Understand Firepower Models, Managers, and Log in Commands

Introduction

This document describes different types of Firepower models and managers, and how to access them using Command Line Interface (CLI).

Prerequisites

Requirements

Cisco recommends that you must have knowledge of these topics:

• Firepower, Firepower Threat Defense (FTD) and Firepower Management Center (FMC)
• Difference between Firepower and Firepower Threat Defense (FTD)

Abbreviations

• Next Generation Intrusion Prevention System (NGIPS)

• Next Generation Firewall (NGFW)

• Firepower Threat Defense (FTD)

• Firepower Extensible Operating System (FXOS)

• Firepower Chassis Manager (FCM)

• Adaptive Security Device Manager (ASDM)

• Firepower Device Manager (FDM)

• Defense Center (DC)

• Firepower Management Center (FMC)

Terminology and Types

Device Terminology and Types

Sourcefire/ Firepower/ SFR/ NGIPS/ Sensors/ FTD/ NGFW

Managers Terminology and Types

ASDM/ FDM/ FCM/ DC/ Firesight/ FMC/ FMCv

Managers are used to manage devices.

Adaptive Security Device Manager (ASDM) and Firepower Device Manager (FDM) are local management Graphical User Based (GUI) based option in the device.

Firepower Management Center (FMC) is a separate management GUI based tool.

At a time, one manager can be used to manage the device.

For example : If you want to manage Firepower services (SFR) so either you can use Adaptive Security Device Manager (ASDM) or Firepower Management Center (FMC).

                     : If you want to manage Firepower Threat Defense (FTD) so either you can use Firepower Device Manager (FDM) or Firepower Management Center (FMC).

Detailed Information

1. Firepower

1. ASA Firepower Services (SFR)

Firepower installed as software on ASA except in one model ASA 5585. In ASA 5585, hardware module is inserted to get firepower services.

In ASA 5500-X series, Firepower services (SFR) software services installed on Solid State Drive (SSD) and ASA 5585 has hardware firepower module.

2. Sensor/NGIPS (7000 and 8000 Series and Virtual)

7000 and 8000 series are hardware firepower devices.

Virtual Firepower installed on supported virtual platform. (For supported platform details, refer to release notes.)

3. FTD/NGFW (ASA 5500-x Series, 1000 Series, 2100 Series, 3100 Series, 4100 Series, 9300 Series and Virtual)

Mentioned Firepower series are hardware Firepower Threat Defense (FTD) devices.

Virtual Firepower Threat Defense is installed on supported virtual platform. (For supported platform details, refer to release notes.)

In Firepower Threat Defense, ASA and Firepower features are merged in one unified image represented as lina engine and snort engine.

CLI is available, but no configure terminal mode (config t).

Firepower Extensible Operating System (FXOS) is an operating system on the supervisor. 

The Firepower Chassis Manager (FCM) is used to manage FXOS.

FXOS and FTD are 2 separate software OS images on FPR4100 and 9300, while FPR1000, FPR2100 and FPR3100 are a unified OS bundle of FTD and FXOS.

On these hardware series, you can either install ASA and completely covert into ASA, or you can install FTD and take leverage of both features in one image.

Note: On 1000 series, 2100 series and 3100 series, when you are running FTD then you cannot manage the FXOS using FCM. On 1000 series, 2100 series and 3100 series, when you are running ASA, then FCM is available and you can manage the FXOS using FCM only if ASA version is less than 9.13.

2. Firepower Management Center 

FMC is a separate manager to use to manage the multiple devices.

FMC is available as hardware as well as virtual.

Hardware FMC: FMC 1000, FMC 1600, FMC 2500, FMC 2600, FMC 4500 and FMC 4600 

Virtual FMC: FMCv(2/10/25) and FMCv300 (For supported platform details, refer to release notes.)

Note: Number 2/10/25/300 represents maximum number of devices can be managed by FMC. For example: FMCv300 means it can manage 300 devices.

Fresh Installation or Reimage Files: Restore.iso required for Hardware FMC.

Connect to Firepower, FTD, FXOS, and FMC CLI

There are 3 user privilege modes in CLI, named below:

Clish  >

Expert $

Root #

1. SFR CLI

There are two ways:

• You can directly SSH to SFR IP to gain the CLI access.

• Using ASA CLI, you can access SFR console.

Example: ASA 5508 SFR

2. Firepower 7000 and 8000 Series and FMC CLI

• You can directly SSH to device IP to gain the CLI access.

Example: SSH into 7110 Firepower

Example: SSH into FMCv 

3. FTD CLI

• You can directly SSH to device IP to gain the CLI access.

Example: SSH into FTDv

4. FXOS CLI

Example: FPR 4120 running FTD

Continue....