Sie sind auf Seite 1von 70

GSSO Channel Engineering

October 2017
POV Process
Install FTD
dCloud
Configuration
Risk Reports
Sanitize
Agenda
POV Process
Partner Executed POV
Well-established process to ensure success and drive partner profitability. The Fire Jumper
program builds competence with Cisco solutions and prepares partner SEs for POVs. Individual
and partner incentives and promotions help to migrate Cisco and competitive installed base.

Training & Incentives & POV Partner


Enablement Promotions Delivery Profitability

1. Well defined POV program with


Fire Jumper trained partner SEs engage established Win Criteria
with customers and lead POVs 2. Best Practices Guides for repeatable
processes and increased Win Rate
3. Engagement with Channel and Direct
teams for opportunities

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4
On-Site POV Process
Software Download
Software Installation
Bootstrap
Licensing
Initial Configuration
Customer Report Generation
Device Sanitization

Proof of Value: https://communities.cisco.com/docs/DOC-65405


2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5
dCloud POV
Pre-Configured & pre-licensed Manager
Limited on-site deployment
ASA or Firepower Appliance
Optional Endpoint Kit

Qualifies for CFNA POVs


Ensures consistency and saves time
Coverage
Firepower Services for ASA 5.4
Firepower Services for ASA 6.1
Firepower Threat Defense 6.1
Stealthwatch 6.8 [Q3 FY17]
Proof of Value: https://communities.cisco.com/docs/DOC-65405
2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6
POV Methodology

Find
Opportunity

Find Installed customer base


Opportunity
Competitive take-outs
Demand generation activities
Call campaigns
Account mapping

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7
POV Methodology

Find Presentation
Opportunity & Demo

Presentation dCloud for demo delivery


& Demo https://communities.cisco.com/docs/DOC-65440
Prepare for demos through Fire Jumper Program
https://communities.cisco.com/docs/DOC-55046
Partner Help for delivery of customer facing
presentations and demos
www.cisco.com/go/ph

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8
POV Methodology

Find Presentation Proof of


Opportunity & Demo Value

Proof of Win Criteria defined up-front to limit scope of POV


Value
Data Collection Worksheet to properly prepare solution
configuration
On-site delivery leveraging dCloud where available
Customer facing meeting to deliver reports focused on
Cisco differentiating value
CFNA POV submission for incentives
2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9
POV Hardware Sourcing (if required)

Find Presentation Proof of


Opportunity & Demo Value

POV POV hardware available through Cisco account team


Hardware
Primary use for strategic POVs with high performance
appliances (e.g. Firepower 4100 / 9300)
Requires deal registration and SFDC opportunity
creation by Cisco Security AM
Contact Cisco PDM or Security AM for support

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10
Proof of Value
Deployment Options
On-Site Sensor and FMC
Build VMware ESXi server
Internet
Download and install FMC VM
Add Licenses to FMC
Update FTD Software
Firewall Place FTD on span or tap port
Configure Policies:
span / tap System
FTD
Switch Health
Intrusion
File
Access Control

Perform POV
FMC
Generate Risk Reports
Users Active
Directory
VMware Risk Sanitize (FTD, FMC)
ESXi Reports
LAN

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12
On-Site Sensor and dCloud FMC

Schedule dCloud Session


dCloud FMC
Download and install FMC VM
Risk Add Licenses to FMC
Reports
TCP 8443
Update FTD Software
Firewall
Place FTD on span or tap port
Internet Connection TCP 8443
span / tap
FTD Configure Policies
Switch
System
Health
Intrusion
File
Access Control
Optional: An Active Directory
1-to-1 NAT configuration is
required for additional user
Perform POV
and hostname context sent to
Users Active
Directory dCloud. This is not a Create Risk Reports
requirement for the POV.
LAN Sanitize (FTD) FMC

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13
Install FTD
FTD Sensor Installation Steps

1. Prepare for Installation


Download Firepower Threat Defense (FTD) Software
Confirm Health of Solid State Drive (SSD)
2. Verify and Upgrade the ROMMON Image
3. Reimage ASA to FTD

*Only required if running Firepower Services, IPS, or CX Software

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15
Download FTD Software
(5515-X Example)

Go to: http://software.cisco.com/download/navigator.html

Navigate to Downloads Home > Products > Security > Firewalls > Next-Generation Firewalls
(NGFW) > ASA 5500-X with FirePOWER Services > ASA 5515-X with FirePOWER Services
> Firepower Threat Defense Software
Select the following options and download the versions listed below or later.
Firepower Threat Defense for ASA 55XX series
v6.1.0 (ftd-6.1.0-330.pkg)
Firepower Threat Defense v6.1.0 boot image for
ASA 5512/5515/5525/5545/5555 devices
(ftd-boot-9.6.2.0.cdisk)

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16
Confirm Health of SSD
FTD is factory installed on ASA5500-X FTD SKUs
e.g. ASA5525-FTD-X; SF-ASA-TD6.1.0-K9 Base Software
Installation for FTD on a ASA5500-X platform requires one or two SSD drives
ASA5500-X-SSD12= SKU

Order ASA with SSD

ciscoasa# show inventory


Name: "Chassis", DESCR: "ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC"
PID: ASA5515 , VID: V01 , SN: FGH123456A1

Name: "Storage Device 1", DESCR: "Unigen 128 GB SSD MLC, Model Number:
Micron_M550_MTFDDAK123MAY"
PID: N/A , VID: N/A , SN: 12345678900

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17
Install FTD
Verify & Upgrade ROMMON Image
Check ROMMON Version

Only Required for ASA 5506-X series, ASA 5508-X, and ASA 5516-X models
ROMMON version must be 1.1.8 or later to reimage to FTD
View current ROMMON in Mod 1 of MAC Address Table
show module

ciscoasa# show module


Name: "Chassis", DESCR: "ASA 5506-X with SW, 6 GE Data, 1 GE Mgmt, AC"
[]
Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------------------------- ----------------- ---------------- --------------
1 7426.aceb.ccea to 7426.aceb.ccf2 1.0 1.1.1 9.3(2)2
sfr 7426.aceb.cce9 to 7426.aceb.cce9 N/A N/A

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19
Download the ROMMON Image
(5506-X Example)

Go to: http://software.cisco.com/download/navigator.html
Navigate to Downloads Home > Products pane. Continue to navigate to Downloads Home >
Products > Security > Firewalls > Next-Generation Firewall (NGFW) > ASA 5500-X with
FirePOWER Services > ASA 5506-X with FirePOWER Services > ASA Rommon Software
Select the following options and download the versions listed below or later
ASA ROMMON Software (asa5500-firmware-1108.SPA)

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20
Upgrade the ROMMON

Configure the management 1/1 interface with an IP address with connectivity to


a TFTP server that can source the required ROMMON software
ASA 5506-X Series, 5508-X, and 5516-X use interface management 1/1

Use ping command to verify connectivity

ciscoasa# config t
ciscoasa (config)# interface management1/1
ciscoasa (config)# ip address 10.10.200.3 255.255.255.0
ciscoasa (config)# ping 10.10.200.2

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21
Upgrade the ROMMON

Copy the ROMMON image to ASA flash memory with the copy command
ciscoasa (config)# copy tftp://10.10.200.2:/asa5500-firmware-1108.SPA
disk0:asa5500-firmware-1108.SPA
Address or name of remote host [10.10.200.2]?
Source filename [asa5500-firmware-1108.SPA]?
Destination filename [asa5500-firmware-1108.SPA]?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[]
!!!!!!!!!!!!!!!!!!!
9241408 bytes copied in 10.240 secs (924140 bytes/sec)

Upgrade the ROMMON image with the upgrade rommon command


ciscoasa (config)# upgrade rommon disk0:asa5500-firmware-1108.SPA
Computed Hash SHA2: d824bdeecee1308fc64427367fa559e9
[]
Verification successful.
System config has been modified. Save? [Y]es/[N]o: Y
Cyrptochecksum: 3ba071b1 6fdc7ca1 1ba8e23d 200c580f

6788 bytes copied in 0.230 secs


Proceed with reload? [confirm]

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22
Verify Upgraded ROMMON Version

Confirm ROMMON upgrade in Mod 1 of MAC Address Table


show module

ciscoasa# show module


Name: "Chassis", DESCR: "ASA 5506-X with SW, 6 GE Data, 1 GE Mgmt, AC"
[]
Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------------------------- ----------------- ---------------- --------------
1 7426.aceb.ccea to 7426.aceb.ccf2 1.0 1.1.8 9.3(2)2
sfr 7426.aceb.cce9 to 7426.aceb.cce9 N/A N/A

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23
Install FTD
Access the ROMMON
ciscoasa# reload
System config has been modified. Save? [Y]es/[N]o: N
Proceed with reload? [confirm]
ciscoasa#
***
*** --- START GRACEFUL SHUTDOWN ---
Reload the ASA and press Esc during Shutting down isakmp
startup when prompted []
*** --- SHUTDOWN NOW ---
If you see, Launching BootLoader Process shutdown finished
you waited too long and must reload Rebooting.....
[]
the ASA again Booting from ROMMON
[]
Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.
Boot interrupted.

Management0/0
Link is DOWN
MAC Address: a0ec.f938.fdac

Use ? for help.


rommon #0>

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25
Configure IP Settings
ASA 5512-X, 5515-X, 5525-X, 5545-X, and 5555-X
o Use interface management 0/0
rommon #0> interface management0/0
o Boot image file extension is .cdisk rommon #1> address 10.10.200.3
rommon #2> server 10.10.200.2
ASA 5506-X Series, 5508-X, and 5516-X rommon #3> gateway 10.10.200.1
rommon #4> file ftd-boot-9.6.2.0.cdisk
o Use interface management 1/1 rommon #5> set
ROMMON Variable Settings:
by default and do not require ADDRESS=10.10.200.3
the interface command SERVER=10.10.200.2
GATEWAY=10.10.200.1
o Boot image file extension is .lfbff PORT=Management0/0
VLAN=untagged
IMAGE=ftd-boot-9.6.2.0.cdisk
CONFIG=
LINKTIMEOUT=20
PKTTIMEOUT=4
RETRY=20
rommon #5> sync
Updating NVRAM Parameters...

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26
rommon #6> ping 10.10.200.2
Download the Boot Image Sending 20, 100-byte ICMP Echoes to 10.10.200.2, timeout is
4 seconds:
?!!!!!!!!!!!!!!!!!!!
Success rate is 95 percent (19/20)
rommon #7> tftpdnld
ROMMON Variable Settings:
ADDRESS=10.10.200.2
Ping to verify connectivity to SERVER=10.10.200.3
TFTP server GATEWAY=10.10.200.1
PORT=Management0/0
Enter tftpdnld to load boot image VLAN=untagged
IMAGE=ftd-boot-9.6.2.0.cdisk
CONFIG=
LINKTIMEOUT=20
PKTTIMEOUT=4
RETRY=20

tftp ftd-boot-9.6.2.0.cdisk@10.10.200.2 via 10.10.200.2


!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[]
Received 101173248 bytes
[]
Launching TFTP Image...
[]
ciscoasa-boot>

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27
ciscoasa-boot> setup

Establish Connectivity Welcome to Cisco FTD Setup


[hit Ctrl-C to abort]
Default values are inside []

Enter a hostname [ciscoasa]: <FTD Hostname>


Do you want to configure IPv4 address on management interface?(y/n)
[Y]: Y
Do you want to enable DHCP for IPv4 address assignment on management
Use the setup command to configure interface?(y/n) [N]: N
Enter an IPv4 address [192.168.8.8]: <FTD Sensor Management IP>
network settings Enter the netmask [255.255.255.0]: <Netmask>
Enter the gateway [192.168.8.1]: <Default Gateway>

Establish temporary connectivity to HTTP or Do you want to configure static IPv6 address on management
interface?(y/n) [N]: N
FTP server to download system software Stateless autoconfiguration will be enabled for IPv6 addresses.
Enter the primary DNS server IP address: <DNS Server>
Do you want to configure Secondary DNS Server? (y/n) [n]: N
Only HTTP or FTP supported for system Do you want to configure Local Domain Name? (y/n) [n]: N
software installation Do you want to configure Search domains? (y/n) [n]: N
Do you want to enable the NTP service? [Y]: Y
Enter the NTP servers separated by commas: <NTP Server>
Do you want to enable the NTP symmetric key authentication? [N]: N
Please review the final configuration:

[]

Apply the changes?(y,n) [Y]: Y


Configuration saved successfully!
Applying...
Restarting network services...
Done.

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28
Install FTD System Software
Use the system install command to install the system software
asasfr-boot> system install ftp://admin:C1sco12345@10.10.200.2/ftd-6.1.0-330.pkg

######################## WARNING ############################


# The content of disk0: will be erased during installation! #
#############################################################

Do you want to continue? [y/N]: Y


Erasing disk0 ...
Verifying
Enter credentials to authenticate with ftp server
Username: admin
Password:
Verifying
Downloading...
Extracting
Package Detail
Description: Cisco ASA-FTD 6.1.0-330 System Install
Requires reboot: Yes
Do you want to continue with upgrade? [y]: Y
Warning: Please do not interrupt the process or turn off the system. Doing so might leave system in unusable state.

Starting upgrade process ...


Populating new system image

Reboot is required to complete the upgrade. Press 'Enter' to reboot the system.

See the Reimage the Cisco ASA or FTD Device document for additional details:
http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/reimage/asa-ftd-reimage.html
Install FTD
Allow 30 minutes or longer for installation and reboot the ASA when prompted

Login with the default username: admin and password: Admin123

Read and Accept the EULA

Cisco ASA5515-X Threat Defense v6.1.0 (build 330)


firepower login: admin
Password: Admin123
You must accept the EULA to continue.
Press <ENTER> to display the EULA:
[]
Please enter YES or press <ENTER> to AGREE to the EULA:
System initialization in progress. Please stand by.

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30
You must change the password for 'admin' to continue.
Enter new password: <new password>
Install FTD Confirm new password: <repeat password>
You must configure the network to continue.
You must configure at least one of IPv4 or IPv6.
Change the admin password Do you want to configure IPv4? (y/n) [y]: Y
Do you want to configure IPv6? (y/n) [n]: N
Configure IP addresses & other Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]:
settings as prompted based on Enter an IPv4 address for the management interface
[192.168.45.45]: <FTD Management IP>
the Data Collection Worksheet Enter an IPv4 netmask for the management interface
[255.255.255.0]: <Netmask>
Select no when asked to
Enter the IPv4 default gateway for the management interface
manage the device locally [192.168.45.1]: <Default Gateway>
Enter a fully qualified hostname for this system [firepower]:
Risk Reports are not supported
<hostname>
via the on-box Manager, Enter a comma-separated list of DNS servers or 'none' []:
Firepower Device Manager <dns servers>
Enter a comma-separated list of search domains or 'none' []:
If your networking information has changed, you will need to
reconnect.
For HTTP Proxy configuration, run 'configure network http-proxy'
Manage the device locally? (yes/no) [yes]: <no>
Configure firewall mode? (routed/transparent) [routed]:
<transparent>
Configuring firewall mode ...
[]
>
2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31
Reconfigure Management IP Address
(If Required)
Changed via CLI configure network command

Verified via CLI show network command


> configure network ipv4 manual 10.10.200.2 255.255.255.0 10.10.200.1
DNS Configuration has changed at
/ngfw/usr/local/sf/lib/perl/5.10.1/SF/NetworkConf/NetworkSettings.pm line 1466.

Setting IPv4 network configuration.


Network settings changed.
> show network
[]
=======[ br1 ]=======
State : Enabled
Channels : Management & Events
[]
----------------------[ IPv4 ]----------------------
Configuration : Manual
Address : 10.10.200.2
Netmask : 255.255.255.0
Broadcast : 10.10.200.1
2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32
dCloud
Access and Schedule
dCloud Features / Access
Setting up a dCloud POV Sessions
Browse to https://dcloud.cisco.com

Select Login

Login in with CCO ID

Select region closest to you (if prompted)

Select Catalog from the toolbar

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34
dCloud Features / Access
Setting up a dCloud POV Sessions
Browse to http://dcloud.cisco.com

Select region closest to you (if prompted)

Select Login

Login in with CCO ID

Select Catalog from the toolbar

Search for Firepower POV

Select Schedule for desired POV demo

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35
dCloud Features / Access
Setting up a dCloud POV Sessions
Browse to http://dcloud.cisco.com

Select region closest to you (if prompted)

Select Login

Login in with CCO ID

Select Catalog from the toolbar

Search for Firepower POV

Select Schedule

Enter POV timeframe and click Next

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36
dCloud Features / Access
Setting up a dCloud POV Sessions
Browse to http://dcloud.cisco.com

Select region closest to you (if prompted)

Select Login

Login in with CCO ID

Select Catalog from the toolbar

Search for Firepower POV

Select Schedule

Enter POV timeframe and click Next

Enter relevant information and click Next

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37
dCloud Features / Access
Setting up a dCloud POV Sessions
Browse to http://dcloud.cisco.com

Select region closest to you (if prompted)

Select Login

Login in with CCO ID

Select Catalog from the toolbar

Search for Firepower POV

Select Schedule

Enter POV timeframe and click Next

Enter relevant information and click Next

Select Schedule

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38
dCloud POV Duration

Initial dCloud Schedule limits users to 5-day demos


dCloud will authorize 30-day extension for all POVs
Extensions beyond 30-days are handled on a case by case basis and
require additional customer opportunity information
Risk reports are based on 5-days of customer traffic and additional
time should only be used as required to troubleshoot receiving network
traffic or other items

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39
Configuration
Connect FTD to FMC
Capture Relevant FMC Information
The Dashboard will reflect scheduled sessions

Select View for the Firepower Proof of Value

Select Details

Note the Owner and Session ID information


Owner with @ symbol not supported
If present, use dcloud instead

Scroll down and note the Public Address

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41
Configure FTD via CLI
Access FTD CLI

If using the dCloud FMC, change the management-port to 8443

Configure FMC IP as Public Address from dCloud session details

The dCloud default registration key is C1sco12345 and the default nat-id is 12345

> configure network management-port 8443


Management port changed to 8443.
> configure manager add <FMC IP>
<Registration Key> <nat-id>
Manager successfully configured.

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42
Login to the FMC

Browse to the FMC using https to the Public Address from dCloud session details

Login using Owner for the FMC username and Session ID for the password

326411

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 43
Enable Smart License Evaluation Mode
Navigate to System > Licenses > Smart Licenses

Select Evaluation Mode

Confirm by selecting Yes

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 44
Add FTD to FMC

Navigate to Devices > Device Management

Select Add > Add Device

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 45
Connect FTD to FMC

If using dCloud:
Use the Host of DONTRESOLVE
Registration Key of C1sco12345
Cisco POV Access Control Policy
Expand the advanced settings and enter a
Unique NAT ID of 12345
Select the Malware, Threat, and URL Filtering
Licenses
Click Register

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 46
Troubleshoot FTD to FMC Connection

Use show managers from FTD CLI to confirm FMC IP address and view status

> show managers


Host : 64.100.11.49
Registration Key : ***
Registration : Pending
RPC Status :
>

Ensure registration key and unique NAT-ID match with FMC

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 47
Troubleshoot FTD to FMC Connection

Enter expert mode

Use sudo pigtail to review debugging information

Open a POV TAC case through your Cisco GSSO CSE as required

> expert
admin@ftd5506:~$ sudo pigtail

********************************************************************************
** Displaying logs: HTTP ACTQ DCSM VMSS MOJO NGUI NGFW TCAT VMSB DEPL USMS MSGS
********************************************************************************
[]

MSGS: 10-07 02:21:19 ciscoasa SF-IMS[10849]: [15490] sftunneld:sf_ssl [INFO] Connect to 64.100.11.216 on port 8443 -
br1
MSGS: 10-07 02:21:19 ciscoasa SF-IMS[10849]: [15490] sftunneld:sf_ssl [INFO] Initiate IPv4 connection to 64.100.11.216
(via br1)
MSGS: 10-07 02:21:19 ciscoasa SF-IMS[10849]: [15490] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to
64.100.11.216:8443/tcp
MSGS: 10-07 02:21:19 ciscoasa SF-IMS[10849]: [15490] sftunneld:sf_ssl [INFO] Wait to connect to 8443 (IPv6):
64.100.11.216
MSGS: 10-07 02:21:37 ciscoasa sudo: admin : TTY=ttyS1 ; PWD=/home/admin ; USER=root ;
COMMAND=/ngfw/usr/local/sf/bin/pigtail

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 48
Configuration
Object Management
Object Management: Edit HOME_NET Variable
Browse to Objects > Object Management
Select Variable Set on the left hand side
Select to edit the Default-Set

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 50
Object Management: Edit HOME_NET Variable

Select next to HOME_NET

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 51
Object Management
Click to create a new
Network Object

Provide a Name
Enter Network information
that matches the customer
environment
Click Save
2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 52
Object Management: Edit HOME_NET Variable
Include the New Network Object in the HOME_NET Variable
Click Save, Save, Yes

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 53
Object Management: Edit Network Discovery Policy
Browse to Policies > Network Discovery
Select to delete the IPv4-Private-All-RFC1918
Click Yes to confirm

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 54
Object Management: Edit Network Discovery Policy
Select to Add a New Rule
Select the Users checkbox
Add the newly created HOME_NET variable to the right hand pane
Click Save

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 55
Configuration
Configure Passive Interface
Configure Passive Interface

Navigate to Devices > Device Management


Select to Edit Device

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 57
Configure Passive Interface

Select next to the


interface connected to
the evaluation network

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 58
Configure Passive Interface

Set Interface to Passive Mode


Provide a name & Enable Interface
Define a new Security Zone
Click OK
Click Save

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 59
Configure Passive Interface
Click the Deploy button at top right to push interface configuration to FTD

Select the checkbox by your FTD device

Click Deploy

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 60
Deployment Status

View the status of deployment by clicking the green checkmark

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 61
Deployment Status
When the deployment completes, the interface status for the
passive interface should turn green.

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 62
Confirm Traffic Flow to FTD

Browse to Analysis > Connections > Events

If events are not populating, verify that interfaces are connected, enabled,
and the SPAN port or tap is functional.

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 63
Risk Reports
Risk Reports
Integrated into the FMC with 6.1 or later
Browse to Overview > Reporting
Select Report Templates
Generate Advanced Malware, Attacks, and Network Risk Reports

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 65
Risk Reports
Complete close-out meeting with
customer
Focus on Win Criteria and differentiating
value of Cisco Solution
Propose Bill of Materials
Submit Assessment for incentives
through SIRE www.cisco-sire.com
Review Cisco Funded Network
Assessment Post for more information
https://communities.cisco.com/docs/DOC-65405

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 66
Sanitize
Device Sanitization

After a successful POV


Purge customer data
Prepare for next POV

End dCloud session which will automatically delete the FMC VM and
any customer information
Erase and reformat the FTD File System

> erase /noconfirm disk0:

Reinstall FTD for the next customer engagement


Powering off FTD

FTD should not be powered off with a switch or by pulling a power cord. Disk corruption
can occur, and can cause problems with deploying policies or upgrades later.

Power off an FTD from FMC


Devices > Device Management
Select your device
Click Devices
Click the Red Stop symbol
in the System Menu

Power off an FTD from CLI


> shutdown

2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 69

Das könnte Ihnen auch gefallen