Pass Cisco SNCF 300-710 Exam in First Attempt Easily

Cisco NGFW Firepower Threat Defense (FTD)

1. Lecture-01: Introduction and Concept of Cisco Firepower

Going to start Cisco fire power. But before start Cisco Firepower, we need to know the history and shortcut. No, I'm not going in detail about the history, because you're going to be confused. Used to see and search so many things like what is FTD, what is FMC, what is next generation firewall? And maybe you will see sometimes this Cisco Firepower, sometimes with upper case, sometime with lowercase, and so many things you will see to such this course. First of all we need to know Snort, what is Snot? This is intrusion detection system Snort, which is written in C language, c and C plus plus language. And this is free and open source. And Snort was developed by Martin. Why I'm telling you, snort. We will go later, you will understand why I'm telling you Snort. So Martin mr.Martin introduced Snort in. This is an open source IPS and IDs. We already know IPS and IDs we discuss in many courses, intrusion detection System and intrusion prevention system. You can use Snot as a packet Snipper. You can use Smart as a packet logging, you can analyze the protocol as well to use Snot and it's open source. If you search, you will find about this not if you google it Snot. So Snot is still there, which is free andopensourcenor.org, you can see this one, and you can use them, you can download them as well. And you can use as a firewall, as IPS, as IDs, as a packet logging, as analysed as a packet Snipper. And you can use for content matching, content filtering, OS fingerprint and for so many purposes you can use Snot, which is an open source. Okay, done. And which is introduced by Martin. Now, coming to the source: Fire. This is what I was talking about. Maybe someone, when you are searching, will find source power. So you will say, "What is source fire?" So, what exactly is firepower? So, in 2001, Martin used not engine to introduce network security hardware and software under the company name Source Fire. Because he introduced this 1098 development not in 1998, he used Snot, and he introduced and founded in 2001. Cisco. Then in 2013, Cisco acquired this source fire. You know, behind the source fire, there is a snot.Keep in mind, that's why I'm showing you this. So in 2013, after 1112 years, because it was going on top, cisco acquired Source Fire from Martin and they pay them 2.7 billion. That's what big organisation do. Like I give an example in many courses, the big fish, they are killing the small fish. So they take on this Source Fire from Martin in2013, after twelve years, when it's reached to SFE, because in that time, Source Fire was one of the top leader in cybersecurity industry, one of the top IPS and ideas, and it was the best solution in that time. So what Cisco did in 2013, Cisco put the Source Fire and his adaptive security applies means Cisco as a they integrate Source Fire inside their adaptive security applies with the series of X, they introduce a new series and they put this source Fire. And also they put this in ISRrouters the same image source Fire.We are still in source Fire. And later on they introduce a new hardware with Firepower 2001 in this series with the source Fire. So this was the story of Source Fire. So basically the name was taken from Martin company and they integrate them, keep in mind they integrate I will tell you a bit later, the integrated version, what is that one? Leave it. This version now coming to after 2013, what's this quarter when they acquire this source Fire, they changed the name to Fireside. In Virgin five they changed the name to new term which is Fireside. So it means that was Source fire. When they acquire them, then they change the name to fire site. Again, confusion. So in version five they change the name to Fireside. And in this Fireside they combined both the images Cisco as a image and also this Ft, this snot source Fire either Fireside again, I will come to this one. So it means in 2013 and version 15 the Cisco changed the name now coming to Firepower, which is today, now and maybe in future they can change the name, we don't know, it's up to them. But right now which we are studying. So the name is Firepower. What Cisco done? In Virgin six, they changed the name from Fireside to which was Fireside to fire power. In Virgin Five, it was fireside. But what they done, they say there are two types of firepower. One with the upper case power, the power is in upper case and another one is Firepower with lowercase. So Cisco says that whenever we write firepower with uppercase, it means we integrate fire power services inside our Cisco ASA image. Because in the beginning when they acquire them so they put a module inside Cisco essay extra module, you can put them and that module, they call them firepower with uppercase. You get what I'm saying? Because in interview once I was giving an interview, they asked me this thing in interview, they say what is the difference between fire power with upper case and lowercase? So when somebody asks you, you will say there is no difference, it's up to you. Why you are writing an uppercase and lower case is up to you. It's an English word you want to write in. So it's not like this. Basically, with uppercase power it means that the firepower services was an extra module which was forcefully integrated to Cisco essay. And when they write firepower with lowercase, it means a separate image. When they introduce a new image with the name FTD, which we will discuss a bit later and which is our topic. So with the lowercase it's FTD, which is a new image, a new separately device is not like a module. After the services, they introduced a new device which both the operating system was integrated. This not one. And also the Cisco ASA image. They combined them and they introduced a new device with the name FTD, which we will discuss. So it's clear. So this is Carl and Virgin Six Firepower before going to FTD if we come back. So old days. It was Source fire. The company was source fire because of Mountain. I told you this was the company name and knew it. Now, Cisco. And old days, it was Sourcefire defence center, the management system. But here we call them fireside Management Center. Then that older were called Sensor and then Cisco call them as a device. Then an oldest was defence center. Then they call them fireside Management Center source fire 3d System. Then they say, fireside system. And then they would say Management device. And this is manage device. And if we go back to this table. So in version four, they call them Defense Center. In virgin fire. They call them fireside. System and the management device called them Fireside Management Center. And Virgin Six. They call them firepower system. And the management device called them firepower Management Center. So now it's clear to you. Yeah, and our latest version is 6.7, which we will do and we will cover the latest up to now last month, which they released is Six. So now it's clear to you. Now, coming to the two devices which we are talking about here, that Management Center and Firepower System. What is these two things? So, if we go to this one, Firepower Thread Defense FTD, we call them a shortcut. So basically, this is the next generation firewall of Cisco FTD, the sensor which does everything, which is like a firewall, like a Cisco area. You can consider them like Paul Wall to Firewall, like a Juniper firewall. Either Paul Wall to Firewall, either FortiGate Firewall, or whatever. And this. They call it firepower thread defence FTD. We can manage this FTD locally, which I create this topology to manage them locally first. But if you have many firewall, many FTD, then you need a device to manage centrally from onelocation, which is called Firepower Management Center FMC. In shortcut, like in Palo Alto, we have what is called Panorama. Panorama, you can manage many devices from one centralised location. In 40 gate, we have 40 manager to configure many firewall from one centralised location. And when do we have Active Directory from where we can manage all the window PC? Centralized location. So same as we have Firepower Management Center, if you have more than one FTD and you want to manage them, because rather than to manage separately, suppose you have ten FTDs in your organization, what you're going to do, you will configure every each device separately, it's going to be a headache and more resources and many things require. And separately you will manage every device rather than this. You can register all the device. Just like when we join any PC to ActiveDirectory, the same you will join the FMC. And from central location you can manage all these device. And their device is called Firepower Management Center. It can be a virtual appliance, it can be a physical appliance, and you can deploy them in VMware as well FMC. So you can perform administrative tasks, management, analysis, reporting configuration, whatever you want to do with FTD, you will do from centralised location and then you can push those policies and those tasks to FTD. And this is called Firepower Management Center. Now, a little bit about Next generation Firewall, because we discuss many firewall type in Cisco as a course, like a traditional firewall, we sell three firewall and we discuss application firewall, we discuss packet filtering firewall. We discussed many firewall types there. One of them was the next generation firewall. Next generation Firewall can provide you all traditional firewall facilities and features, but they can give you only three things extra which other firewall cannot provide you, and those are app ID, user ID and content ID. These three are the feature of Next-generation Firewall. Applied means application awareness, and then container d like scanning IPS IDs. So many things are there to scan your and deep packet inspection. And the last one is user ID. You can create rule by users as well. And last thing which Next generation provide you, which a traditional firewall cannot, is a deep packet inspection. And I told you what is deep packet inspection. It's like a DNA test, which they can provide you whatever traditional farmers only do urine test and blood test, but they can provide you DNA test, which is in more detail and more like a city skin and more of those type of detail they can provide. This is called next generation firewall. Okay, so this was a history about Cisco Firepower from where it started and from where it end. And what is the latest name of FTD?

2. Lecture-02:Install and Add Cisco FTD 6.2.3-83 on EVE NG

We know what is FTD and what is FMC. Now how we gonna do our lab to use FTD and FMC? The best thing I already explained many courses are two main simulation application. One of them is Eve and the other one is GNS Three. And you can use VMware either other virtualization application. But I would highly recommend to use because it's easy to install, easy to configure and easy to manage. And also all the things are available in EU and also it's not problematic like GNS three, you will face many problems in GNS three, NVM as well. So it's better to use Eve and G. So we're going to do all our lab and Eve. Ok. So now we need images for these. I already share another course to location to download all these images. Let me show you quickly then I already download it, so I will install directly one of them I share torrent file which I have somewhere you can use both as similar 200 GB images are there regarding which is related to Eve. All of them are ready mate, you don't need to do anything. So this is Eve, full with every image. So this is Kimiu because I don't need this router image and these are router and this switches images. These are the images just unzip and drag to Kimu folder and you can use like a Windows Server 2019 twelve, eight Windows ten, eight, seven but the one I'm looking for is Firepower. So let's go to this is Linux and here is so here you will see Firepower next generation IPS, Firepower this one FTD and FMC. Now we know what is the difference between FTD and FMC and next generation IPS. We discussed in CC and P, you already know about that one. So here is FTD but there are two versions inside this one 6.23. So keep in mind you need to download the same version of FTD and FMC to support so6.23 either there is three version as well. So it's better to download these ones firepower 6.30 and Firepower FTD 30. These two images you need to download from this torrent file. Firepower six means version six, FTD means I led you to NFM CD management one, six, three, zero. Okay, so when you download this one either you can use another link is which I share as well, google Drive if you don't want to download or use for some reason, you cannot use torrent file because in some country it's not allowed and maybe for some other reason so you can use GoogleDrive link which I will share later. So this is the Google Drive and almost you will find the similar images like ASA images and all those and big IP and so many things. The one which I am interested in, this one here you can see Fire power 626 three and FTD six three. Okay, I will use in the lab 671, but if you have less minimum Ram, you require 16GB which I will show you right now. So it's better to use 6.3.There is no huge difference. It's like a window seven and window ten means just the graphic change and most of the stuff are similar. Okay. So you can use 6.3.It's better for you if you are doing lab inside your laptop. Okay. So you can download these images from here. I already done and I unzip in here as I believe yes 6.23 and 6.71 and also 6.23.So I have both the version and installation is similar. Inside file name should be Virtue A. Everyone owns 6.7 also and six point this one as well. And also this one as well. So keep in mind sometimes when you download from Google drive so they just put one with the file and when you boot up so it will not boot up. So keep in mind the name has to be this one. You can search on Eve website as well. Okay, so what I was so here is I will install an Eve. So I have already run Eve and you can use Venus CP to reach here. So this is my Venus CP. Okay. And Venus CP IPA is this 1131 root and EV is the password by default. Let me put Eve and you will log in. Maybe they will park you some other place. So you can come to this place. Kim You opt unit lab add on kim Yu here and the images which I download. So right side is the Eve and left side is your system where you need to go. Let me go back to this is documents and it's in download compress. And here is FTD this one. So the folder normally has to be the same. Firepower has been in the small and FTD in capital and just drag them to here until it's installed. Let me show you. So what I done, I put the IP up Eve then port number 22 SFTP root and by default password is Eve. You not change. Okay. So right side is the remote machine and left side is the local my PC. Okay. So what I done, I go to opt unit lab adds on and keep folder. Okay, you can just drag and drop. If you download from Cisco then you need to create a folder here with this name. Firepower FTD with version number and then choose all these inside. The name has to be Virshu Kukow. Kukow is the extension kim u copy and write. And this is version two. So that's why it's too there. And then just drag them to here. And because we have ready made image so we can drag straight away. And after drag you need to assign you need to fix permission command. So it's done. So I need to go to root if and from here go to edit and paste and enter fix permission. And this way it will be ready. So let me access this one and the image will be there. Sorry, it was so this is my e BYP and I can login password is Eve and Eve. Okay. And if I go to node and type firepower. So here is only FTD is showing because I just install FTD only, not FMC yet. So it's only showing this and just save. And this way you can access it. Okay, let me show you if you are using lab and your laptop. So I have Eve installed with this setting. Let me show you. I have 16 GBM in my system. But I allocate twelve GB Ram to Eve if you want to use FTD and FMC and want to do lab and your laptop. So, minimum requirement is 16 GB with I five processor. So what I do is I look at four processor and I look at twelve GB of my own laptop, which is 16 GB totally. So in this way you can do your lab and your laptop. Anyway I will do on my server. But just to show you here in case if you want. So this was the way to install Cisco Firepower. Keep in mind if you download directly if you have a Cisco account, the only thing is you need to give this name. You can change this name by the way, here, here is a folder new and just give them the name Firepower and whatever if you have FTD and then the version supposed 6.70 just permission and allowed everything. And when the folder is created, just drag that Cisco file here. So it will be a long name inside the file. Just change the name to this one which is inside here. Change the name to virtual. I don't know what is the name, but this the file name, it has to be like this one is the Eve Save.

3. Lecture-03: Install and Add Cisco FMC 6.2.3-83 on EVE NG

FMC because we discussed two things that are required: one is management, and the other is the firewall. So the firewall we already installed with FTD, and now we're coming to install FMC, same approach. What do you need to do? Do you need to log into your vNSCP? The IP address that is showing one is 4135, and you can use any FTP server; it's not vNSCP, this one is A. Otherwise, you can use any SFTP application. So let me run this one and this tip address. Okay, password Eve, and I'm already in Kimu. This time I'm going to drag FMC this one, firepower six FMC, and drag them here. So let me show you. You can use any SFTP pro, type the IP password login, local machine side lift side remote machine go to opt unit lab adds on Kimiu I'm already here. And then you can create a folder if you directly download, in my case, three DMAT images. No need to create a folder and you have to allow all the permissions and just drag the file and change the name to virtue A. Okay, but in my case, That's it. In case you download directly, suppose if you have a Cisco account and you download from here, suppose Cisco firepower FTD image download suppose if you have a Cisco account, so you go to Software Download. You will log in through your login detail. So here you will find different okay, the version which we have supported 6.7, which is the latest one. Whatever, you can do 6.3 as well. So here you will find different type. Okay, let me go to 6.7.Suppose 6.71 this one and if I go to it should be there is two type of okay, let me go to any maybe I'm on the wrong place Firepower okay, it should be okay, this is star one. I just need to show you there will be different types kimiu and also you need to type exactly the correct one. Okay, for some reason, maybe I'm in the wrong place, so let me go back to search another one. Okay, let me go back and search again. Either let me type here, Google and type Cisco FTD image download and go to software download is going to the same place. By the way, it has to show me different type. Okay, so this one should be written key cow and also because it's a different version for everylike for VMware, you have a different version for some reason, it's not showing me correctly. Let me go any other way. It's coming to the wrong place. Just 1 minute, let's see this one and this one suppose any image Management Center and this one is the let's go to FMC. It's the same thing. Let me show you, okay, I don't know for some reason it's not showing me correctly. I need to go to the proper place, just to show you. I suppose if you download, then you need to create a folder anyway, so it's copy. Now this one FMC. So what do you need to do? Go back to CLI, because I already applied. So you can apply this one fix permission command. And now you can go back and right click node and Firepower. And here you will see this time FMC as well. So with the version number and FMC. So FMC for Management. And the other one is the exit Firewall. Okay, so this one is now so now it's showing me two kwh FTD and FMC as well. So this was the way to install FMC and Eve.

4. Lecture-04: Introduction to FDM (Firepower Device Manager)

FDM Firepower Device Manager don't confuse yourself with FTD and FDM FTD is the next generation Firewall the product while FDM is Firepower Device Manager you already done and we done what was the name? HDM we configure with the help of ASDM but ASDM can configure only one at the same time. Same thing as FDM so basically FDM is on box solution suppose if you have only one FTD one FTD you install suppose in remote location either in your remote office either you have a Soho environment so it means only one device you are using so what are you going to do? You will say no. I need FMC as well to configure them. You will say okay. It's only one device, and now I have to spend more money to buy FMC for that no, so what do you do if you have only one FTD so you can configure it out of the box? There is a solution automatically, and it's called "Firepower Device Manager," like when you configure a four-ticket firewall. When you configure PaloAlto, you access them directly in the browser; you've already done both courses when you configure Paul to Firewall, and you assign management IP just type that management IP in the browser, and you access Paul to Firewall, so why not FTD? Yes, you can do it, which is what they call it; they change the name, and that's why you are giving me money to show you this one; otherwise, it's so easy if you already know Palo Alto Firewall, you already know 40 G firewall, and you need to know Firepower as well, but just to make you confused, what the hell is FDM? So Firepower Device Manager is nothing but a web based interface where you can access FTD directly without the help of FMC so for small scale solution to install FTD locally you have a solution web based solution which they call them FDM so local management is possible with the help of FDM for midsize network. For branch office. For remote branch you can use FDM you do need FMC to configure your Firewall and I believe you can up to five years is five users can log in at the same time but when you exceed more than five. Then the old session will expire so this is the only limitation on the same time but we don't need so you can use FDM to configure the Firewall to manage the firewall reporting monitoring dashboard everything is available in this single interface to do it. You can configure access control policy. You can configure net policy. You can configure IPS. You can configure IDs .You can configure policy. You can configure you can change the theme you can configure routing everything with the help of FDM but it's nothing but a web browser where you will access FDM directly but keep in mind there is something which is by default when you are using FDM zero slash zero interface has to be connected outside. Otherwise you have to do many changes. And that's why I created this topology here. And zero slash zero is connected outside, then zero one interface has to be connected to inside. It will be easy for you. And of the day we don't need interfaces either this side or this side. So Cisco says, if you want to deploy FTD, it's better to connect zero slash zero to outside and zero slice one to inside. It will be easy for you to deploy them. Otherwise there is not mandatory or compulsory to do like this. The beauty of this FDM, it doesn't require anyFlash, it doesn't require any Java to install. It doesn't require any plug in to install. It's a simple browser type the IP. Why I'm telling you this? Because we did it in a square safi wall. When we installed what was the ASDM, we encountered many issues, as did you. There was Java that was not installed, then another thing, then some browsers that did not support it, then Windows 10 blocks you from using Java. Google Prompt said that we no longer have Flash installed and so many other things. So there is no such thing that for FDM you need Firepower device manager to install anything. Just configure the management IP and type that IP in your browser. And you can access the device directly. And this was introduced in 6.2.Okay, this is called FDM because we will use this one to configure the first time. So now what feature can FDM provide us? So initial deployment you can use. You can do monitoring, you can do net policy, you can configure routing policy, you can configure excess control policy, everything. The only drawback when you install Cisco Ft, FTD standalone means like without FMC to use locally FDM. So there is no transparent mode available. This is only drawback. Otherwise rest of everything is available to use FDM. And here is some example. You can create object, you can create policy, you can do monitoring, you can do URL filtering, application and so many things. Whatever you can do centralizedly, you can use FDM to do locally on one device. Because in many organisations they have branch offices and there are only one device installed, then you need to use FDM rather than to use FM. See, it's clear.

5. Lecture-05: Configure and Setup Cisco FTD Lab for FDM Access.

Create a small lab. First of all, we will configure FTD locally, then we will jump to FMCOK, which is a centralised management system. But first, we need to know about FTD locally. Why? In branch offices and remote branches you will see FTD without FMC. So definitely you need to know both. Okay, so what I'm going to do, let's create a topology like this one, I will take FTD, okay? This one is zero, is external interface and then management I will connect and then I will take one PC as an example for inside, okay, inside we're going to use 192-1681 subnet, and for external we are going to use 192-16-8114 subnet. Four one is my ICP IP so they will provide dynamically IP to DHCP. Either we can configure static as well. Okay, so this is my lab, and then I will take a docker as an internal PC, you can take as a Windows XP, Windows seven, either Windows ten, you can use docker as well, it's up to you. Okay, so this is the topology which we going to use. You can use Linux tiny core docker if you have less memory. So this docker require only KB's memory. Okay, so you can use this one, I will share everything and I will show you what you need. And from here to download these devices images. Okay, so let's go to topology. I'm an Eve and first of all I need note here in node I will type Cisco firepower, okay? And I'm going to take the latest version of Cisco Firepower, which is 6.7, so Firepower FTD 6765, and I'm going to change the name to FTD. Okay, I only need one number and I can change the icon to something that looks like a firewall because FTD, at the end of the day, is a firewall. Okay, so let me take this one and you can increase the memory if you want it's HGB it's okay, and save. And let me type here, internet is the name and I will use cloud one which is connected to my external interface. I will show you this one as well, don't worry and save. Okay, so this is my internet. So I will connect this internet cloud to zero which is by default DHCP enabled to connect to outside zero and save. Now I need one internal PC for test purpose. So what I will do, note, and here I can use docker and you can use live Linux tiny core. If you are using Eve Community edition, I will share those as well. So from here I will take this one eve gist of if you are using Professional edition and I will say this is PC one, I will change the name and also let me change the icon to something look like internal PC okay so let me go up and let's take this image and I will use RDP you can use directly VNC as well. So this is my internal and internal will connect to one interface so change this one to one and save okay I don't need this one by mistake. This one is type so I connect one PC as internal OK and now I need for management purpose I need another one even though if you can use this one as a management as well but anyway I will go to network and this time I will take the stock PC and here I will say Mgmt to support like a management and management cloud. I will connect this one to management this time okay it's written MGM to something so here is my topology. A small topology okay and let's boot up this one to start and let's start before starting this docker Ineed to assign IP but let me show you what I need so my internal subnet will be 192.168 one I will assign this IP to my internal PC so bold and you can change the colour if you want okay so let me put this IP here and this side I will assign 100 okay so let me type this IP here 100 by the way so let me type the whole IP this is 124 so this is the internal interface IP okay and I can change the colour if you want and let me assign this one here externally let me duplicate this one externally as I told you we're going to use in my case one one four in your case it can be anything cloud so here I would say and this one IP is my ISP IP so I will forward all that traffic to this IP and this side should be DHCP automatically if you want you can put a static IP as well so let me type DHCP so this side will get sorry let me take here DHCP. Now coming to management management I'm using my WiFi subnet which is my home WiFi router 100 subnet okay so what I will do, let me copy duplicate this one and here we will assign suppose 100 dot something and maybe you have zero or one so you will use that one. So here I would say 200 far away IP so that it's not used in my home some routers okay let me change the colour so this is management IP which will be configured so if we assign here okay that's it and this is my management PCI will reach to this device from this browser so this is a small topology and let me start this device okay so I boot this device and let me start this one as well okay because it will take almost 25 to 30 minutes first time FTD second time when you configure them first time then it takes less time. Maybe ten to 15 minutes to boot up. Then it depend on your Ram. If you have much Ram then it can boot up in six to eight minutes. But first time whatever your situation is it will take 20 to 25 minutes to boot up. Okay? So it will boot up. And this is our topology, this is our ISP Internet. Here we will use DHCP internals. This interface will be 100 and PC. Okay I was talking about PC. Let's configure the PC as well. So let me stop this PC because this is a docker in professional Edition. So how you can configure go to startup configuration and this PC one they will take the docker automatically here click on this PC and there is the way to assign IP to docker and professional Edition. There is the command IP address one default 100which is my firewall IP and the steel DNS. So you don't need to know about this one is just the script to use them. So paste the script here and save when you say there will be off you need to drag to on that's it and close. And now you can start this docker. So this is the way to assign IP to docker if you are using a professional edition otherwise you can use other Linux docker which I will show you later in the course incase if you are using your own PC and doing this lab okay so I will show you that way as well. That's all there is to it. If you want to test whether or not the IP address is correct, you can use RDP, VNCP, or HTML files. Okay, so this is the Docker for inside, so why not verify it before leaving our lab? So if we go to the application system tool and here is and here you can type "show IP" and it's better to type "if config dat ethernet zero" so this is the IP, you can see the IP is okay, it's the IP address, and this is the subnet mask. Okay, and if you say "route," here it will show you "route," and Linux is the Linux Docker, so you can use the Linux command to check out. That's it. So this was our lab setup. We will come back to this lab after a while. Okay, so let me quit this video here.

Hide