inter-Chassis Clustering
• For the ASR 9006, if you want to set a non-default MTU, set the ASR interface MTU to be 14 bytes
higher than the cluster device MTU. Otherwise, OSPF adjacency peering attempts may fail unless the
mtu-ignore option is used. Note that the cluster device MTU should match the ASR IPv4 MTU.
• On the switch(es) for the cluster control link interfaces, you can optionally enable Spanning Tree PortFast
on the switch ports connected to the cluster unit to speed up the join process for new units.
• When you see slow bundling of a Spanned EtherChannel on the switch, you can enable LACP rate fast
for an individual interface on the switch. Note that some switches, such as the Nexus series, do not
support LACP rate fast when performing in-service software upgrades (ISSUs), so we do not recommend
using ISSUs with clustering.
• On the switch, we recommend that you use one of the following EtherChannel load-balancing algorithms:
source-dest-ip or source-dest-ip-port (see the Cisco Nexus OS and Cisco IOS port-channel
load-balance command). Do not use a vlan keyword in the load-balance algorithm because it can cause
unevenly distributed traffic to the devices in a cluster.
• If you change the load-balancing algorithm of the EtherChannel on the switch, the EtherChannel interface
on the switch temporarily stops forwarding traffic, and the Spanning Tree Protocol restarts. There will
be a delay before traffic starts flowing again.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
12
Logical Devices
Guidelines for Clustering
• Switches on the cluster control link path should not verify the L4 checksum. Redirected traffic over the
cluster control link does not have a correct L4 checksum. Switches that verify the L4 checksum could
cause traffic to be dropped.
• Port-channel bundling downtime should not exceed the configured keepalive interval.
• On Supervisor 2T EtherChannels, the default hash distribution algorithm is adaptive. To avoid asymmetric
traffic in a VSS design, change the hash algorithm on the port-channel connected to the cluster device
to fixed:
router(config)# port-channel id hash-distribution fixed
Do not change the algorithm globally; you may want to take advantage of the adaptive algorithm for the
VSS peer link.
EtherChannels for Inter-Chassis Clustering
• For connecting switches, set the EtherChannel mode to Active; On mode is not supported on the Firepower
4100/9300 chassis, even for the cluster control link.
• FXOS EtherChannels have the LACP rate set to normal by default. This setting can make port-channel
members take more than 30 seconds to bundle, which can cause the cluster interface health check to fail
causing the unit to be removed from the cluster. We recommend that you change the LACP rate to fast.
The following example modifies the "default" lacp policy:
firepower# scope org
firepower /org # scope lacppolicy default
firepower /org/lacppolicy# set lacp-rate fast
firepower /org* # commit-buffer
Note
Some switches, such as the Nexus series, do not support LACP rate fast when performing
in-service software upgrades (ISSUs), so we do not recommend using ISSUs with
clustering.
• In Catalyst 3750-X Cisco IOS software versions earlier than 15.1(1)S2, the cluster unit did not support
connecting an EtherChannel to a switch stack. With default switch settings, if the cluster unit EtherChannel
is connected cross stack, and if the master switch is powered down, then the EtherChannel connected
to the remaining switch will not come up. To improve compatibility, set the stack-mac persistent timer
command to a large enough value to account for reload time; for example, 8 minutes or 0 for indefinite.
Or, you can upgrade to more a more stable switch software version, such as 15.1(1)S2.
• Spanned vs. Device-Local EtherChannel Configuration—Be sure to configure the switch appropriately
for Spanned EtherChannels vs. Device-local EtherChannels.
◦Spanned EtherChannels—For cluster unit Spanned EtherChannels, which span across all members
of the cluster, the interfaces are combined into a single EtherChannel on the switch. Make sure
each interface is in the same channel group on the switch.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
13
Logical Devices
Guidelines for Clustering
◦Device-local EtherChannels—For cluster unit Device-local EtherChannels including any
EtherChannels configured for the cluster control link, be sure to configure discrete EtherChannels
on the switch; do not combine multiple cluster unit EtherChannels into one EtherChannel on the
switch.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
14
Logical Devices
Defaults for Clustering
Additional Guidelines
• We recommend connecting EtherChannels to a VSS or vPC for redundancy.
• Within a chassis, you cannot cluster some security modules and run other security modules in standalone
mode; you must include all security modules in the cluster.
Defaults for Clustering
The cluster control link uses Port-channel 48.
Configure ASA Clustering
You can easily deploy the cluster from the Firepower 4100/9300 chassis supervisor. All initial configuration
is automatically generated for each unit. For inter-chassis clustering, you must configure each chassis separately.
Deploy the cluster on one chassis; you can then copy the bootstrap configuration from the first chassis to the
next chassis for ease of deployment.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
15
Logical Devices
Configure ASA Clustering
Before You Begin
• You must enable clustering for all 3 module slots in a Firepower 9300 chassis, even if you do not have
a module installed. If you do not configure all 3 modules, the cluster will not come up.
• On the Interfaces tab, the port-channel 48 cluster type interface shows the Operation State as failed
if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not
require any member interfaces, and you can ignore this Operational State.
• You can only deploy a routed firewall mode ASA cluster from the Firepower 4100/9300 chassis. To
change the ASA cluster to transparent firewall mode, complete this procedure, and then see Change the
ASA to Transparent Firewall Mode, on page 28.
Procedure
Step 1
Add at least one Data type interface or EtherChannel (also known as a port-channel) before you deploy the
cluster. See Create a Port Channel or Edit Interface Properties.
You can also add data interfaces to the cluster after you deploy it.
For inter-chassis clustering, all data interfaces must be EtherChannels with at least one member interface.
Add the same EtherChannels on each chassis.
Step 2
Add a Management type interface or EtherChannel. See Create a Port Channel or Edit Interface Properties.
For inter-chassis clustering, add the same Management interface on each chassis.
Step 3
For inter-chassis clustering, add a member interface to port-channel 48, which is used as the cluster control
link.
If you do not include a member interface, then when you deploy the logical device, the Firepower Chassis
Manager assumes that this cluster is an intra-chassis cluster and does not show the Chassis ID field. Add the
same member interfaces on each chassis.
Step 4
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have
been configured, a message stating so is shown instead.
Step 5
Click Add Device to open the Add Device dialog box.
If you have an existing cluster, you are prompted to remove the cluster and add a new one. All cluster-related
configuration on the security modules will be replaced by the new information.
Step 6
For the Device Name, provide a name for the logical device. This name is used by the Firepower 4100/9300
chassis supervisor to configure clustering settings and assign interfaces; it is not the cluster name used in the
security module configuration.
Step 7 For the Template, choose Cisco Adaptive Security Appliance.
Step 8 For the Image Version, choose the ASA software version.
Step 9 For the Device Mode, click the Cluster radio button.
Step 10 Click the Create New Cluster radio button.
Step 11 Click OK.
If you have any standalone devices configured, you are prompted to replace them with a new cluster. You
see the Provisioning - device name window.
All interfaces are assigned to the cluster by default.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
16
Logical Devices
Configure ASA Clustering
Step 12 Click the device icon in the center of the screen.
The ASA Configuration dialog box appears with the Cluster Information tab selected.
Step 13 In the Chassis ID field, enter a chassis ID. Each chassis in the cluster must use a unique ID.
Step 14 In the Cluster Key field, configure an authentication key for control traffic on the cluster control link.
The shared secret is an ASCII string from 1 to 63 characters. The shared secret is used to generate the key.
This option does not affect datapath traffic, including connection state update and forwarded packets, which
are always sent in the clear.
Step 15 Set the Cluster Group Name, which is the cluster group name in the security module configuration.
The name must be an ASCII string from 1 to 38 characters.
Step 16 Click Management Interface and choose the management interface you created earlier.
Step 17 Choose the Address Type for the management interface.
This information is used to configure a management interface in the security module configuration.
a) In the Management IP Pool field, configure a pool of Local IP addresses, one of which will be assigned
to each cluster unit for the interface, by entering the starting and ending addresses separated by a hyphen.
Include at least as many addresses as there are units in the cluster. Note that for the Firepower 9300, you
must include 3 addresses per chassis, even if you do not have all module slots filled. If you plan to expand
the cluster, include additional addresses. The Virtual IP address (known as the Main cluster IP address)
that belongs to the current primary unit is not a part of this pool; be sure to reserve an IP address on the
same network for the Main cluster IP address. You can use IPv4 and/or IPv6 addresses.
b) Enter a Network Mask or Prefix Length.
c) Enter a Network Gateway.
d) Enter a Virtual IP address.
This IP address must be on the same network as the cluster pool addresses, but not be part of the pool.
Step 18 On the Settings tab, for the Password, enter a password for the "admin" user.
Step 19 Click OK to close the ASA Configuration dialog box.
Step 20 Click Save.
The Firepower 4100/9300 chassis supervisor deploys the cluster by downloading the specified software version
and pushing the cluster bootstrap configuration and management interface settings to each security module.
Step 21 For inter-chassis clustering, add the next chassis to the cluster:
a) On the first chassis Firepower Chassis Manager, click the Show Cluster Details icon at the top right; copy
the displayed cluster configuration.
b) Connect to the Firepower Chassis Manager on the next chassis, and add a logical device according to this
procedure.
c) Choose Join an Existing Cluster.
d) Click the Copy config check box, and click OK. If you uncheck this check box, you must manually enter
the settings to match the first chassis configuration.
e) In the Copy Cluster Details box, paste in the cluster configuration from the first chassis, and click OK.
f) Click the device icon in the center of the screen. The cluster information is mostly pre-filled, but you must
change the following settings:
• Chassis ID—Enter a unique chassis ID.
• Cluster Key—(Not prefilled) Enter the same cluster key.
Click OK.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
17
Logical Devices
Configure Firepower Threat Defense Clustering
g) Click Save.
Step 22 Connect to the primary unit security module to customize your clustering configuration.
Configure Firepower Threat Defense Clustering
You can easily deploy the cluster from the Firepower 4100/9300 chassis supervisor. All initial configuration
is automatically generated for each unit.
Before You Begin
• You must enable clustering for all 3 module slots in a Firepower 9300 chassis, even if you do not have
a module installed. If you do not configure all 3 modules, the cluster will not come up.
• On the Interfaces tab, the port-channel 48 cluster type interface shows the Operation State as failed
if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not
require any member interfaces, and you can ignore this Operational State.
Procedure
Step 1
Add at least one Data type interface or EtherChannel (also known as a port-channel) before you deploy the
cluster.
You can also add data interfaces to the cluster after you deploy it.
Step 2
Step 3
Add a Management type interface or EtherChannel.
(Optional) Add a Firepower-eventing interface.
This interface is a secondary management interface for Firepower Threat Defense devices. To use this interface,
you must configure its IP address and other parameters at the Firepower Threat Defense CLI. For example,
you can separate management traffic from events (such as web events). See the configure network commands
in the Firepower Threat Defense command reference.
Step 4
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have
been configured, a message stating so is shown instead.
Step 5
Click Add Device to open the Add Device dialog box.
If you have an existing logical device, you are prompted to remove the device and add a new one. All
configuration on the device(s) will be replaced by the new information.
Step 6
For the Device Name, provide a name for the logical device. This name is used by the Firepower 4100/9300
chassis supervisor to configure clustering/management settings and to assign interfaces; it is not the cluster
name used in the logical device configuration.
Step 7 For the Template, choose Cisco Firepower Threat Defense.
Step 8 For the Image Version, choose the Firepower Threat Defense software version. Make sure this version is
compatible with your FXOS version and with the Firepower Management Center version.
Step 9 For the Device Mode, click the Cluster radio button.
Step 10 Click OK.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
18
Logical Devices
Configure Firepower Threat Defense Clustering
If you have any standalone devices configured, you are prompted to replace them with a new cluster. You
see the Provisioning - device name window.
All interfaces are assigned to the cluster by default. Hardware Bypass-capable ports are shown with the
following icon:
. If you do not assign both interfaces in a Hardware Bypass pair, you see a warning message
to make sure your assignment is intentional. You do not need to use the Hardware Bypass feature, so you can
assign single interfaces if you prefer.
Step 11 Click the device icon in the center of the screen.
The Cisco Firepower Threat Defense Configuration dialog box appears.
Step 12 On the Cluster Information tab, complete the following:
a) In the Cluster Key field, configure an authentication key for control traffic on the cluster control link.
The shared secret is an ASCII string from 1 to 63 characters. The shared secret is used to generate the key.
This option does not affect datapath traffic, including connection state update and forwarded packets,
which are always sent in the clear.
b) Set the Cluster Group Name, which is the cluster group name in the logical device configuration.
The name must be an ASCII string from 1 to 38 characters.
c) Select the management interface to use with the logical device from the Management Interface drop-down
list.
If you assign a Hardware Bypass-capable interface as the Management interface, you see a warning message
to make sure your assignment is intentional.
Step 13 On the Settings tab, complete the following:
a) In the Registration Key field, enter the key to be shared between the Firepower Management Center and
the cluster members during registration.
b) In the Password field, enter a password for the admin user on the cluster.
c) In the Firepower Management Center IP field, enter the IP address of the managing Firepower
Management Center.
d) In the Search Domains field, enter a comma-separated list of search domains for the management network.
e) From the Firewall Mode drop-down list, choose Transparent or Routed.
f) In the DNS Servers field, enter a comma-separated list of DNS servers that the Firepower Threat Defense
device should use on the management network.
g) In the Fully Qualified Hostname field, enter a fully qualified name for the Firepower Threat Defense
device.
h) From the Eventing Interface drop-down list, choose the interface on which Firepower events should be
sent. If not specified, the management interface will be used.
To specify a separate interface to use for Firepower events, you must configure an interface as a
firepower-eventing interface. If you assign a Hardware Bypass-capable interface as the Eventing interface,
you see a warning message to make sure your assignment is intentional.
Step 14 On the Interface Information tab, configure a management IP address for each security module in the cluster.
Select the type of address from the Address Type drop-down list and then complete the following for each
security module.
Note
You must set the IP address for all 3 module slots in a chassis, even if you do not have a module
installed. If you do not configure all 3 modules, the cluster will not come up.
a) In the Management IP field, configure an IP address.
Specify an IP address on the same network for each module.
b) Enter a Network Mask or Prefix Length.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
19
Logical Devices
Examples for Inter-Site Clustering
c) Enter a Network Gateway address.
Step 15 On the Agreement tab, read and accept the end user license agreement (EULA).
Step 16 Click OK to close the Cisco Firepower Threat Defense Configuration dialog box.
Step 17 Click Save.
The Firepower 4100/9300 chassis supervisor deploys the cluster by downloading the specified software version
and pushing the cluster bootstrap configuration and management interface settings to each security module.
Step 18 Add each unit separately to the Firepower Management Center using the management IP addresses, and then
group them into a cluster at the web interface.
All cluster units must be in a successfully-formed cluster on FXOS prior to adding them to Firepower
Management Center.
Examples for Inter-Site Clustering
The following examples show supported cluster deployments.
Spanned EtherChannel Transparent Mode North-South Inter-Site Example
The following example shows 2 cluster members at each of 2 data centers placed between inside and outside
routers (North-South insertion). The cluster members are connected by the cluster control link over the DCI.
The cluster members at each site connect to the local switches using spanned EtherChannels for the inside
and outside. Each EtherChannel is spanned across all chassis in the cluster.
The inside and outside routers at each data center use OSPF, which is passed through the transparent ASAs.
Unlike MACs, router IPs are unique on all routers. By assigning a higher cost route across the DCI, traffic
stays within each data center unless all cluster members at a given site go down. The lower cost route through
the ASAs must traverse the same bridge group at each site for the cluster to maintain asymmetric connections.
In the event of a failure of all cluster members at one site, traffic goes from each router over the DCI to the
cluster members at the other site.
The implementation of the switches at each site can include:
• Inter-site VSS/vPC—In this scenario, you install one switch at Data Center 1, and the other at Data
Center 2. One option is for the cluster units at each Data Center to only connect to the local switch, while
the VSS/vPC traffic goes across the DCI. In this case, connections are for the most part kept local to
each datacenter. You can optionally connect each unit to both switches across the DCI if the DCI can
handle the extra traffic. In this case, traffic is distributed across the data centers, so it is essential for the
DCI to be very robust.
• Local VSS/vPC at each site—For better switch redundancy, you can install 2 separate VSS/vPC pairs
at each site. In this case, although the cluster units still have a spanned EtherChannel with Data Center
1 chassis connected only to both local switches, and Data Center 2 chassis connected to those local
switches, the spanned EtherChannel is essentially “split.” Each local VSS/vPC sees the spanned
EtherChannel as a site-local EtherChannel.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
20
Logical Devices
Examples for Inter-Site Clustering
Spanned EtherChannel Transparent Mode East-West Inter-Site Example
The following example shows 2 cluster members at each of 2 data centers placed between the gateway router
and two inside networks at each site, the App network and the DB network (East-West insertion). The cluster
members are connected by the cluster control link over the DCI. The cluster members at each site connect to
the local switches using spanned EtherChannels for both the App and DB networks on the inside and outside.
Each EtherChannel is spanned across all chassis in the cluster.
The gateway router at each site uses an FHRP such as HSRP to provide the same destination virtual MAC
and IP addresses at each site. A good practice to avoid unintended MAC address flapping is to statically add
the gateway routers real MAC addresses to the ASA MAC address table. Without these entries, if the gateway
at site 1 communicates with the gateway at site 2, that traffic might pass through the ASA and attempt to reach
site 2 from the inside interface and cause problems. The data VLANs are extended between the sites using
Overlay Transport Virtualization (OTV) (or something similar). You must add filters to prevent traffic from
traversing the DCI to the other site when the traffic is destined for the gateway router. If the gateway router
at one site becomes unreachable, you must remove the filters so traffic can be sent to the other site’s gateway
router.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
21
Logical Devices
History for Clustering
See Spanned EtherChannel Transparent Mode North-South Inter-Site Example, on page 20 for information
about vPC/VSS options.
History for Clustering
Feature Name
Platform
Releases
Feature Information
Intra-chassis Clustering for 1.1.1
the Cisco ASA
You can cluster all ASA security modules within the Firepower 9300 chassis.
Inter-chassis clustering for 1.1.3
6 ASA modules
You can now enable inter-chassis clustering for the ASA. You can include up to 6 modules
in up to 6 chassis.
We introduced the following screen: Logical Devices > Configuration
We modified the following screen: Logical Devices > Configuration
Support for intra-chassis 1.1.4
clustering on the
Firepower Threat Defense
on the Firepower 9300
The Firepower 9300 supports intra-chassis clustering with the Firepower Threat Defense
application.
We modified the following screen: Logical Devices > Configuration
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
22
Logical Devices
Configure Service Chaining
Configure Service Chaining
The Cisco Firepower 4100/9300 chassis can support multiple services (for example, a firewall and a third-party
DDoS application) on a single blade. These applications and services can be linked together to form a Service
Chain.
About Service Chaining
In the current supported Service Chaining configuration, the third-party Radware DefensePro virtual platform
runs in front of the ASA firewall. Radware DefensePro is a KVM-based virtual platform that provides
distributed denial-of-service (DDoS) detection and mitigation capabilities on the Firepower 4100/9300 chassis.
When Service Chaining is enabled on your Firepower 4100/9300 chassis, traffic from the network must first
pass through the DefensePro virtual platform before reaching the main ASA firewall.
The Radware DefensePro virtual platform may be referred to as Radware vDP (virtual DefensePro), or simply
vDP. The Radware DefensePro virtual platform may occasionally be referred to as a Link Decorator.
Prerequisites for Service Chaining
Prior to deploying Radware DefensePro on your Firepower 4100/9300 chassis, you must configure the
Firepower 4100/9300 chassis to use an NTP Server with the etc/UTC Time Zone. For more information about
setting the date and time in your Firepower 4100/9300 chassis, see Setting the Date and Time.
Guidelines for Service Chaining
Models
• The Radware DefensePro platform is supported with ASA on the following security appliances:
◦Firepower 9300
◦Firepower 4120 - You must use the CLI to deploy Radware DefensePro on this platform; the
Firepower Chassis Manager does not yet support this functionality.
◦Firepower 4140 - You must use the CLI to deploy Radware DefensePro on this platform; the
Firepower Chassis Manager does not yet support this functionality.
◦Firepower 4150
Note
The Radware DefensePro platform is not currently supported with ASA on Firepower
4110 devices.
Additional Guidelines
• The DefensePro application can run as separate instances on up to three security modules.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
23
Logical Devices
Configure Radware DefensePro Service Chain on a Standalone Logical Device
Configure Radware DefensePro Service Chain on a Standalone Logical Device
The following procedure shows how to install Radware DefensePro in a single Service Chain in front of a
standalone ASAlogical device.
Note
If you are installing Radware vDP in front of ASA on a Firepower 4120 or 4140 security appliance, you
must use the FXOS CLI to deploy the decorator. For full CLI instructions on how to install and configure
Radware DefensePro in a service chain in front of ASA on Firepower 4100 devices, refer to the FXOS
CLI configuration guide.
If you are installing Radware vDP in front of Firepower Threat Defense on any Firepower device, you
must use the FXOS CLI to deploy the decorator. For full CLI instructions on how to install and configure
Radware DefensePro in a service chain in front of Firepower Threat Defense on Firepower 4100 or
Firepower 9300 devices, refer to the FXOS CLI configuration guide.
Before You Begin
• Download the vDP image from Cisco.com (see Downloading Images from Cisco.com) and then upload
that image to the Firepower 4100/9300 chassis (see Uploading an Image to the Firepower Security
Appliance).
• You can deploy the Radware DefensePro application in a standalone configuration on an intra-chassis
cluster; for intra-chassis clustering, see Configure Radware DefensePro Service Chain on an Intra-Chassis
Cluster, on page 25.
Procedure
Step 1
Step 2
If you want to use a separate management interface for vDP, enable the interface and set it to be the mgmt
type according to Edit Interface Properties. Otherwise, you can share the application management interface.
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have
been configured, a message stating so is shown.
Step 3
Create a standalone ASA Logical Device (see Create a Standalone ASA Logical Device, on page 3).
Note that before you click Save at the end of the procedure to create a standaolone ASA logical device, you
must first follow the following steps to add a vDP decorator to the logical device.
Step 4
In the Decorators area, select vDP. The Radware: Virtual DefensePro - Configuration window appears.
Configure the following fields under the General Information tab.
If you have more than one vDP version uploaded to the Firepower 4100/9300 chassis, select the version you
want to use in the Version drop-down.
Under the Management Interface drop-down, choose the management interface you created in step 1 of this
procedure.
Select the default Address Type, IPv4 only, IPv6 only, or IPv4 and IPv6.
Configure the following fields, based on your Address Type selection from the previous step.
a) In the Management IP field, configure a local IP address.
b) IPv4 only: Enter a Network Mask.
Step 5
Step 6
Step 7
Step 8
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
24
Logical Devices
Configure Radware DefensePro Service Chain on an Intra-Chassis Cluster
IPv6 only: Enter a Prefix Length.
c) Enter a Network Gateway address.
Step 9 Click the checkbox next to each data port that you want to assign to the device.
Step 10 Click OK.
Step 11 Click Save.
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software
version and pushing the bootstrap configuration and management interface settings to the specified security
module.
Configure Radware DefensePro Service Chain on an Intra-Chassis Cluster
The following procedure shows how to install the Radware DefensePro image, and configure it in a Service
Chain in front of an ASA intra-chassis cluster.
Before You Begin
• Download the vDP image from Cisco.com (see Downloading Images from Cisco.com) and then upload
that image to the Firepower 4100/9300 chassis (see Uploading an Image to the Firepower Security
Appliance).
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
If you want to use a separate management interface for vDP, enable the interface and set it to be the mgmt
type according to Edit Interface Properties. Otherwise, you can share the application management interface.
Configure an ASA intra-chassis cluster (see Configure ASA Clustering, on page 15 ).
Note that before you click Save at the end of the procedure to configure the intra-chassis cluster, you must
first follow the following steps to add a vDP decorator to the cluster.
In the Decorators area, select vDP. The Radware: Virtual DefensePro - Configuration dialog box appears.
Configure the following fields under the General Information tab.
If you have more than one vDP version uploaded to the Firepower 4100/9300 chassis, select the vDP version
you want to use in the Version drop-down.
Under the Management Interface drop-down, choose a management interface.
Click the checkbox next to each data port that you want to assign to the vDP decorator.
Click the Interface Information tab.
Select the Address Type to be used, IPv4 only, IPv6 only, or IPv4 and IPv6.
Configure the following fields for each Security Module. Note that the fields that display depend on your
Address Type selection from the previous step.
a) In the Management IP field, configure a local IP address.
b) IPv4 only: Enter a Network Mask.
IPv6 only: Enter a Prefix Length.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
25
Logical Devices
Open UDP/TCP Ports and Enable vDP Web Services
c) Enter a Network Gateway address.
Step 10 Click OK.
Step 11 Click Save.
The Firepower eXtensible Operating System deploys the logical device by downloading the specified software
version and pushing the bootstrap configuration and management interface settings to the specified security
module.
Step 12 Choose Logical Devices to open the Logical Devices page.
Step 13 Scroll through the list of configured logical devices to the entries for vDP. Verify their Attributes listed in the
Management IP column.
• If the CLUSTER-ROLE element displays as unknown for the DefensePro instances, you must enter
the DefensePro application and configure the master IP address to complete the creation of the vDP
cluster.
• If the CLUSTER-ROLE element displays as primary or secondary for the DefensePro instances, the
applications are online and formed in a cluster.
Open UDP/TCP Ports and Enable vDP Web Services
The Radware APSolute Vision Manager interfaces communicate with the Radware vDP appliation using
various UDP/TCP ports. In orer for the vDP application to communicate with the APSolute Vision Manager,
you must ensure that these ports are accessible and not blocked by your firewall. For more information on
which specific ports to open, see the following tables in the APSolute Vision User Guide:
• Ports for APSolute Vision Server-WBM Communication and Operating System
• Communication Ports for APSolute Vision Server with Radware Devices
In order for Radware APSolute Vision to manage the Virtual DefensePro application deployed on the FXOS
chassis, you must enable the vDP web service using the FXOS CLI.
Procedure
Step 1
From the FXOS CLI, connect to the vDP application instance.
connect module slot console
connect vdp
Step 2
Enable vDP web services.
manage secure-web status set enable
Step 3
Exit the vDP application console and return to the FXOS module CLI.
Ctrl ]
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
26
Logical Devices
Manage Logical Devices
Manage Logical Devices
You can delete a logical device, convert an ASA to transparent mode, change the interface configuration, and
perform other tasks on existing logical devices.
Connect to the Console of the Application or Decorator
Use the following procedure to connect to the console of the application or decorator.
Note
If you encounter any issues with accessing the console, we recommend that you try a different SSH client
or upgrade your SSH client to a newer version.
Procedure
Step 1
To connect to the console of the application or decorator:
a) From the FXOS CLI, connect to the security module/engine:
Firepower-chassis # connect module slot_number console
To connect to the security engine of a device that does not support multiple security modules,
use 1 as the slot_number.
The first time you connect to the security module, you access the FXOS module CLI.
Note
b) To connect to the application or decorator, enter the appropriate command for your device:
Firepower-module1>connect asa
Firepower-module1>connect ftd
Firepower-module1>connect vdp
Subsequent connections from the supervisor level of the FXOS CLI to the security module/engine access
the security module/engine OS directly.
Step 2
(Optional) Exit the application console to the FXOS module CLI by typing Ctrl-A-D.
Exit the decorator console to the FXOS module CLI by typing Ctrl-]-.
You might want to access the FXOS module CLI for troubleshooting purposes.
Step 3
Return to the supervisor level of the FXOS CLI.
a) To exit the security module/engine console, type ~.
You exit to the Telnet application.
b) To exit the Telnet application, enter:
telnet>quit
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
27
Logical Devices
Delete a Logical Device
Example
The following example connects to an ASA on security module 1 and then exits back to the supervisor level
of the FXOS CLI.
Firepower# connect module 1 console
Telnet escape character is '~'.
Trying 127.5.1.1...
Connected to 127.5.1.1.
Escape character is '~'.
CISCO Serial Over LAN:
Close Network Connection to Exit
Firepower-module1>connect asa
asa> ~
telnet> quit
Connection closed.
Firepower#
Delete a Logical Device
Procedure
Step 1
Choose Logical Devices to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have
been configured, a message stating so is shown instead.
Step 2
Step 3
Step 4
Click Delete for the logical device that you want to delete.
Click Yes to confirm that you want to delete the logical device.
Click Yes to confirm that you want to delete the application configuration.
Change the ASA to Transparent Firewall Mode
You can only deploy a routed firewall mode ASA from the Firepower 4100/9300 chassis. To change the ASA
to transparent firewall mode, complete the initial deployment, and then change the firewall mode within the
ASA CLI. Because changing the firewall mode erases the configuration, you must then redeploy the
configuration from the Firepower 4100/9300 chassis to regain the bootstrap configuration. The ASA then
remains in transparent mode with a working bootstrap configuration.
Procedure
Step 1
Step 2
Connect to the ASA console according to Connect to the Console of the Application or Decorator, on page
27. For a cluster, connect to the primary unit. For a failover pair, connect to the active unit.
Enter configuration mode:
enable
configure terminal
By default, the enable password is blank.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
28
Logical Devices
Change an Interface on a Firepower Threat Defense Logical Device
Step 3
Set the firewall mode to transparent:
firewall transparent
Step 4
Save the configuration:
write memory
For a cluster or failover pair, this configuration is replicated to secondary units:
asa(config)# firewall transparent
asa(config)# write memory
Building configuration...
Cryptochecksum: 9f831dfb 60dffa8c 1d939884 74735b69
3791 bytes copied in 0.160 secs
[OK]
asa(config)#
Beginning configuration replication to Slave unit-1-2
End Configuration Replication to slave.
asa(config)#
Step 5
On the Firepower Chassis Manager Logical Devices page, click the Edit icon to edit the ASA.
The Provisioning page appears.
Step 6
Click the device icon to edit the bootstrap configuration. Change any value in your configuration, and click
OK.
You must change the value of at least one field. Cisco recommends changing the Password to a new password
because this setting is not important.
You see a warning about changing the bootstrap configuration; click Yes.
Step 7
Click Save to redeploy the configuration to the ASA.For an inter-chassis cluster or for a failover pair, repeat
steps 5 through 7 to redeploy the bootstrap configuration on each chassis.
Wait several minutes for the chassis/security modules to reload, and for the ASA to to become operational
again. The ASA now has an operational bootstrap configuration, but remains in transparent mode.
Change an Interface on a Firepower Threat Defense Logical Device
You can allocate or unallocate an interface, or replace a management interface on a Firepower Threat Defense
logical device. You can then sync the interface configuration in the Firepower Management Center.
Before You Begin
• Configure your interfaces, and add any EtherChannels according to Edit Interface Properties and Create
a Port Channel.
• You can edit the membership of an allocated EtherChannel without affecting the logical device or
requiring a sync on the Firepower Management Center.
• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are
allocated by default to a cluster), you need to unallocate the interface from the logical device first, then
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
29
Logical Devices
Change an Interface on an ASA Logical Device
add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel
to the device.
• If you want to replace the management or firepower eventing interface with a management EtherChannel,
then you need to create the EtherChannel with at least 1 unallocated data member interface, and then
replace the current management interface with the EtherChannel. After the Firepower Threat Defense
device reboots (management interface changes cause a reboot), and you sync the configuration in the
Firepower Management Center, you can add the (now unallocated) management interface to the
EtherChannel as well.
• For clustering or High Availability, make sure you add or remove the interface on all units before you
sync the configuration in the Firepower Management Center. Note that new interfaces are added in an
administratively down state, so they do not affect interface monitoring.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
In the Firepower Chassis Manager, choose Logical Devices.
Click the Edit icon at the top right to edit the logical device.
Unallocate a data interface by de-selecting the interface in the Data Ports area.
Allocate a new data interface by selecting the interface in the Data Ports area.
Replace the management or eventing interface:
For these types of interfaces, the device reboots after you save your changes.
a) Click the device icon in the center of the page.
b) On the General/Cluster Information tab, choose the new Management Interface from the drop-down
list.
c) On the Settings tab, choose the new Eventing Interface from the drop-down list.
d) Click OK.
If you change the IP address of the Management interface, then you must also change the IP address for the
device in the Firepower Management Center: go to Devices > Device Management > Device/Cluster. In the
Management area, set the IP address to match the bootstrap configuration address.
Step 6
Step 7
Step 8
Click Save.
Log into the Firepower Management Center.
Select Devices > Device Management and click the edit icon ( ) for your Firepower Threat Defense device.
The Interfaces tab is selected by default.
Step 9 Click the Sync Interfaces from device button on the top left of the Interfaces tab.
Step 10 Click Save.
You can now click Deploy and deploy the policy to assigned devices. The changes are not active until you
deploy them.
Change an Interface on an ASA Logical Device
You can allocate, unallocate, or replace a management interface on an ASA logical device. ASDM discovers
the new interfaces automatically.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
30
Logical Devices
Change an Interface on an ASA Logical Device
Before You Begin
• Configure your interfaces and add any EtherChannels according to Edit Interface Properties and Create
a Port Channel.
• You can edit the membership of an allocated EtherChannel without affecting the logical device.
• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are
allocated by default to a cluster), you need to unallocate the interface from the logical device first, then
add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel
to the device.
• If you want to replace the management interface with a management EtherChannel, then you need to
create the EtherChannel with at least 1 unallocated data member interface, and then replace the current
management interface with the EtherChannel. After the ASA reloads (management interface changes
cause a reload), you can add the (now unallocated) management interface to the EtherChannel as well.
• For clustering or failover, new interfaces are added in an administratively down state, so they do not
affect interface monitoring.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
In the Firepower Chassis Manager, choose Logical Devices.
Click the Edit icon at the top right to edit the logical device.
Unallocate a data interface by de-selecting the interface in the Data Ports area.
Allocate a new data interface by selecting the interface in the Data Ports area.
Replace the management interface:
For this type of interface, the device reloads after you save your changes.
a) Click the device icon in the center of the page.
b) On the General/Cluster Information tab, choose the new Management Interface from the drop-down
list.
c) Click OK.
Step 6
Click Save.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
31
Logical Devices
Change an Interface on an ASA Logical Device
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
32
">