- Introduction to the Cisco ASA FirePOWER Module
- Managing Reusable Objects
- Managing Device Configuration
- Getting Started with Access Control Policies
- Blacklisting Using Security Intelligence IP Address Reputation
- Tuning Traffic Flow Using Access Control Rules
- Controlling Traffic with Network-Based Rules
- Controlling Traffic with Reputation-Based Rules
- Access Control Rules: Realms and Users
- Access Control Rules: Custom Security Group Tags
- Controlling Traffic Using Intrusion and File Policies
- Intelligent Application Bypass
- Access Control Using Content Restriction
- Understanding Traffic Decryption
- Getting Started with SSL Policies
- Getting Started with SSL Rules
- Tuning Traffic Decryption Using SSL Rules
- Understanding Network Analysis and Intrusion Policies
- Using Layers in a Network Analysis or Intrusion Policy
- Customizing Traffic Preprocessing
- Getting Started with Network Analysis Policies
- Using Application Layer Preprocessors
- Configuring SCADA Preprocessing
- Configuring Transport & Network Layer Preprocessing
- Access Control Policies: Adaptive Profiles
- Getting Started with Intrusion Policies
- Tuning Intrusion Policies Using Rules
- Detecting Specific Threats
- Globally Limiting Intrusion Event Logging
- Understanding and Writing Intrusion Rules
- Introduction to Identity Data
- Realms and Identity Policies
- User Identity Sources
- DNS Policies
- Blocking Malware and Prohibited Files
- Logging Connections in Network Traffic
- Viewing Events
- Configuring External Alerting
- Configuring External Alerting for Intrusion Rules
- Using the ASA FirePOWER Dashboard
- Using ASA FirePOWER Reporting
- Scheduling Tasks
- Managing System Policies
- Configuring ASA FirePOWER Module Settings
- Licensing the ASA FirePOWER Module
- Updating ASA FirePOWER Module Software
- Monitoring the System
- Using Backup and Restore
- Generating Troubleshooting Files
- Importing and Exporting Configurations
- Viewing the Status of Long-Running Tasks
- Security, Internet Access, and Communication Ports
- Understanding Update Types
- Performing Software Updates
- Uninstalling Software Updates
- Updating the Vulnerability Database
- Importing Rule Updates and Local Rule Files
Updating ASA FirePOWER Module Software
Cisco electronically distributes several different types of updates, including major and minor updates to the ASA FirePOWER module software itself, as well as rule updates, geolocation database (GeoDB) updates, and Vulnerability Database (VDB) updates.
Caution This section contains general information on updating the ASA FirePOWER module. Before you update, including the VDB, GeoDB, or intrusion rules, you must read the release notes or advisory text that accompanies the update. The release notes provide important information, including prerequisites, warnings, and specific installation and uninstallation instructions.
Unless otherwise documented in the release notes or advisory text, updating does not modify configurations; the settings remain intact.
Understanding Update Types
Cisco electronically distributes several different types of updates, including major and minor updates to the ASA FirePOWER module software itself, as well as intrusion rule updates and VDB updates.
The following table describes the types of updates provided by Cisco. For most update types, you can schedule their download and installation; see Scheduling Tasks and Using Recurring Rule Updates.
Note that while you can uninstall patches and other minor updates, you cannot uninstall major updates or return to previous versions of the VDB, GeoDB, or intrusion rules. If you updated to a new major version and you need to revert to an older version, contact Support.
Performing Software Updates
There are a few basic steps to updating. First, you must prepare for the update by reading the release notes and completing any required pre-update tasks. Then, you can begin the update. You must verify the update’s success. Finally, complete any required post-update steps.
For more information, see the following sections:
- Planning for the Update
- Understanding the Update Process
- Updating the ASA FirePOWER Module Software
- Monitoring the Status of Major Updates
Planning for the Update
Before you begin the update, you must thoroughly read and understand the release notes, which you can download from the Support Site. The release notes describe new features and functionality, and known and resolved issues. The release notes also contain important information on prerequisites, warnings, and specific installation and uninstallation instructions.
The following sections provide an overview of some of the factors you must consider when planning for the update.
You must make sure you are running the correct software version. The release notes indicate the required version. If you are running an earlier version, you can obtain updates from the Support Site.
Time and Disk Space Requirements
Make sure you have enough free disk space and allow enough time for the update. The release notes indicate space and time requirements.
Configuration Backup Guidelines
Before you begin a major update, Cisco recommends that you delete any backups that reside on the ASA FirePOWER module after copying them to an external location. Regardless of the update type, you should also back up current configuration data to an external location. See Using Backup and Restore.
Because the update process may affect traffic inspection and traffic flow, and because the Data Correlator is disabled while an update is in progress, Cisco recommends you perform the update in a maintenance window or at a time when the interruption will have the least impact.
Understanding the Update Process
You use the ASA FirePOWER module interface to update the ASA FirePOWER module.
The Product Updates page ( Configuration > ASA FirePOWER Configuration > Updates ) shows the version of each update, as well as the date and time it was generated. It also indicates whether a software reboot is required as part of the update. When you upload updates obtained from Support, they appear on the page. Uninstallers for patch and feature updates also appear; see Uninstalling Software Updates. The page can also list VDB updates.
Tip For patches and feature updates, you can take advantage of the automated update feature; see Automating Software Updates.
When you install or uninstall updates, the following capabilities may be affected:
- traffic inspection, including application and user awareness and control, URL filtering, Security Intelligence filtering, intrusion detection and prevention, and connection logging
- traffic flow
The Data Correlator does not run during system updates. It resumes when the update is complete.
The manner and duration of network traffic interruption depends on how yourASA FirePOWER module is configured and deployed, and whether the update reboots the ASA FirePOWER module. For specific information on how and when network traffic is affected for a particular update, see the release notes.
Using the ASA FirePOWER Module During the Update
Regardless of the type of update, do not use the ASA FirePOWER module to perform tasks other than monitoring the update.
To prevent you from using the ASA FirePOWER module during a major update, and to allow you to easily monitor a major update’s progress, the system streamlines the ASA FirePOWER module interface. You can monitor a minor update's progress in the task queue ( Monitoring > ASA FirePOWER Monitoring > Task Status ). Although you are not prohibited from using the ASA FirePOWER module during a minor update, Cisco recommends against it.
Even for minor updates, the ASA FirePOWER module may become unavailable during the update process. This is expected behavior. If this occurs, wait until you can again access the ASA FirePOWER module. If the update is still running, you must continue to refrain from using the ASA FirePOWER module until the update has completed. Note that while updating, the ASA FirePOWER module may reboot a second time; this is also expected behavior.
Caution If you encounter issues with the update (for example, if the update has failed or if a manual refresh of the Update Status page shows no progress), do not restart the update. Instead, contact Support.
You must complete all of the post-update tasks listed in the release notes to ensure that your deployment is performing properly.
The most important post-update task is to reapply access control policies. Note that applying an access control policy may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected; see Deploying Configuration Changes.
Updating the ASA FirePOWER Module Software
Update the ASA FirePOWER module software in one of two ways, depending on the type of update and whether your ASA FirePOWER module has access to the Internet:
- You can obtain the update directly from the Support Site if your ASA FirePOWER module has access to the Internet. This option is not supported for major updates.
- You can manually download the update from the Support Site and then upload it to the ASA FirePOWER module. Choose this option if your ASA FirePOWER module does not have access to the Internet or if you are performing a major update.
For major updates, updating the ASA FirePOWER module removes uninstallers for previous updates.
To update the ASA FirePOWER Module Software:
Step 1 Read the release notes and complete any required pre-update tasks.
Pre-update tasks may include making sure that: the ASA FirePOWER module is running the correct version of the Cisco software, you have enough free disk space to perform the update, you set aside adequate time to perform the update, you backed up configuration data, and so on.
Step 2 Upload the update. You have two options, depending on the type of update and whether your ASA FirePOWER module has access to the Internet:
– Sourcefire: (https://support.sourcefire.com/)
– Cisco: (http://www.cisco.com/cisco/web/support/index.html)
– Sourcefire: (https://support.sourcefire.com/)
– Cisco: (http://www.cisco.com/cisco/web/support/index.html)
Note Download the update directly from the Support Site, either manually or by clicking Download Updates on the Product Updates tab. If you transfer an update file by email, it may become corrupted.
Step 3 Select Monitoring > ASA FirePOWER Monitoring > Task Status to view the task queue and make sure that there are no jobs in process.
Tasks that are running when the update begins are stopped and cannot be resumed; you must manually delete them from the task queue after the update completes. The task queue automatically refreshes every 10 seconds. You must wait until any long-running tasks are complete before you begin the update.
Step 4 Select Configuration > ASA FirePOWER Configuration > Updates .
The Product Updates page appears.
Step 5 Click the install icon next to the update you uploaded.
The update process begins. How you monitor the update depends on whether the update is a major or minor update. See the ASA FirePOWER Module Update Types table and the release notes to determine your update type:
- For minor updates, you can monitor the update's progress in the task queue ( Monitoring > ASA FirePOWER Monitoring > Task Status ).
- For major updates, you can begin monitoring the update’s progress in the task queue. However, after the ASA FirePOWER module completes its necessary pre-update checks, you are locked out of the module interface. When you regain access, the Upgrade Status page appears. See Monitoring the Status of Major Updates for information.
Caution Regardless of the update type, do not use the ASA FirePOWER module to perform tasks other than monitoring the update until the update has completed and, if necessary, the ASA FirePOWER module reboots. For more information, see Using the ASA FirePOWER Module During the Update.
Step 6 After the update finishes, access the ASA FirePOWER module interface and refresh the page. Otherwise, the interface may exhibit unexpected behavior. If you are the first user to access the interface after a major update, the End User License Agreement (EULA) may appear. You must review and accept the EULA to continue.
Step 7 If the rule update available on the Support Site is newer than the rules on your ASA FirePOWER module, import the newer rules.
For more information, see Importing Rule Updates and Local Rule Files.
Step 8 Reapply access control policies.
Applying an access control policy may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see Deploying Configuration Changes.
Step 9 If the VDB available on the Support Site is newer than the most recently installed VDB, install the latest VDB.
Installing a VDB update causes a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see Updating the Vulnerability Database.
Monitoring the Status of Major Updates
For major updates, the ASA FirePOWER module provides you with a streamlined interface so that you can easily monitor the update process. The streamlined interface also prevents you from using the ASA FirePOWER module to perform tasks other than monitoring the update.You can begin monitoring the update’s progress in the task queue ( Monitoring > ASA FirePOWER Monitoring > Task Status ). However, after the ASA FirePOWER module completes its necessary pre-update checks, you are locked out of the user interface until a streamlined update page appears.
The streamlined interface displays the version you are updating from, the version you are updating to, and the time that has elapsed since the update began. It also displays a progress bar and gives details about the script currently running.
Tip Click show log for current script to see the update log. Click hide log for current script to hide the log again.
If the update fails for any reason, the page displays an error message indicating the time and date of the failure, which script was running when the update failed, and instructions on how to contact Support. Do not restart the update.
Caution If you encounter any other issue with the update (for example, if a manual refresh of the page shows no progress for an extended period of time), do not restart the update. Instead, contact Support.
When the update completes, the ASA FirePOWER module displays a success message and reboots. After the ASA FirePOWER module finishes rebooting, complete any required post-update steps.
Uninstalling Software Updates
When you apply a patch or feature update, the update process creates an uninstaller that allows you to remove the update.
When you uninstall an update, the resulting Cisco software version depends on the update path. For example, consider a scenario where you updated directly from Version 5.0 to Version 5.0.0.2. Uninstalling the Version 5.0.0.2 patch might result in Version 5.0.0.1, even though you never installed the Version 5.0.0.1 update. For information on the resulting Cisco software version when you uninstall an update, see the release notes.
Note Uninstalling is not supported for major updates. If you updated to a new major version and you need to revert to an older version, contact Support.
Uninstalling an update may affect traffic inspection and traffic flow. For specific information on how and when network traffic is affected for a particular update, see the release notes.
After you uninstall the update, verify that the uninstall succeeded. For specific information for each update, see the release notes.
To uninstall a patch or feature update:
Step 1 Select Configuration > ASA FirePOWER Configuration > Updates .
The Product Updates page appears.
Step 2 Click the install icon next to the uninstaller for the update you want to remove.
If prompted, confirm that you want to uninstall the update and reboot the ASA FirePOWER module.
The uninstall process begins. You can monitor its progress in the task queue ( Monitoring > ASA FirePOWER Monitoring > Task Status ).
Caution Do not use the ASA FirePOWER module interface to perform tasks until the uninstall has completed and, if necessary, the ASA FirePOWER module reboots. For more information, see Using the ASA FirePOWER Module During the Update.
Step 3 Refresh the page. Otherwise, the interface may exhibit unexpected behavior.
Updating the Vulnerability Database
The Cisco Vulnerability Database (VDB) is a database of known vulnerabilities to which hosts may be susceptible. The Cisco Vulnerability Research Team (VRT) issues periodic updates to the VDB. To update the VDB, use the Product Updates page.
Note Installing a VDB update with detection updates may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected.You may want to schedule the update during low system usage times to minimize the impact of any system downtime.
Note After you complete a VDB update, reapply any out-of-date access control policy. Keep in mind that installing a VDB or reapplying an access control policy can cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see Deploying Configuration Changes.
This section explains how to plan for and perform manual VDB updates.
To update the vulnerability database:
Step 1 Read the VDB Update Advisory Text for the update.
The advisory text includes information about the changes to the VDB made in the update.
Step 2 Select Configuration > ASA FirePOWER Configuration > Updates .
The Product Updates page appears.
– Sourcefire: (https://support.sourcefire.com/)
– Cisco: (http://www.cisco.com/cisco/web/support/index.html)
– Sourcefire: (https://support.sourcefire.com/)
– Cisco: (http://www.cisco.com/cisco/web/support/index.html)
Note Download the update directly from the Support Site either manually or by clicking Download Updates. If you transfer an update file by email, it may become corrupted.
Step 4 Click the install icon next to the VDB update.
The Install Update page appears.
The update process begins. You can monitor the update's progress in the task queue ( Monitoring > ASA FirePOWER Monitoring > Task Status ).
Caution If you encounter issues with the update (for example, if the task queue indicates that the update has failed) do not restart the update. Instead, contact Support.
You must reapply any out-of-date access control policies for the VDB update to take effect; see Deploying Configuration Changes.
Importing Rule Updates and Local Rule Files
As new vulnerabilities become known, the Cisco Vulnerability Research Team (VRT) releases rule updates that you can first import onto your ASA FirePOWER module, then implement by applying affected access control, network analysis, and intrusion policies.
Rule updates are cumulative, and Cisco recommends you always import the latest update. You cannot import a rule update that either matches or predates the version of the currently installed rules.
Note Rule updates may contain new binaries, so make sure your process for downloading and installing them complies with your security policies. In addition, rule updates may be large, so import rules during periods of low network use.
A rule update may provide the following:
- new and modified rules and rule states —Rule updates provide new and updated intrusion and preprocessor rules. For new rules, the rule state may be different in each system-provided intrusion policy. For example, a new rule may be enabled in the Security over Connectivity intrusion policy and disabled in the Connectivity over Security intrusion policy. Rule updates may also change the default state of existing rules, or delete existing rules entirely.
- new rule categories —Rule updates may include new rule categories, which are always added.
- modified preprocessor and advanced settings —Rule updates may change the advanced settings in the system-provided intrusion policies and the preprocessor settings in system-provided network analysis policies. They can also update default values for the advanced preprocessing and performance options in your access control policies.
- new and modified variables —Rule updates may modify default values for existing default variables, but do not override your changes. New variables are always added.
Understanding When Rule Updates Modify Policies
Rule updates can affect both system-provided and custom network analysis policies, as well as all access control policies:
- system provided —Changes to system-provided network analysis and intrusion policies, as well as any changes to advanced access control settings, automatically take effect when you reapply the policies after the update.
- custom —Because every custom network analysis and intrusion policy uses a system-provided policy as its base, or as the eventual base in a policy chain, rule updates can affect custom network analysis and intrusion policies. However, you can prevent rule updates from automatically making those changes. This allows you to update system-provided base policies manually, on a schedule independent of rule update imports. Regardless of your choice (implemented on a per-custom-policy basis), updates to system-provided policies do not override any settings you customized. For more information, see Allowing Rule Updates to Modify a System-Provided Base Policy.
Note that importing a rule update discards all cached changes to network analysis and intrusion policies. For your convenience, the Rule Updates page lists policies with cached changes. For more information, see Resolving Conflicts and Committing Policy Changes.
For changes made by a rule update to take affect, you must reapply any modified policies. When importing a rule update, you can configure the system to automatically reapply intrusion or access control policies. This is especially useful if you allow the rule update to modify system-provided base policies.
- Reapplying an access control policy also reapplies associated SSL, network analysis, and file policies, but does not reapply intrusion policies. It also updates the default values for any modified advanced settings. Because you cannot apply a network analysis policy independently, you must reapply access control policies if you want to update preprocessor settings in network analysis policies.
- Reapplying intrusion policies allows you to update rules and other changed intrusion policy settings. You can reapply intrusion policies in conjunction with access control policies, or you can apply only intrusion policies to update intrusion rules without updating any other access control configurations.
When a rule update includes shared object rules, applying an access control or intrusion policy for the first time after the import causes a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information on applying access control and intrusion policies, including requirements, other effects, and recommendations, see Deploying Configuration Changes.
For more information on importing rule updates, see:
- Using One-Time Rule Updates explains how to import a single rule update from the Support Site.
- Using Recurring Rule Updates explains how to use an automated feature to download and install rule updates from the Support Site.
- Importing Local Rule Files explains how to import a copy of a standard text rules file that you have created on a local machine.
- Viewing the Rule Update Log explains the rule update log.
Using One-Time Rule Updates
There are two methods that you can use for one-time rule updates:
- Using Manual One-Time Rule Updates explains how to manually download a rule update from the Support Site and then manually install the rule update.
- Using Automatic One-Time Rule Updates explains how to use an automated feature to search the Support Site for new rule updates and upload them.
Using Manual One-Time Rule Updates
The following procedure explains how to import a new rule update manually. This procedure is especially useful if your ASA FirePOWER module does not have Internet access.
To manually import a rule update:
Step 1 From a computer that can access the Internet, access either of the following sites:
- Sourcefire: (https://support.sourcefire.com/)
- Cisco: (http://www.cisco.com/cisco/web/support/index.html)
Step 2 Click Download , then click Rules .
Step 3 Navigate to the latest rule update.
Rule updates are cumulative; you cannot import a rule update that either matches or predates the version of the currently installed rules.
Step 4 Click the rule update file that you want to download and save it to your computer.
Step 5 Select Configuration > ASA FirePOWER Configuration > Updates , then select the Rule Updates tab.
The Rule Updates page appears.
Tip You can also click Import Rules on the Rule Editor page (Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Rule Editor).
Step 6 Optionally, click Delete All Local Rules , then click OK to move all user-defined rules that you have created or imported to the deleted folder. See Deleting Custom Rules for more information.
Step 7 Select Rule Update or text rule file to upload and install and click Choose File to navigate to and select the rule update file.
Step 8 Optionally, reapply policies after the update completes:
- Select Reapply intrusion policies after the rule update import completes to automatically reapply intrusion policies. Choose only this option to update rules and other changed intrusion policy settings without having to update any other access control configurations you may have made. You must select this option to reapply intrusion policies in conjunction with access control policies; reapplying access control policies in this case does not perform a complete apply.
- Select Reapply access control policies after the rule update import completes to automatically reapply access control policies and their associated SSL, network analysis, and file policies, but not intrusion policies. Selecting this option also updates the default values for any modified access control advanced settings. Because you cannot apply a network analysis policy independently of its parent access control policy, you must reapply access control policies if you want to update preprocessor settings in network analysis policies.
The system installs the rule update and displays the Rule Update Log detailed view; see Understanding the Rule Update Import Log Detailed View. The system also applies policies as you specified in the previous step; see Deploying Configuration Changes and Applying an Intrusion Policy.
Note Contact Support if you receive an error message while installing the rule update.
Using Automatic One-Time Rule Updates
The following procedure explains how to import a new rule update by automatically connecting to the Support Site. You can use this procedure only if the ASA FirePOWER module has Internet access.
To automatically import a rule update:
Step 1 Select Configuration > ASA FirePOWER Configuration > Updates , then select the Rule Updates tab.
The Rule Updates page appears.
Tip You can also click Import Rules on the Rule Editor page (Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Rule Editor).
Step 2 Optionally, click Delete All Local Rules , then click OK to move all user-defined rules that you have created or imported to the deleted folder. See Deleting Custom Rules for more information.
Step 3 Select Download new Rule Update from the Support Site .
Step 4 Optionally, reapply policies after the update completes:
- Select Reapply intrusion policies after the rule update import completes to automatically reapply intrusion policies. Choose only this option to update rules and other changed intrusion policy settings without having to update any other access control configurations you may have made. You must select this option to reapply intrusion policies in conjunction with access control policies; reapplying access control policies in this case does not perform a complete apply.
- Select Reapply access control policies after the rule update import completes to automatically reapply access control, network analysis, and file policies, but not intrusion policies. Selecting this option also updates the default values for any modified access control advanced settings. Because you cannot apply a network analysis policy independently of its parent access control policy, you must reapply access control policies if you want to update preprocessor settings in network analysis policies.
The system installs the rule update and displays the Rule Update Log detailed view; see Understanding the Rule Update Import Log Detailed View. The system also applies policies as you specified in the previous step; see Deploying Configuration Changes and Applying an Intrusion Policy.
Note Contact Support if you receive an error message while installing the rule update.
Using Recurring Rule Updates
You can import rule updates on a daily, weekly, or monthly basis, using the Rule Updates page.
Applicable subtasks in the rule update import occur in the following order: download, install, base policy update, and policy reapply. When one subtask completes, the next subtask begins. Note that you can only apply policies previously applied by the ASA FirePOWER module where the recurring import is configured.
To schedule recurring rule updates:
Step 1 Select Configuration > ASA FirePOWER Configuration > Updates , then select the Rule Updates tab.
The Rule Updates page appears.
Tip You can also click Import Rules on the Rule Editor page (Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Rule Editor).
Step 2 Optionally, click Delete All Local Rules , then click OK to move all user-defined rules that you have created or imported to the deleted folder. See Deleting Custom Rules for more information.
Step 3 Select Enable Recurring Rule Update Imports .
The page expands to display options for configuring recurring imports. Import status messages appear beneath the Recurring Rule Update Imports section heading. Recurring imports are enabled when you save your settings.
Tip To disable recurring imports, clear the Enable Recurring Rule Update Imports check box and click Save.
Step 4 In the Import Frequency field, select Daily , Weekly , or Monthly from the drop-down list.
If you selected a weekly or monthly import frequency, use the drop-down lists that appear to select the day of the week or month when you want to import rule updates. Select from a recurring task drop-down list either by clicking or by typing the first letter or number of your selection one or more times and pressing Enter.
Step 5 In the Import Frequency field, specify the time when you want to start your recurring rule update import.
Step 6 Optionally, reapply policies after the update completes:
- Select Reapply intrusion policies after the rule update import completes to automatically reapply intrusion policies. Choose only this option to update rules and other changed intrusion policy settings without having to update any other access control configurations you may have made. You must select this option to reapply intrusion policies in conjunction with access control policies; reapplying access control policies in this case does not perform a complete apply.
- Select Reapply access control policies after the rule update import completes to automatically reapply access control policies and their associated SSL, network analysis, and file policies, but not intrusion policies. Selecting this option also updates the default values for any modified access control advanced settings. Because you cannot apply a network analysis policy independently of its parent access control policy, you must reapply access control policies if you want to update preprocessor settings in network analysis policies.
Step 7 Click Save to enable recurring rule update imports using your settings.
The status message under the Recurring Rule Update Imports section heading changes to indicate that the rule update has not yet run. At the scheduled time, the system installs the rule update and applies policies as you specified in the previous step; see Deploying Configuration Changes and Applying an Intrusion Policy.
You can log off or perform other tasks before or during the import. When accessed during an import, the Rule Update Log displays a red status icon (
), and you can view messages as they occur in the Rule Update Log detailed view. Depending on the rule update size and content, several minutes may pass before status messages appear. For more information, see Viewing the Rule Update Log.
Note Contact Support if you receive an error message while installing the rule update.
Importing Local Rule Files
A local rule is a custom standard text rule that you import from a local machine as a plain text file with ASCII or UTF-8 encoding. You can create local rules using the instructions in the Snort users manual, which is available at http://www.snort.org.
Note the following regarding importing local rules:
-
The text file name can include alphanumeric characters, spaces, and no special characters other than underscore (
_), period (.), and dash (-). - You do not have to specify a Generator ID (GID); if you do, you can specify only GID 1 for a standard text rule or 138 for a sensitive data rule.
- Do not specify a Snort ID (SID) or revision number when importing a rule for the first time; this avoids collisions with SIDs of other rules, including deleted rules.
The system will automatically assign the rule the next available custom rule SID of 1000000 or greater, and a revision number of 1.
- You must include the SID assigned by the system and a revision number greater than the current revision number when importing an updated version of a local rule that you have previously imported.
To view the revision number for a current local rule, display the Rule Editor page ( Policies > Intrusion Policy > Rule Editor ), click on the local rule category to expand the folder, then click Edit next to the rule.
- You can reinstate a local rule that you have deleted by importing the rule using the SID assigned by the system and a revision number greater than the current revision number. Note that the system automatically increments the revision number when you delete a local rule; this is a device that allows you to reinstate local rules.
To view the revision number for a deleted local rule, display the Rule Editor page ( Policies > Intrusion Policy > Rule Editor ), click on the deleted rule category to expand the folder, then click Edit next to the rule.
- You cannot import a rule file that includes a rule with a SID greater than 2147483647; the import will fail.
- If you import a rule that includes a list of source or destination ports that is longer than 64 characters, the import will fail.
- The system always sets local rules that you import to the disabled rule state; you must manually set the state of local rules before you can use them in your intrusion policy. See Setting Rule States for more information.
- You must make sure that the rules in the file do not contain any escape characters.
- The rules importer requires that all custom rules are imported in ASCII or UTF-8 encoding.
- All imported local rules are automatically saved in the local rule category.
- All deleted local rules are moved from the local rule category to the deleted rule category.
- The system imports local rules preceded with a single pound character (#).
- The system ignores local rules preceded with two pound characters (##) and does not import them.
-
Policy validation fails if you enable an imported local rule that uses the deprecated
thresholdkeyword in combination with the intrusion event thresholding feature in an intrusion policy. See Configuring Event Thresholding for more information.
Step 1 Select Policies > Intrusion Policy > Rule Editor .
The Import Rules page appears.
Tip You can also select System > Updates, then select the Rule Updates tab.
Step 3 Select Rule Update or text rule file to upload and install and click Choose File to navigate to the rule file. Note that all rules uploaded in this manner are saved in the local rule category.
Tip You can import only plain text files with ASCII or UTF-8 encoding.
The rule file is imported. Make sure you enable the appropriate rules in your intrusion policies. The rules are not activated until the next time you apply the affected policies.
Note The system does not use the new rule set for inspection until after you apply your intrusion policies. See Deploying Configuration Changes for procedures.
Viewing the Rule Update Log
The ASA FirePOWER module generates a record for each rule update and local rule file that you import.
Each record includes a time stamp, the name of the user who imported the file, and a status icon indicating whether the import succeeded or failed. You can maintain a list of all rule updates and local rule files that you import, delete any record from the list, and access detailed records for all imported rules and rule update components. Actions you can take in the Rule Update Log are described in the following table.
find more information in Understanding the Rule Update Log Table. |
|
delete an import file record from the import log, including detailed records for all objects included with the file |
click the delete icon ( Note Deleting the file from the log does not delete any object imported in the import file, but only deletes the import log records. |
view details for each object imported in a rule update or local rule file |
click the view icon ( |
See the following sections for more information:
- Understanding the Rule Update Log Table describes the fields in the list of rule updates and local rule files that you import.
- Viewing Rule Update Import Log Details describes the detailed record for each object imported in a rule update or local rule file.
- Understanding the Rule Update Import Log Detailed View describes each field in the Rule Update Log detailed view.
Step 1 Select Configuration > ASA FirePOWER Configuration > Updates , then select the Rule Updates tab.
The Rule Updates page appears.
Tip You can also click Import Rules on the Rule Editor page (Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Rule Editor).
Step 2 Click Rule Update Log .
The Rule Update Log page appears. This page lists each imported rule update and local rule file.
Understanding the Rule Update Log Table
The fields in the list of rule updates and local rule files that you import are described in the following table.
The name of the import file. If the import fails, a brief statement of the reason for the failure appears under the file name. |
|
) 
)
Click the view icon (
) next to the rule update or file name to view the Rule Update Log detailed page for the rule update or local rule file, or click the delete icon (
) to delete the file record and all detailed object records imported with the file.
Tip You can view import details as they appear while a rule update import is in progress.
Viewing Rule Update Import Log Details
The Rule Update Import Log detailed view lists a detailed record for each object imported in a rule update or local rule file. You can also create a custom workflow or report from the records listed that includes only the information that matches your specific needs.
The following table describes specific actions you can perform on a Rule Update Import Log detailed view.
find more information in Understanding the Rule Update Import Log Detailed View. |
To view the Rule Update Import Log Detailed View:
Step 1 Select Configuration > ASA FirePOWER Configuration > Updates , then select the Rule Updates tab.
The Rule Updates page appears.
Tip You can also click Import Rules on the Rule Editor page (Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Rule Editor).
Step 2 Click Rule Update Log .
The Rule Update Log page appears.
Step 3 Click the view icon (
) next to the file whose detailed records you want to view.
The table view of detailed records appears.
Understanding the Rule Update Import Log Detailed View
You can view a detailed record for each object imported in a rule update or local rule file. The fields in the Rule Update Log detailed view are described in the following table.
Updating the Geolocation Database
The Cisco Geolocation Database (GeoDB) is a database of geographical data associated with routable IP addresses. The ASA FirePOWER module provides the country and continent. When your system detects GeoDB information that matches a detected IP address, you can view the geolocation information associated with that IP address. Cisco issues periodic updates to the GeoDB.
To update the GeoDB, use the Geolocation Updates page ( Configuration > ASA FirePOWER Configuration > Updates > Geolocation Updates ). When you upload GeoDB updates, they appear on this page.
The installation usually takes 30 to 40 minutes. Although a GeoDB update does not interrupt any other system functions (including the ongoing collection of geolocation information), the update does consume system resources while it completes. Consider this when planning your updates.
This section explains how to plan for and perform manual GeoDB updates. You can also take advantage of the automated update feature to schedule GeoDB updates; for more information, see Automating Geolocation Database Updates.
To update the geolocation database:
Step 1 Select Configuration > ASA FirePOWER Configuration > Updates .
The Product Updates page appears.
Step 2 Click the Geolocation Updates tab.
The Geolocation Updates page appears.
– Sourcefire: (https://support.sourcefire.com/)
– Cisco: (http://www.cisco.com/cisco/web/support/index.html)
– Sourcefire: (https://support.sourcefire.com/)
– Cisco: (http://www.cisco.com/cisco/web/support/index.html)
Note Download the update directly from the Support Site, either manually or by clicking Download and install geolocation update from the Support Site on the Geolocation Updates page. If you transfer an update file by email, it may become corrupted.
The update process begins. The average duration of update installation is 30 to 40 minutes. You can monitor the update’s progress in the task queue ( Monitoring > ASA FirePOWER Monitoring > Task Status ).
Step 4 After the update finishes, return to the Geolocation Updates page to confirm that the GeoDB build number matches the update you installed.
The GeoDB update overrides any previous versions of the GeoDB and is effective immediately. Although it may take a few minutes for a GeoDB update to take effect throughout your deployment, you do not have to reapply access control policies after you update.
Feedback