Cisco 4100, 9300, 4100/9300 chassis supervisor Firepower, ASA Adaptive Security Appliance, FTD Firepower Threat Defense Configuration Guide

Logical Devices

•

About Logical Devices, page 1

•

Create a Standalone Logical Device, page 3

•

Deploy a Cluster, page 6

•

Configure Service Chaining, page 23

•

Manage Logical Devices, page 26

About Logical Devices

When you create a logical device, the Firepower 4100/9300 chassis supervisor deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine, or in the case of an intra-chassis cluster, to all security modules installed in the Firepower chassis.

You can create either of the following two types of logical devices:

• Standalone—You can create a standalone logical device for each security module/engine installed in the Firepower chassis.

• Cluster—Clustering lets you group multiple security modules together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. Multiple module devices, like the Firepower 9300, support intra-chassis clustering.

Note

On an Firepower 4100/9300 chassis that supports multiple security modules, you can only create one type of logical device, standalone or cluster. In other words, if you have three security modules installed, you cannot create a standalone logical device on one security module and then create a cluster using the remaining two logical devices.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

1

Logical Devices

Logical Devices Page

Note

If you are configuring standalone logical devices, you must install the same software type on all modules in the chassis; different software types are not supported at this time. Note that modules can run different versions of a particular device type, but all modules must be configured as the same type of logical device.

Logical Devices Page

Use the Logical Devices page of the Firepower Chassis Manager to create, edit, and delete logical devices.

The Logical Devices page includes an informational area for the logical device(s) installed on each Firepower

4100/9300 chassis security module/engine.

The header for each logical device area provides the following information:

• The unique name of the logical device.

• The name of the main application installed on the security module/engine, either ASA or FTD.

• The logical device mode, either Standalone or Clustered.

• Status—Shows the state of the logical device:

◦ok—The logical device configuration is complete.

◦incomplete-configuration—The logical device configuration is incomplete.

Each logical device area provides the following information:

• Security Module—Shows the security module.

• Ports—Shows the ports assigned to the application instance.

• Application—Shows the application running on the security module.

• Version—Shows the software version number of the application running on the security module.

Note

Updates to Firepower Threat Defense logical devices are done using Firepower

Management Center and are not reflected on the Logical Devices > Edit and System

> Updates pages in Firepower Chassis Manager. On these pages, the version shown indicates the software version (CSP image) that was used to create the Firepower Threat

Defense logical device.

• Management IP—Shows the local IP address assigned as the logical device Management IP.

• Management URL—Shows the management URL assigned to the application instance.

• Gateway—Shows the network gateway address assigned to the application instance.

• Management Port—Shows the management port assigned to the application instance.

• Status—Shows the state of the application instance:

◦Online—The application is running and operating.

2

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Create a Standalone Logical Device

◦Offline—The application is stopped and inoperable.

◦Installing—The application installation is in progress.

◦Not Installed—The application is not installed.

◦Install Failed—The application installation failed.

◦Starting—The application is starting up.

◦Start Failed—The application failed to start up.

◦Started—The application started successfully, and is waiting for app agent heartbeat.

◦Stopping—The application is in the process of stopping.

◦Stop Failed—The application was unable to be brought offline.

◦Not Responding—The application is unresponsive.

◦Updating—The application software upgrade is in progress.

◦Update Failed—The application software upgrade failed.

◦Update Succeeded—The application software upgrade succeeded.

Create a Standalone Logical Device

You can create a standalone logical device for each security module/engine installed in the Firepower chassis.

Create a Standalone ASA Logical Device

You can create a standalone logical device for each security module/engine installed in the Firepower 4100/9300 chassis. On multiple module devices, like the Firepower 9300, you cannot create standalone logical devices if you have a cluster configured. You will need to delete the cluster before you can configure a standalone device.

Note

Optionally, you can install the third-party Radware DefensePro virtual platform as a DDoS detection and mitigation service that sits in front of the ASA firewall on the security module (see

About Service Chaining,

on page 23 ).

Note

You must install the same software type on all modules in a chassis; different software types are not supported at this time. Note that modules can run different versions of a particular device type, but all modules must be configured as the same type of logical device.

Before You Begin

• If the security module/engine that you want to use for the logical device already has a logical device configured on it, you must first delete the existing logical device (see

Delete a Logical Device, on page

28 ).

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

3

Logical Devices

Create a Standalone ASA Logical Device

• Download the application image you want to use for the logical device from Cisco.com (see Downloading

Images from Cisco.com

) and then upload that image to the Firepower 4100/9300 chassis (see Uploading an Image to the Firepower Security Appliance ).

• Configure a management interface to use with the logical device.

• You can only deploy a routed firewall mode ASA from the Firepower 4100/9300 chassis. To change the ASA to transparent firewall mode, complete this procedure, and then see

Change the ASA to

Transparent Firewall Mode, on page 28

.

Procedure

Step 1

Choose Logical Devices to open the Logical Devices page.

The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.

Step 2

Click Add Device to open the Add Device dialog box.

Step 3

For the Device Name, provide a name for the logical device.

Step 4

For the Template, choose Cisco Adaptive Security Appliance.

Step 5

For the Image Version, choose the ASA software version.

Step 6

For the Device Mode, click the Standalone radio button.

Step 7

Click OK.

You see the Provisioning - device name window.

Step 8

Expand the Data Ports area, and click each port that you want to assign to the device.

Step 9

Click the device icon in the center of the screen.

The ASA Configuration dialog box appears.

Step 10 On the General Information tab, complete the following: a) On multiple module devices, like the Firepower 9300, choose the security module that you want to use for this logical device by clicking on it under Security Module Selection.

b) Select the management interface to use with the logical device from the Management Interface drop-down list.

c) Under DEFAULT, configure the management interface:

This information is used to configure a management interface in the security module/engine configuration.

This management IP address is also the IP address you will use to connect to ASDM.

1

Select the type of address from the Address Type drop-down list.

2

In the Management IP field, configure a local IP address.

3

Enter a Network Mask or Prefix Length.

4

Enter a Network Gateway address.

Step 11 On the Settings tab, enter a password for the "admin" user in the Password field.

Step 12 Click OK to close the ASA Configuration dialog box.

Step 13 Click Save.

4

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Create a Standalone Threat Defense Logical Device

The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine.

Create a Standalone Threat Defense Logical Device

You can create a standalone logical device for each security module/engine installed in the Firepower 4100/9300 chassis. On multiple module devices, like the Firepower 9300, you cannot create standalone logical devices if you have a cluster configured. You will need to delete the cluster before you can configure a standalone device.

Note

You must install the same software type on all modules in a chassis; different software types are not supported at this time. Note that modules can run different versions of a particular device type, but all modules must be configured as the same type of logical device.

Before You Begin

• If the security module/engine that you want to use for the logical device already has a logical device configured on it, you must first delete the existing logical device (see

Delete a Logical Device, on page

28 ).

• Download the application image you want to use for the logical device from Cisco.com (see Downloading

Images from Cisco.com

) and then upload that image to the Firepower 4100/9300 chassis (see Uploading an Image to the Firepower Security Appliance ).

• Configure a management interface to use with the logical device. You must also configure at least one

Data type interface. Optionally, you can also create a firepower-eventing interface to carry all event traffic (such as web events).

Procedure

Step 1

Choose Logical Devices to open the Logical Devices page.

The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.

Step 2

Click Add Device to open the Add Device dialog box.

Step 3

For the Device Name, provide a name for the logical device.

This name is used by the Firepower 4100/9300 chassis supervisor to configure management settings and to assign interfaces; it is not the device name used in the security module/engine configuration.

Step 4

For the Template, choose Cisco Firepower Threat Defense.

Step 5

For the Image Version, choose the Threat Defense software version.

Step 6

For the Device Mode, click the Standalone radio button.

Step 7

Click OK.

You see the Provisioning - device name window.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

5

Logical Devices

Deploy a Cluster

Step 8

Expand the Data Ports area, and click each port that you want to assign to the device.

Step 9

Click the device icon in the center of the screen.

The configuration dialog box appears.

Step 10 On the General Information tab, complete the following: a) On multiple module devices, like the Firepower 9300, choose the security module that you want to use for this logical device by clicking on it under Security Module Selection.

b) Select the management interface to use with the logical device from the Management Interface drop-down list.

c) Under Management, configure the management interface:

1

Select the type of address from the Address Type drop-down list.

2

In the Management IP field, configure a local IP address.

3

Enter a Network Mask or Prefix Length.

4

Enter a Network Gateway address.

Step 11 On the Settings tab, complete the following: a) In the Registration Key field, enter the key to be shared between Firepower Management Center and the device during registration.

b) In the Password field, enter a password for the device.

c) In the Firepower Management Center IP field, enter the IP address of the managing Firepower

Management Center.

d) In the Search Domains field, enter a comma-separated list of search domains for the device.

e) Choose the firewall mode: Transparent or Routed.

f) In the DNS Servers field, enter a comma-separated list of DNS servers for the device to use.

g) In the Fully Qualified Hostname field, enter a fully qualified name for the Threat Defense device.

h) Choose the interface on which Firepower events should be sent. If not specified, the management interface will be used.

To specify an interface to use for Firepower events, you must configure an interface as a firepower-eventing interface. For more information, see About Firepower Security Appliance Interfaces .

Step 12 On the Agreement tab, read and accept the end user license agreement (EULA).

Step 13 Click OK to close the configuration dialog box.

Step 14 Click Save.

The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module/engine.

Deploy a Cluster

Clustering lets you group multiple devices together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. The Firepower 9300, which includes multiple modules, supports intra-chassis clustering where you group all modules within a single chassis into a cluster. You can

6

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

About Clustering on the Firepower 4100/9300 Chassis

also use inter-chassis clustering, where multiple chassis are grouped together; inter-chasis clustering is the only option for single module devices like the Firepower 4100 series.

Note

The Firepower Threat Defense does not support a cluster across multiple chassis (inter-chassis); only intra-chassis clustering is supported.

About Clustering on the Firepower 4100/9300 Chassis

The cluster consists of multiple devices acting as a single logical unit. When you deploy a cluster on the

Firepower 4100/9300 chassis, it does the following:

• Creates a cluster-control link (by default, port-channel 48) for unit-to-unit communication. For intra-chassis clustering (Firepower 9300 only), this link utilizes the Firepower 9300 backplane for cluster communications. For inter-chassis clustering, you need to manually assign physical interface(s) to this

EtherChannel for communications between chassis.

• Creates the cluster bootstrap configuration within the application.

When you deploy the cluster, the Firepower 4100/9300 chassis supervisor pushes a minimal bootstrap configuration to each unit that includes the cluster name, cluster control link interface, and other cluster settings. Some parts of the bootstrap configuration may be user-configurable within the application if you want to customize your clustering environment.

• Assigns data interfaces to the cluster as Spanned interfaces.

For intra-chassis clustering, spanned interfaces are not limited to EtherChannels, like it is for inter-chassis clustering.The Firepower 9300 supervisor uses EtherChannel technology internally to load-balance traffic to multiple modules on a shared interface, so any data interface type works for Spanned mode.

For inter-chassis clustering, you must use Spanned EtherChannels for all data interfaces.

Note

Individual interfaces are not supported, with the exception of a management interface.

• Assigns a management interface to all units in the cluster.

The following sections provide more detail about clustering concepts and implementation.

Primary and Secondary Unit Roles

One member of the cluster is the primary unit. The primary unit is determined automatically. All other members are secondary units.

You must perform all configuration on the primary unit only; the configuration is then replicated to the secondary units.

Cluster Control Link

The cluster control link is automatically created using the Port-channel 48 interface. For intra-chassis clustering, this interface has no member interfaces. For inter-chassis clustering, you must add one or more interfaces to

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

7

Logical Devices

About Clustering on the Firepower 4100/9300 Chassis

the EtherChannel. This Cluster type EtherChannel utilizes the Firepower 9300 backplane for cluster communications for intra-chassis clustering.

For a 2-member inter-chassis cluster, do not directly connect the cluster control link from one chassis to the other chassis. If you directly connect the interfaces, then when one unit fails, the cluster control link fails, and thus the remaining healthy unit fails. If you connect the cluster control link through a switch, then the cluster control link remains up for the healthy unit.

Cluster control link traffic includes both control and data traffic.

Size the Cluster Control Link for Inter-Chassis Clustering

If possible, you should size the cluster control link to match the expected throughput of each chassis so the cluster-control link can handle the worst-case scenarios.

Cluster control link traffic is comprised mainly of state update and forwarded packets. The amount of traffic at any given time on the cluster control link varies. The amount of forwarded traffic depends on the load-balancing efficacy or whether there is a lot of traffic for centralized features. For example:

• NAT results in poor load balancing of connections, and the need to rebalance all returning traffic to the correct units.

• When membership changes, the cluster needs to rebalance a large number of connections, thus temporarily using a large amount of cluster control link bandwidth.

A higher-bandwidth cluster control link helps the cluster to converge faster when there are membership changes and prevents throughput bottlenecks.

Note

If your cluster has large amounts of asymmetric (rebalanced) traffic, then you should increase the cluster control link size.

Cluster Control Link Redundancy for Inter-Chassis Clustering

The following diagram shows how to use an EtherChannel as a cluster control link in a Virtual Switching

System (VSS) or Virtual Port Channel (vPC) environment. All links in the EtherChannel are active. When the switch is part of a VSS or vPC, then you can connect Firepower 4100/9300 chassis interfaces within the same EtherChannel to separate switches in the VSS or vPC. The switch interfaces are members of the same

EtherChannel port-channel interface, because the separate switches act like a single switch. Note that this

EtherChannel is device-local, not a Spanned EtherChannel.

8

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

About Clustering on the Firepower 4100/9300 Chassis

Cluster Control Link Reliability for Inter-Chassis Clustering

To ensure cluster control link functionality, be sure the round-trip time (RTT) between units is less than 20 ms. This maximum latency enhances compatibility with cluster members installed at different geographical sites. To check your latency, perform a ping on the cluster control link between units.

The cluster control link must be reliable, with no out-of-order or dropped packets; for example, for inter-site deployment, you should use a dedicated link.

Cluster Control Link Network

The Firepower 4100/9300 chassis auto-generates the cluster control link interface IP address for each unit based on the chassis ID and slot ID: 127.2.chassis_id.slot_id. You cannot set this IP address manually, either in FXOS or within the application. The cluster control link network cannot include any routers between units; only Layer 2 switching is allowed. For inter-site traffic, Cisco recommends using Overlay Transport

Virtualization (OTV).

Management Network

We recommend connecting all units to a single management network. This network is separate from the cluster control link.

Management Interface

You can assign a Management type interface to the cluster. This interface is a special individual interface as opposed to a Spanned interface. The management interface lets you connect directly to each unit.

For the ASA, the Main cluster IP address is a fixed address for the cluster that always belongs to the current primary unit. You also configure a range of addresses so that each unit, including the current primary unit, can use a Local address from the range. The Main cluster IP address provides consistent management access to an address; when a primary unit changes, the Main cluster IP address moves to the new primary unit, so management of the cluster continues seamlessly. The Local IP address is used for routing, and is also useful for troubleshooting. For example, you can manage the cluster by connecting to the Main cluster IP address, which is always attached to the current primary unit. To manage an individual member, you can connect to the Local IP address. For outbound management traffic such as TFTP or syslog, each unit, including the primary unit, uses the Local IP address to connect to the server.

For the Firepower Threat Defense, assign a management IP address to each unit on the same network. Use these IP addresses when you add each unit to the Management Center.

Spanned EtherChannels

You can group one or more interfaces per chassis into an EtherChannel that spans all chassis in the cluster.

The EtherChannel aggregates the traffic across all the available active interfaces in the channel. A Spanned

EtherChannel can be configured in both routed and transparent firewall modes. In routed mode, the

EtherChannel is configured as a routed interface with a single IP address. In transparent mode, the IP address is assigned to the BVI, not to the bridge group member interface. The EtherChannel inherently provides load balancing as part of basic operation.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

9

Logical Devices

Prerequisites for Clustering

Inter-Site Clustering

For inter-site installations, you can take advantage of clustering as long as you follow the recommended guidelines.

You can configure each cluster chassis to belong to a separate site ID.

Site IDs work with site-specific MAC addresses and IP addresses. Packets sourced from the cluster use a site-specific MAC address and IP address, while packets received by the cluster use a global MAC address and IP address. This feature prevents the switches from learning the same global MAC address from both sites on two different ports, which causes MAC flapping; instead, they only learn the site MAC address.

Site-specific MAC addresses and IP address are supported for routed mode using Spanned EtherChannels only.

Site IDs are also used to enable flow mobility using LISP inspection.

See the following sections for more information about inter-site clustering:

• Sizing the Data Center Interconnect—

Prerequisites for Clustering, on page 10

• Inter-Site Guidelines—

Guidelines for Clustering, on page 12

• Inter-Site Examples— Examples for Inter-Site Clustering, on page 20

Prerequisites for Clustering

Inter-Chassis Hardware and Software Requirements

All chassis in a cluster:

10

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Prerequisites for Clustering

• For the Firepower 4100 series: All chassis must be the same model. For the Firepower 9300: All security modules must be the same type. You can have different quantities of installed security modules in each chassis, although all modules present in the chassis must belong to the cluster including any empty slots.

• Must run the identical FXOS software except at the time of an image upgrade.

• Must include the same interface configuration for interfaces you assign to the cluster, such as the same

Management interface, EtherChannels, active interfaces, speed and duplex, and so on. You can use different network module types on the chassis as long as the capacity matches for the same interface

IDs and interfaces can successfully bundle in the same spanned EtherChannel. Note that all data interfaces must be EtherChannels in inter-chassis clustering.

• Must use the same NTP server. Do not set the time manually.

• ASA: Each FXOS chassis must be registered with the License Authority or satellite server. There is no extra cost for secondary units. For Firepower Threat Defense, all licensing is handled by the Firepower

Management Center.

Switch Prerequisites for Inter-Chassis Clustering

• Be sure to complete the switch configuration and successfully connect all the EtherChannels from the chassis to the switch(es) before you configure clustering on the Firepower 4100/9300 chassis.

• For a list of supported switches, see Cisco FXOS Compatibility .

Sizing the Data Center Interconnect for Inter-Site Clustering

You should reserve bandwidth on the data center interconnect (DCI) for cluster control link traffic equivalent to the following calculation:

If the number of members differs at each site, use the larger number for your calculation. The minimum bandwidth for the DCI should not be less than the size of the cluster control link for one member.

For example:

• For 4 members at 2 sites:

◦4 cluster members total

◦2 members at each site

◦5 Gbps cluster control link per member

Reserved DCI bandwidth = 5 Gbps (2/2 x 5 Gbps).

• For 6 members at 3 sites, the size increases:

◦6 cluster members total

◦3 members at site 1, 2 members at site 2, and 1 member at site 3

◦10 Gbps cluster control link per member

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

11

Logical Devices

Guidelines for Clustering

Reserved DCI bandwidth = 15 Gbps (3/2 x 10 Gbps).

• For 2 members at 2 sites:

◦2 cluster members total

◦1 member at each site

◦10 Gbps cluster control link per member

Reserved DCI bandwidth = 10 Gbps (1/2 x 10 Gbps = 5 Gbps; but the minimum bandwidth should not be less than the size of the cluster control link (10 Gbps)).

Guidelines for Clustering

Models

• ASA on the Firepower 9300—Supported for intra-chassis, inter-chassis, and inter-site clustering.

• ASA on the Firepower 4100 series—Supported for inter-chassis and inter-site clustering.

• Firepower Threat Defense on the Firepower 9300—Supported for intra-chassis clustering.

• Radware DefensePro—Supported for intra-chassis clustering with the ASA.

Switches for Inter-Chassis Clustering

• For the ASR 9006, if you want to set a non-default MTU, set the ASR interface MTU to be 14 bytes higher than the cluster device MTU. Otherwise, OSPF adjacency peering attempts may fail unless the

mtu-ignore option is used. Note that the cluster device MTU should match the ASR IPv4 MTU.

• On the switch(es) for the cluster control link interfaces, you can optionally enable Spanning Tree PortFast on the switch ports connected to the cluster unit to speed up the join process for new units.

• When you see slow bundling of a Spanned EtherChannel on the switch, you can enable LACP rate fast for an individual interface on the switch. Note that some switches, such as the Nexus series, do not support LACP rate fast when performing in-service software upgrades (ISSUs), so we do not recommend using ISSUs with clustering.

• On the switch, we recommend that you use one of the following EtherChannel load-balancing algorithms:

source-dest-ip or source-dest-ip-port (see the Cisco Nexus OS and Cisco IOS port-channel

load-balance command). Do not use a vlan keyword in the load-balance algorithm because it can cause unevenly distributed traffic to the devices in a cluster.

• If you change the load-balancing algorithm of the EtherChannel on the switch, the EtherChannel interface on the switch temporarily stops forwarding traffic, and the Spanning Tree Protocol restarts. There will be a delay before traffic starts flowing again.

• Switches on the cluster control link path should not verify the L4 checksum. Redirected traffic over the cluster control link does not have a correct L4 checksum. Switches that verify the L4 checksum could cause traffic to be dropped.

• Port-channel bundling downtime should not exceed the configured keepalive interval.

12

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Guidelines for Clustering

• On Supervisor 2T EtherChannels, the default hash distribution algorithm is adaptive. To avoid asymmetric traffic in a VSS design, change the hash algorithm on the port-channel connected to the cluster device to fixed: router(config)# port-channel id hash-distribution fixed

Do not change the algorithm globally; you may want to take advantage of the adaptive algorithm for the

VSS peer link.

EtherChannels for Inter-Chassis Clustering

• For connecting switches, set the EtherChannel mode to Active; On mode is not supported on the Firepower

4100/9300 chassis, even for the cluster control link.

• FXOS EtherChannels have the LACP rate set to normal by default. This setting can make port-channel members take more than 30 seconds to bundle, which can cause the cluster interface health check to fail causing the unit to be removed from the cluster. We recommend that you change the LACP rate to fast.

The following example modifies the "default" lacp policy: firepower#

scope org

firepower /org #

scope lacppolicy default

firepower /org/lacppolicy#

set lacp-rate fast

firepower /org* #

commit-buffer

Note

Some switches, such as the Nexus series, do not support LACP rate fast when performing in-service software upgrades (ISSUs), so we do not recommend using ISSUs with clustering.

• In Catalyst 3750-X Cisco IOS software versions earlier than 15.1(1)S2, the cluster unit did not support connecting an EtherChannel to a switch stack. With default switch settings, if the cluster unit EtherChannel is connected cross stack, and if the master switch is powered down, then the EtherChannel connected to the remaining switch will not come up. To improve compatibility, set the stack-mac persistent timer command to a large enough value to account for reload time; for example, 8 minutes or 0 for indefinite.

Or, you can upgrade to more a more stable switch software version, such as 15.1(1)S2.

• Spanned vs. Device-Local EtherChannel Configuration—Be sure to configure the switch appropriately for Spanned EtherChannels vs. Device-local EtherChannels.

◦Spanned EtherChannels—For cluster unit Spanned EtherChannels, which span across all members of the cluster, the interfaces are combined into a single EtherChannel on the switch. Make sure each interface is in the same channel group on the switch.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

13

Guidelines for Clustering

Logical Devices

◦Device-local EtherChannels—For cluster unit Device-local EtherChannels including any

EtherChannels configured for the cluster control link, be sure to configure discrete EtherChannels on the switch; do not combine multiple cluster unit EtherChannels into one EtherChannel on the switch.

14

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Defaults for Clustering

Additional Guidelines

• We recommend connecting EtherChannels to a VSS or vPC for redundancy.

• Within a chassis, you cannot cluster some security modules and run other security modules in standalone mode; you must include all security modules in the cluster.

Defaults for Clustering

The cluster control link uses Port-channel 48.

Configure ASA Clustering

You can easily deploy the cluster from the Firepower 4100/9300 chassis supervisor. All initial configuration is automatically generated for each unit. For inter-chassis clustering, you must configure each chassis separately.

Deploy the cluster on one chassis; you can then copy the bootstrap configuration from the first chassis to the next chassis for ease of deployment.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

15

Logical Devices

Configure ASA Clustering

Before You Begin

• You must enable clustering for all 3 module slots in a Firepower 9300 chassis, even if you do not have a module installed. If you do not configure all 3 modules, the cluster will not come up.

• On the Interfaces tab, the port-channel 48 cluster type interface shows the Operation State as failed if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not require any member interfaces, and you can ignore this Operational State.

• You can only deploy a routed firewall mode ASA cluster from the Firepower 4100/9300 chassis. To change the ASA cluster to transparent firewall mode, complete this procedure, and then see

Change the

ASA to Transparent Firewall Mode, on page 28

.

Procedure

Step 1

Add at least one Data type interface or EtherChannel (also known as a port-channel) before you deploy the cluster. See Create a Port Channel or Edit Interface Properties .

You can also add data interfaces to the cluster after you deploy it.

For inter-chassis clustering, all data interfaces must be EtherChannels with at least one member interface.

Add the same EtherChannels on each chassis.

Step 2

Add a Management type interface or EtherChannel. See Create a Port Channel or Edit Interface Properties .

For inter-chassis clustering, add the same Management interface on each chassis.

Step 3

For inter-chassis clustering, add a member interface to port-channel 48, which is used as the cluster control link.

If you do not include a member interface, then when you deploy the logical device, the Firepower Chassis

Manager assumes that this cluster is an intra-chassis cluster and does not show the Chassis ID field. Add the same member interfaces on each chassis.

Step 4

Choose Logical Devices to open the Logical Devices page.

The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.

Step 5

Click Add Device to open the Add Device dialog box.

If you have an existing cluster, you are prompted to remove the cluster and add a new one. All cluster-related configuration on the security modules will be replaced by the new information.

Step 6

For the Device Name, provide a name for the logical device. This name is used by the Firepower 4100/9300 chassis supervisor to configure clustering settings and assign interfaces; it is not the cluster name used in the security module configuration.

Step 7

For the Template, choose Cisco Adaptive Security Appliance.

Step 8

For the Image Version, choose the ASA software version.

Step 9

For the Device Mode, click the Cluster radio button.

Step 10 Click the Create New Cluster radio button.

Step 11 Click OK.

If you have any standalone devices configured, you are prompted to replace them with a new cluster. You see the Provisioning - device name window.

All interfaces are assigned to the cluster by default.

16

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Configure ASA Clustering

Step 12 Click the device icon in the center of the screen.

The ASA Configuration dialog box appears with the Cluster Information tab selected.

Step 13 In the Chassis ID field, enter a chassis ID. Each chassis in the cluster must use a unique ID.

Step 14 In the Cluster Key field, configure an authentication key for control traffic on the cluster control link.

The shared secret is an ASCII string from 1 to 63 characters. The shared secret is used to generate the key.

This option does not affect datapath traffic, including connection state update and forwarded packets, which are always sent in the clear.

Step 15 Set the Cluster Group Name, which is the cluster group name in the security module configuration.

The name must be an ASCII string from 1 to 38 characters.

Step 16 Click Management Interface and choose the management interface you created earlier.

Step 17 Choose the Address Type for the management interface.

This information is used to configure a management interface in the security module configuration.

a) In the Management IP Pool field, configure a pool of Local IP addresses, one of which will be assigned to each cluster unit for the interface, by entering the starting and ending addresses separated by a hyphen.

Include at least as many addresses as there are units in the cluster. Note that for the Firepower 9300, you must include 3 addresses per chassis, even if you do not have all module slots filled. If you plan to expand the cluster, include additional addresses. The Virtual IP address (known as the Main cluster IP address) that belongs to the current primary unit is not a part of this pool; be sure to reserve an IP address on the same network for the Main cluster IP address. You can use IPv4 and/or IPv6 addresses.

b) Enter a Network Mask or Prefix Length.

c) Enter a Network Gateway.

d) Enter a Virtual IP address.

This IP address must be on the same network as the cluster pool addresses, but not be part of the pool.

Step 18 On the Settings tab, for the Password, enter a password for the "admin" user.

Step 19 Click OK to close the ASA Configuration dialog box.

Step 20 Click Save.

The Firepower 4100/9300 chassis supervisor deploys the cluster by downloading the specified software version and pushing the cluster bootstrap configuration and management interface settings to each security module.

Step 21 For inter-chassis clustering, add the next chassis to the cluster: a) On the first chassis Firepower Chassis Manager, click the Show Cluster Details icon at the top right; copy the displayed cluster configuration.

b) Connect to the Firepower Chassis Manager on the next chassis, and add a logical device according to this procedure.

c) Choose Join an Existing Cluster.

d) Click the Copy config check box, and click OK. If you uncheck this check box, you must manually enter the settings to match the first chassis configuration.

e) In the Copy Cluster Details box, paste in the cluster configuration from the first chassis, and click OK.

f) Click the device icon in the center of the screen. The cluster information is mostly pre-filled, but you must change the following settings:

• Chassis ID—Enter a unique chassis ID.

• Cluster Key—(Not prefilled) Enter the same cluster key.

Click OK.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

17

Logical Devices

Configure Firepower Threat Defense Clustering

g) Click Save.

Step 22 Connect to the primary unit security module to customize your clustering configuration.

Configure Firepower Threat Defense Clustering

You can easily deploy the cluster from the Firepower 4100/9300 chassis supervisor. All initial configuration is automatically generated for each unit.

Before You Begin

• You must enable clustering for all 3 module slots in a Firepower 9300 chassis, even if you do not have a module installed. If you do not configure all 3 modules, the cluster will not come up.

• On the Interfaces tab, the port-channel 48 cluster type interface shows the Operation State as failed if it does not include any member interfaces. For intra-chassis clustering, this EtherChannel does not require any member interfaces, and you can ignore this Operational State.

Procedure

Step 1

Add at least one Data type interface or EtherChannel (also known as a port-channel) before you deploy the cluster.

You can also add data interfaces to the cluster after you deploy it.

Step 2

Add a Management type interface or EtherChannel.

Step 3

(Optional) Add a Firepower-eventing interface.

This interface is a secondary management interface for Firepower Threat Defense devices. To use this interface, you must configure its IP address and other parameters at the Firepower Threat Defense CLI. For example, you can separate management traffic from events (such as web events). See the configure network commands in the Firepower Threat Defense command reference.

Step 4

Choose Logical Devices to open the Logical Devices page.

The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.

Step 5

Click Add Device to open the Add Device dialog box.

If you have an existing logical device, you are prompted to remove the device and add a new one. All configuration on the device(s) will be replaced by the new information.

Step 6

For the Device Name, provide a name for the logical device. This name is used by the Firepower 4100/9300 chassis supervisor to configure clustering/management settings and to assign interfaces; it is not the cluster name used in the logical device configuration.

Step 7

For the Template, choose Cisco Firepower Threat Defense.

Step 8

For the Image Version, choose the Firepower Threat Defense software version. Make sure this version is compatible with your FXOS version and with the Firepower Management Center version.

Step 9

For the Device Mode, click the Cluster radio button.

Step 10 Click OK.

18

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Configure Firepower Threat Defense Clustering

If you have any standalone devices configured, you are prompted to replace them with a new cluster. You see the Provisioning - device name window.

All interfaces are assigned to the cluster by default.

Step 11 Click the device icon in the center of the screen.

The Cisco Firepower Threat Defense Configuration dialog box appears.

Step 12 On the Cluster Information tab, complete the following: a) In the Cluster Key field, configure an authentication key for control traffic on the cluster control link.

The shared secret is an ASCII string from 1 to 63 characters. The shared secret is used to generate the key.

This option does not affect datapath traffic, including connection state update and forwarded packets, which are always sent in the clear.

b) Set the Cluster Group Name, which is the cluster group name in the logical device configuration.

The name must be an ASCII string from 1 to 38 characters.

c) Select the management interface to use with the logical device from the Management Interface drop-down list.

Step 13 On the Settings tab, complete the following: a) In the Registration Key field, enter the key to be shared between the Firepower Management Center and the cluster members during registration.

b) In the Password field, enter a password for the admin user on the cluster.

c) In the Firepower Management Center IP field, enter the IP address of the managing Firepower

Management Center.

d) In the Search Domains field, enter a comma-separated list of search domains for the management network.

e) From the Firewall Mode drop-down list, choose Transparent or Routed.

f) In the DNS Servers field, enter a comma-separated list of DNS servers that the Firepower Threat Defense device should use on the management network.

g) In the Fully Qualified Hostname field, enter a fully qualified name for the Firepower Threat Defense device.

h) From the Eventing Interface drop-down list, choose the interface on which Firepower events should be sent. If not specified, the management interface will be used.

To specify a separate interface to use for Firepower events, you must configure an interface as a

firepower-eventing interface.

Step 14 On the Interface Information tab, configure a management IP address for each security module in the cluster.

Select the type of address from the Address Type drop-down list and then complete the following for each security module.

Note

You must set the IP address for all 3 module slots in a chassis, even if you do not have a module installed. If you do not configure all 3 modules, the cluster will not come up.

a) In the Management IP field, configure an IP address.

Specify an IP address on the same network for each module.

b) Enter a Network Mask or Prefix Length.

c) Enter a Network Gateway address.

Step 15 On the Agreement tab, read and accept the end user license agreement (EULA).

Step 16 Click OK to close the Cisco Firepower Threat Defense Configuration dialog box.

Step 17 Click Save.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

19

Logical Devices

Examples for Inter-Site Clustering

The Firepower 4100/9300 chassis supervisor deploys the cluster by downloading the specified software version and pushing the cluster bootstrap configuration and management interface settings to each security module.

Step 18 Add each unit separately to the Firepower Management Center using the management IP addresses, and then group them into a cluster at the web interface.

All cluster units must be in a successfully-formed cluster on FXOS prior to adding them to Firepower

Management Center.

Examples for Inter-Site Clustering

The following examples show supported cluster deployments.

Spanned EtherChannel Transparent Mode North-South Inter-Site Example

The following example shows 2 cluster members at each of 2 data centers placed between inside and outside routers (North-South insertion). The cluster members are connected by the cluster control link over the DCI.

The cluster members at each site connect to the local switches using spanned EtherChannels for the inside and outside. Each EtherChannel is spanned across all chassis in the cluster.

The inside and outside routers at each data center use OSPF, which is passed through the transparent ASAs.

Unlike MACs, router IPs are unique on all routers. By assigning a higher cost route across the DCI, traffic stays within each data center unless all cluster members at a given site go down. The lower cost route through the ASAs must traverse the same bridge group at each site for the cluster to maintain asymmetric connections.

In the event of a failure of all cluster members at one site, traffic goes from each router over the DCI to the cluster members at the other site.

The implementation of the switches at each site can include:

• Inter-site VSS/vPC—In this scenario, you install one switch at Data Center 1, and the other at Data

Center 2. One option is for the cluster units at each Data Center to only connect to the local switch, while the VSS/vPC traffic goes across the DCI. In this case, connections are for the most part kept local to each datacenter. You can optionally connect each unit to both switches across the DCI if the DCI can handle the extra traffic. In this case, traffic is distributed across the data centers, so it is essential for the

DCI to be very robust.

• Local VSS/vPC at each site—For better switch redundancy, you can install 2 separate VSS/vPC pairs at each site. In this case, although the cluster units still have a spanned EtherChannel with Data Center

1 chassis connected only to both local switches, and Data Center 2 chassis connected to those local switches, the spanned EtherChannel is essentially “split.” Each local VSS/vPC sees the spanned

EtherChannel as a site-local EtherChannel.

20

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Examples for Inter-Site Clustering

Spanned EtherChannel Transparent Mode East-West Inter-Site Example

The following example shows 2 cluster members at each of 2 data centers placed between the gateway router and two inside networks at each site, the App network and the DB network (East-West insertion). The cluster members are connected by the cluster control link over the DCI. The cluster members at each site connect to the local switches using spanned EtherChannels for both the App and DB networks on the inside and outside.

Each EtherChannel is spanned across all chassis in the cluster.

The gateway router at each site uses an FHRP such as HSRP to provide the same destination virtual MAC and IP addresses at each site. A good practice to avoid unintended MAC address flapping is to statically add the gateway routers real MAC addresses to the ASA MAC address table. Without these entries, if the gateway at site 1 communicates with the gateway at site 2, that traffic might pass through the ASA and attempt to reach site 2 from the inside interface and cause problems. The data VLANs are extended between the sites using

Overlay Transport Virtualization (OTV) (or something similar). You must add filters to prevent traffic from traversing the DCI to the other site when the traffic is destined for the gateway router. If the gateway router at one site becomes unreachable, you must remove the filters so traffic can be sent to the other site’s gateway router.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

21

History for Clustering

Logical Devices

See

Spanned EtherChannel Transparent Mode North-South Inter-Site Example, on page 20

for information about vPC/VSS options.

History for Clustering

Feature Name Platform

Releases

Intra-chassis Clustering for the Cisco ASA

1.1.1

Feature Information

You can cluster all ASA security modules within the Firepower 9300 chassis.

We introduced the following screen: Logical Devices > Configuration

Inter-chassis clustering for

6 ASA modules

1.1.3

Support for intra-chassis clustering on the

Firepower Threat Defense on the Firepower 9300

1.1.4

You can now enable inter-chassis clustering for the ASA. You can include up to 6 modules in up to 6 chassis.

We modified the following screen: Logical Devices > Configuration

The Firepower 9300 supports intra-chassis clustering with the Firepower Threat Defense application.

We modified the following screen: Logical Devices > Configuration

22

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Configure Service Chaining

Configure Service Chaining

The Cisco Firepower 4100/9300 chassis can support multiple services (for example, a firewall and a third-party

DDoS application) on a single blade. These applications and services can be linked together to form a Service

Chain.

About Service Chaining

In the current supported Service Chaining configuration, the third-party Radware DefensePro virtual platform runs in front of the ASA firewall. Radware DefensePro is a KVM-based virtual platform that provides distributed denial-of-service (DDoS) detection and mitigation capabilities on the Firepower 4100/9300 chassis.

When Service Chaining is enabled on your Firepower 4100/9300 chassis, traffic from the network must first pass through the DefensePro virtual platform before reaching the main ASA firewall.

The Radware DefensePro virtual platform may be referred to as Radware vDP (virtual DefensePro), or simply

vDP. The Radware DefensePro virtual platform may occasionally be referred to as a Link Decorator.

Prerequisites for Service Chaining

Prior to deploying Radware DefensePro on your Firepower 4100/9300 chassis, you must configure the

Firepower 4100/9300 chassis to use an NTP Server with the etc/UTC Time Zone. For more information about setting the date and time in your Firepower 4100/9300 chassis, see Setting the Date and Time .

Guidelines for Service Chaining

Models

• The Radware DefensePro platform is only supported on the Firepower 9300 security appliance.

Additional Guidelines

• The DefensePro application can run as separate instances on up to three security modules.

Configure Radware DefensePro Service Chain on a Standalone Logical Device

The following procedure shows how to install Radware DefensePro in a single Service Chain in front of a standalone ASAlogical device.

Note

If you are installing Radware vDP in front of ASA on a Firepower 4120 or 4140 security appliance, you must use the FXOS CLI to deploy the decorator. For full CLI instructions on how to install and configure

Radware DefensePro in a service chain in front of ASA on Firepower 4100 devices, refer to the FXOS

CLI configuration guide.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

23

Logical Devices

Configure Radware DefensePro Service Chain on a Standalone Logical Device

Before You Begin

• Download the vDP image from Cisco.com (see Downloading Images from Cisco.com

) and then upload that image to the Firepower 4100/9300 chassis (see Uploading an Image to the Firepower Security

Appliance ).

• You can deploy the Radware DefensePro application in a standalone configuration on an intra-chassis cluster; for intra-chassis clustering, see

Configure Radware DefensePro Service Chain on an Intra-Chassis

Cluster, on page 25

.

Procedure

Step 1

If you want to use a separate management interface for vDP, enable the interface and set it to be the mgmt type according to Edit Interface Properties . Otherwise, you can share the application management interface.

Step 2

Choose Logical Devices to open the Logical Devices page.

The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown.

Step 3

Create a standalone ASA Logical Device (see

Create a Standalone ASA Logical Device, on page 3

).

Note that before you click Save at the end of the procedure to create a standaolone ASA logical device, you must first follow the following steps to add a vDP decorator to the logical device.

Step 4

In the Decorators area, select vDP. The Radware: Virtual DefensePro - Configuration window appears.

Configure the following fields under the General Information tab.

Step 5

If you have more than one vDP version uploaded to the Firepower 4100/9300 chassis, select the version you want to use in the Version drop-down.

Step 6

Under the Management Interface drop-down, choose the management interface you created in step 1 of this procedure.

Step 7

Select the default Address Type, IPv4 only, IPv6 only, or IPv4 and IPv6.

Step 8

Configure the following fields, based on your Address Type selection from the previous step.

a) In the Management IP field, configure a local IP address.

b) IPv4 only: Enter a Network Mask.

IPv6 only: Enter a Prefix Length.

c) Enter a Network Gateway address.

Step 9

Click the checkbox next to each data port that you want to assign to the device.

Step 10 Click OK.

Step 11 Click Save.

The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module.

24

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Configure Radware DefensePro Service Chain on an Intra-Chassis Cluster

Configure Radware DefensePro Service Chain on an Intra-Chassis Cluster

The following procedure shows how to install the Radware DefensePro image, and configure it in a Service

Chain in front of an ASA intra-chassis cluster.

Before You Begin

• Download the vDP image from Cisco.com (see Downloading Images from Cisco.com

) and then upload that image to the Firepower 4100/9300 chassis (see Uploading an Image to the Firepower Security

Appliance ).

Procedure

Step 1

If you want to use a separate management interface for vDP, enable the interface and set it to be the mgmt type according to Edit Interface Properties . Otherwise, you can share the application management interface.

Step 2

Configure an ASA intra-chassis cluster (see

Configure ASA Clustering, on page 15

).

Note that before you click Save at the end of the procedure to configure the intra-chassis cluster, you must first follow the following steps to add a vDP decorator to the cluster.

Step 3

In the Decorators area, select vDP. The Radware: Virtual DefensePro - Configuration dialog box appears.

Configure the following fields under the General Information tab.

Step 4

If you have more than one vDP version uploaded to the Firepower 4100/9300 chassis, select the vDP version you want to use in the Version drop-down.

Step 5

Under the Management Interface drop-down, choose a management interface.

Step 6

Click the checkbox next to each data port that you want to assign to the vDP decorator.

Step 7

Click the Interface Information tab.

Step 8

Select the Address Type to be used, IPv4 only, IPv6 only, or IPv4 and IPv6.

Step 9

Configure the following fields for each Security Module. Note that the fields that display depend on your

Address Type selection from the previous step.

a) In the Management IP field, configure a local IP address.

b) IPv4 only: Enter a Network Mask.

IPv6 only: Enter a Prefix Length.

c) Enter a Network Gateway address.

Step 10 Click OK.

Step 11 Click Save.

The Firepower eXtensible Operating System deploys the logical device by downloading the specified software version and pushing the bootstrap configuration and management interface settings to the specified security module.

Step 12 Choose Logical Devices to open the Logical Devices page.

Step 13 Scroll through the list of configured logical devices to the entries for vDP. Verify their Attributes listed in the

Management IP column.

• If the CLUSTER-ROLE element displays as unknown for the DefensePro instances, you must enter the DefensePro application and configure the master IP address to complete the creation of the vDP cluster.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

25

Logical Devices

Open UDP/TCP Ports and Enable vDP Web Services

• If the CLUSTER-ROLE element displays as primary or secondary for the DefensePro instances, the applications are online and formed in a cluster.

Open UDP/TCP Ports and Enable vDP Web Services

The Radware APSolute Vision Manager interfaces communicate with the Radware vDP appliation using various UDP/TCP ports. In orer for the vDP application to communicate with the APSolute Vision Manager, you must ensure that these ports are accessible and not blocked by your firewall. For more information on which specific ports to open, see the following tables in the APSolute Vision User Guide:

• Ports for APSolute Vision Server-WBM Communication and Operating System

• Communication Ports for APSolute Vision Server with Radware Devices

In order for Radware APSolute Vision to manage the Virtual DefensePro application deployed on the FXOS chassis, you must enable the vDP web service using the FXOS CLI.

Procedure

Step 1

From the FXOS CLI, connect to the vDP application instance.

connect module slot console

connect vdp

Step 2

Enable vDP web services.

manage secure-web status set enable

Step 3

Exit the vDP application console and return to the FXOS module CLI.

Ctrl ]

Manage Logical Devices

You can delete a logical device, convert an ASA to transparent mode, change the interface configuration, and perform other tasks on existing logical devices.

Connect to the Console of the Application or Decorator

Use the following procedure to connect to the console of the application or decorator.

Note

If you encounter any issues with accessing the console, we recommend that you try a different SSH client or upgrade your SSH client to a newer version.

26

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Connect to the Console of the Application or Decorator

Procedure

Step 1

To connect to the console of the application or decorator: a) From the FXOS CLI, connect to the security module/engine:

Firepower-chassis # connect module slot_number console

Note

To connect to the security engine of a device that does not support multiple security modules, use 1 as the slot_number.

The first time you connect to the security module, you access the FXOS module CLI.

b) To connect to the application or decorator, enter the appropriate command for your device:

Firepower-module1>connect asa

Firepower-module1>connect ftd

Firepower-module1>connect vdp

Subsequent connections from the supervisor level of the FXOS CLI to the security module/engine access the security module/engine OS directly.

Step 2

(Optional) Exit the application console to the FXOS module CLI by typing Ctrl-A-D.

Exit the decorator console to the FXOS module CLI by typing Ctrl-]-.

You might want to access the FXOS module CLI for troubleshooting purposes.

Step 3

Return to the supervisor level of the FXOS CLI.

a) To exit the security module/engine console, type ~.

You exit to the Telnet application.

b) To exit the Telnet application, enter: telnet>quit

Example

The following example connects to an ASA on security module 1 and then exits back to the supervisor level of the FXOS CLI.

Firepower#

connect module 1 console

Telnet escape character is '~'.

Trying 127.5.1.1...

Connected to 127.5.1.1.

Escape character is '~'.

CISCO Serial Over LAN:

Close Network Connection to Exit

Firepower-module1>

connect asa

asa>

~

telnet>

quit

Connection closed.

Firepower#

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

27

Logical Devices

Delete a Logical Device

Delete a Logical Device

Procedure

Step 1

Choose Logical Devices to open the Logical Devices page.

The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.

Step 2

Click Delete for the logical device that you want to delete.

Step 3

Click Yes to confirm that you want to delete the logical device.

Step 4

Click Yes to confirm that you want to delete the application configuration.

Change the ASA to Transparent Firewall Mode

You can only deploy a routed firewall mode ASA from the Firepower 4100/9300 chassis. To change the ASA to transparent firewall mode, complete the initial deployment, and then change the firewall mode within the

ASA CLI. Because changing the firewall mode erases the configuration, you must then redeploy the configuration from the Firepower 4100/9300 chassis to regain the bootstrap configuration. The ASA then remains in transparent mode with a working bootstrap configuration.

Procedure

Step 1

Connect to the ASA console according to

Connect to the Console of the Application or Decorator, on page

26 . For a cluster, connect to the primary unit. For a failover pair, connect to the active unit.

Step 2

Enter configuration mode:

enable configure terminal

By default, the enable password is blank.

Step 3

Set the firewall mode to transparent:

firewall transparent

Step 4

Save the configuration:

write memory

For a cluster or failover pair, this configuration is replicated to secondary units: asa(config)# firewall transparent asa(config)# write memory

Building configuration...

Cryptochecksum: 9f831dfb 60dffa8c 1d939884 74735b69

3791 bytes copied in 0.160 secs

[OK] asa(config)#

28

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Change an Interface on a Firepower Threat Defense Logical Device

Beginning configuration replication to Slave unit-1-2

End Configuration Replication to slave.

asa(config)#

Step 5

On the Firepower Chassis Manager Logical Devices page, click the Edit icon to edit the ASA.

The Provisioning page appears.

Step 6

Click the device icon to edit the bootstrap configuration. Change any value in your configuration, and click

OK.

You must change the value of at least one field. Cisco recommends changing the Password to a new password because this setting is not important.

You see a warning about changing the bootstrap configuration; click Yes.

Step 7

Click Save to redeploy the configuration to the ASA.For an inter-chassis cluster or for a failover pair, repeat steps 5 through 7 to redeploy the bootstrap configuration on each chassis.

Wait several minutes for the chassis/security modules to reload, and for the ASA to to become operational again. The ASA now has an operational bootstrap configuration, but remains in transparent mode.

Change an Interface on a Firepower Threat Defense Logical Device

You can allocate or unallocate an interface, or replace a management interface on a Firepower Threat Defense logical device. You can then sync the interface configuration in the Firepower Management Center.

Before You Begin

• Configure your interfaces, and add any EtherChannels according to Edit Interface Properties and Create a Port Channel .

• You can edit the membership of an allocated EtherChannel without affecting the logical device or requiring a sync on the Firepower Management Center.

• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are allocated by default to a cluster), you need to unallocate the interface from the logical device first, then add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel to the device.

• If you want to replace the management or firepower eventing interface with a management EtherChannel, then you need to create the EtherChannel with at least 1 unallocated data member interface, and then replace the current management interface with the EtherChannel. After the Firepower Threat Defense device reboots (management interface changes cause a reboot), and you sync the configuration in the

Firepower Management Center, you can add the (now unallocated) management interface to the

EtherChannel as well.

• For clustering or High Availability, make sure you add or remove the interface on all units before you sync the configuration in the Firepower Management Center. Note that new interfaces are added in an administratively down state, so they do not affect interface monitoring.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

29

Logical Devices

Change an Interface on an ASA Logical Device

Procedure

Step 1

In the Firepower Chassis Manager, choose Logical Devices.

Step 2

Click the Edit icon at the top right to edit the logical device.

Step 3

Unallocate a data interface by de-selecting the interface in the Data Ports area.

Step 4

Allocate a new data interface by selecting the interface in the Data Ports area.

Step 5

Replace the management or eventing interface:

For these types of interfaces, the device reboots after you save your changes.

a) Click the device icon in the center of the page.

b) On the General/Cluster Information tab, choose the new Management Interface from the drop-down list.

c) On the Settings tab, choose the new Eventing Interface from the drop-down list.

d) Click OK.

If you change the IP address of the Management interface, then you must also change the IP address for the device in the Firepower Management Center: go to Devices > Device Management > Device/Cluster. In the

Management area, set the IP address to match the bootstrap configuration address.

Step 6

Click Save.

Step 7

Log into the Firepower Management Center.

Step 8

Select Devices > Device Management and click the edit icon ( ) for your Firepower Threat Defense device.

The Interfaces tab is selected by default.

Step 9

Click the Sync Interfaces from device button on the top left of the Interfaces tab.

Step 10 Click Save.

You can now click Deploy and deploy the policy to assigned devices. The changes are not active until you deploy them.

Change an Interface on an ASA Logical Device

You can allocate, unallocate, or replace a management interface on an ASA logical device. ASDM discovers the new interfaces automatically.

Before You Begin

• Configure your interfaces and add any EtherChannels according to Edit Interface Properties and Create a Port Channel .

• You can edit the membership of an allocated EtherChannel without affecting the logical device.

• If you want to add an already-allocated interface to an EtherChannel (for example, all interfaces are allocated by default to a cluster), you need to unallocate the interface from the logical device first, then add the interface to the EtherChannel. For a new EtherChannel, you can then allocate the EtherChannel to the device.

• If you want to replace the management interface with a management EtherChannel, then you need to create the EtherChannel with at least 1 unallocated data member interface, and then replace the current

30

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

Logical Devices

Change an Interface on an ASA Logical Device

management interface with the EtherChannel. After the ASA reloads (management interface changes cause a reload), you can add the (now unallocated) management interface to the EtherChannel as well.

• For clustering or failover, new interfaces are added in an administratively down state, so they do not affect interface monitoring.

Procedure

Step 1

In the Firepower Chassis Manager, choose Logical Devices.

Step 2

Click the Edit icon at the top right to edit the logical device.

Step 3

Unallocate a data interface by de-selecting the interface in the Data Ports area.

Step 4

Allocate a new data interface by selecting the interface in the Data Ports area.

Step 5

Replace the management interface:

For this type of interface, the device reloads after you save your changes.

a) Click the device icon in the center of the page.

b) On the General/Cluster Information tab, choose the new Management Interface from the drop-down list.

c) Click OK.

Step 6

Click Save.

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)

31

Change an Interface on an ASA Logical Device

Logical Devices

32

Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4)