Book description
The authoritative visual guide to Cisco Firepower Threat Defense (FTD)
This is the definitive guide to best practices and advanced troubleshooting techniques for the Cisco flagship Firepower Threat Defense (FTD) system running on Cisco ASA platforms, Cisco Firepower security appliances, Firepower eXtensible Operating System (FXOS), and VMware virtual appliances.
Senior Cisco engineer Nazmul Rajib draws on unsurpassed experience supporting and training Cisco Firepower engineers worldwide, and presenting detailed knowledge of Cisco Firepower deployment, tuning, and troubleshooting. Writing for cybersecurity consultants, service providers, channel partners, and enterprise or government security professionals, he shows how to deploy the Cisco Firepower next-generation security technologies to protect your network from potential cyber threats, and how to use Firepower’s robust command-line tools to investigate a wide variety of technical issues.
Each consistently organized chapter contains definitions of keywords, operational flowcharts, architectural diagrams, best practices, configuration steps (with detailed screenshots), verification tools, troubleshooting techniques, and FAQs drawn directly from issues raised by Cisco customers at the Global Technical Assistance Center (TAC). Covering key Firepower materials on the CCNA Security, CCNP Security, and CCIE Security exams, this guide also includes end-of-chapter quizzes to help candidates prepare.
- Understand the operational architecture of the Cisco Firepower NGFW, NGIPS, and AMP technologies
- Deploy FTD on ASA platform and Firepower appliance running FXOS
- Configure and troubleshoot Firepower Management Center (FMC)
- Plan and deploy FMC and FTD on VMware virtual appliance
- Design and implement the Firepower management network on FMC and FTD
- Understand and apply Firepower licenses, and register FTD with FMC
- Deploy FTD in Routed, Transparent, Inline, Inline Tap, and Passive Modes
- Manage traffic flow with detect-only, block, trust, and bypass operations
- Implement rate limiting and analyze quality of service (QoS)
- Blacklist suspicious IP addresses via Security Intelligence
- Block DNS queries to the malicious domains
- Filter URLs based on category, risk, and reputation
- Discover a network and implement application visibility and control (AVC)
- Control file transfers and block malicious files using advanced malware protection (AMP)
- Halt cyber attacks using Snort-based intrusion rule
- Masquerade an internal host’s original IP address using Network Address Translation (NAT)
- Capture traffic and obtain troubleshooting files for advanced analysis
- Use command-line tools to identify status, trace packet flows, analyze logs, and debug messages
Table of contents
- Cover Page
- Title Page
- Copyright Page
- About the Author
- About the Technical Reviewer
- Dedication
- Acknowledgments
- Contents at a Glance
- Contents
- Reader Services
- Icons Used in This Book
- Command Syntax Conventions
- Introduction
-
Part I Troubleshooting and Administration of Hardware Platform
- Chapter 1 Introduction to the Cisco Firepower Technology
- Chapter 2 FTD on ASA 5500-X Series Hardware
- Chapter 3 FTD on the Firepower eXtensible Operating System (FXOS)
- Chapter 4 Firepower Management Center (FMC) Hardware
- Chapter 5 Firepower System Virtual on VMware
-
Part II Troubleshooting and Administration of Initial Deployment
- Chapter 6 The Firepower Management Network
- Chapter 7 Firepower Licensing and Registration
- Chapter 8 Firepower Deployment in Routed Mode
-
Chapter 9 Firepower Deployment in Transparent Mode
- Transparent Mode Essentials
- Best Practices for Transparent Mode
-
Configuring Transparent Mode
- Fulfilling Prerequisites
- Changing the Firewall Mode
- Deploying Transparent Mode in a Layer 2 Network
- Configuring the Physical and Virtual Interfaces
- Verifying the Interface Status
- Verifying Basic Connectivity and Operations
- Deploying an FTD Device Between Layer 3 Networks
- Selecting the Default Action
- Adding an Access Rule
- Creating an Access Rule for SSH
- Verifying Access Control Lists
- Summary
- Quiz
-
Part III Troubleshooting and Administration of Traffic Control
-
Chapter 10 Capturing Traffic for Advanced Analysis
- Traffic Capture Essentials
- Best Practices for Capturing Traffic
-
Configuring Firepower System for Traffic Analysis
- Capturing Traffic from a Firepower Engine
- tcpdump Options
- Downloading a .pcap File Generated by Firepower Engine
- Capturing Traffic from the Firewall Engine
- Downloading a .pcap File Generated by Firewall Engine
- Enabling HTTP Service in FTD
- Capturing Traffic from the FMC
- Downloading a .pcap File Generated by FMC
- Verification and Troubleshooting Tools
- Summary
- Quiz
-
Chapter 11 Blocking Traffic Using Inline Interface Mode
- Inline Mode Essentials
- Best Practices for Inline Mode Configuration
-
Configuring Inline Mode
- Fulfilling Prerequisites
- Creating an Inline Set
- Verifying the Configuration
- Verifying Packet Flow by Using packet-tracer
- Verifying Packet Flow by Using Real Packet Capture
- Enabling Fault Tolerance Features
- Configuring Fault Tolerance Features
- Verifying Fault Tolerance Features
- Blocking a Specific Port
- Configuring Blocking a Specific Port
- Verifying Blocking of a Specific Port
- Analyzing a Packet Drop by Using a Simulated Packet
- Analyzing a Packet Drop by Using a Real Packet
- Summary
- Quiz
- Chapter 12 Inspecting Traffic Without Blocking It
- Chapter 13 Handling Encapsulated Traffic
- Chapter 14 Bypassing Inspection and Trusting Traffic
- Chapter 15 Rate Limiting Traffic
-
Chapter 10 Capturing Traffic for Advanced Analysis
-
Part IV Troubleshooting and Administration of Next-Generation Security Features
-
Chapter 16 Blacklisting Suspicious Addresses by Using Security Intelligence
- Security Intelligence Essentials
- Best Practices for Blacklisting
- Fulfilling Prerequisites
-
Configuring Blacklisting
- Automatic Blacklist Using Cisco Intelligence Feed
- Manual Blacklisting Using a Custom Intelligence List
- Immediate Blacklisting Using a Connection Event
- Adding an Address to a Blacklist
- Deleting an Address from a Blacklist
- Monitoring a Blacklist
- Bypassing a Blacklist
- Adding an Address to a Whitelist
- Deleting an Address from a Whitelist
- Verification and Troubleshooting Tools
- Summary
- Quiz
- Chapter 17 Blocking a Domain Name System (DNS) Query
- Chapter 18 Filtering URLs Based on Category, Risk, and Reputation
- Chapter 19 Discovering Network Applications and Controlling Application Traffic
- Chapter 20 Controlling File Transfer and Blocking the Spread of Malware
-
Chapter 21 Preventing Cyber Attacks by Blocking Intrusion Attempts
- Firepower NGIPS Essentials
- Best Practices for Intrusion Policy Deployment
-
NGIPS Configuration
- Configuring a Network Analysis Policy
- Creating a New NAP with Default Settings
- Modifying the Default Settings of a NAP
- Configuring an Intrusion Policy
- Creating a Policy with a Default Ruleset
- Incorporating Firepower Recommendations
- Enabling or Disabling an Intrusion Rule
- Setting Up a Variable Set
- Configuring an Access Control Policy
- Verification and Troubleshooting Tools
- Summary
- Quiz
-
Chapter 22 Masquerading the Original IP Address of an Internal Network Host
- NAT Essentials
- Best Practices for NAT Deployment
- Fulfilling Prerequisites
-
Configuring NAT
- Masquerading a Source Address (Source NAT for Outbound Connection)
- Configuring a Dynamic NAT Rule
- Verifying the Configuration
- Verifying the Operation: Inside to Outside
- Verifying the Operation: Outside to Inside
- Connecting to a Masqueraded Destination (Destination NAT for Inbound Connection)
- Configuring a Static NAT Rule
- Verifying the Operation: Outside to DMZ
- Summary
- Quiz
-
Chapter 16 Blacklisting Suspicious Addresses by Using Security Intelligence
- Appendix A Answers to the Review Questions
- Appendix B Generating and Collecting Troubleshooting Files Using the GUI
- Appendix C Generating and Collecting Troubleshooting Files Using the CLI
- Index
Product information
- Title: Cisco Firepower Threat Defense (FTD)
- Author(s):
- Release date: December 2017
- Publisher(s): Cisco Press
- ISBN: 9780134679471
You might also like
book
Cisco Next-Generation Security Solutions: All-in-one Cisco ASA Firepower Services, NGIPS, and AMP
Network threats are emerging and changing faster than ever before. Cisco Next-Generation Network Security technologies give …
book
Cisco Certified Design Expert (CCDE 400-007) Official Cert Guide
Marwan Alshawi's best-selling Cisco Press book, the CCDE Study Guide, served as the inspiration and content …
video
CCNP Security Cisco Identify Services Engine SISE 300-715
8+ Hours of Video Instruction CCNP Security Management (SISE) 300-715 Complete Video Course focuses on implementing …
video
Understanding the Cisco ASA Firewall
This is a best practices course on how to set-up, manage, and troubleshoot firewalls and VPNs …