- ASA FirePOWER Module User Guide
- Introduction to the Cisco ASA FirePOWER Module
- Managing Reusable Objects
- Managing Device Configuration
- Getting Started with Access Control Policies
- Blacklisting Using Security Intelligence IP Address Reputation
- Tuning Traffic Flow Using Access Control Rules
- Controlling Traffic with Network-Based Rules
- Controlling Traffic with Reputation-Based Rules
- Controlling Traffic Based on Users
- Controlling Traffic Using Intrusion and File Policies
- Understanding Network Analysis and Intrusion Policies
- Using Layers in a Network Analysis or Intrusion Policy
- Customizing Traffic Preprocessing
- Getting Started with Network Analysis Policies
- Using Application Layer Preprocessors
- Configuring SCADA Preprocessing
- Configuring Transport & Network Layer Preprocessing
- Tuning Preprocessing in Passive Deployments
- Getting Started with Intrusion Policies
- Tuning Intrusion Policies Using Rules
- Detecting Specific Threats
- Globally Limiting Intrusion Event Logging
- Understanding and Writing Intrusion Rules
- Blocking Malware and Prohibited Files
- Logging Connections in Network Traffic
- Viewing Events
- Configuring External Alerting
- Configuring External Alerting for Intrusion Rules
- Using the ASA FirePOWER Dashboard
- Using ASA FirePOWER Reporting
- Scheduling Tasks
- Managing System Policies
- Configuring ASA FirePOWER Module Settings
- Licensing the FireSIGHT System ASA FirePOWER Module
- Updating ASA FirePOWER Module Software
- Monitoring the System
- Using Backup and Restore
- Generating Troubleshooting Files
- Importing and Exporting Configurations
- Viewing the Status of Long-Running Tasks
- Security, Internet Access, and Communication Ports
Licensing the ASA FirePOWER Module
You can license a variety of features to create an optimal ASA FirePOWER deployment for your organization.
Understanding Licensing
You can license a variety of features to create an optimal ASA FirePOWER deployment for your organization.
Licenses allow your device to perform a variety of functions including:
- intrusion detection and prevention
- Security Intelligence filtering
- file control and advanced malware protection
- application, user, and URL control
There are a few ways you may lose access to licensed features in the ASA FirePOWER module. You can remove licensed capabilities. In addition, some licenses may expire. Though there are some exceptions, you cannot use the features associated with an expired or deleted license.
Certain licenses, like the Control license, are perpetual. Other licenses require that you purchase a service subscription to enable the license.
This section describes the types of licenses available in an ASA FirePOWER module deployment. The licenses you can enable on an appliance can depend the other licenses enabled.
The following table summarizes ASA FirePOWER module licenses.
|
|
|
|
|
|
|---|---|---|---|---|
advanced malware protection (network-based malware detection and blocking) |
||||
Protection
A Protection license allows you to perform intrusion detection and prevention, file control, and Security Intelligence filtering:
- Intrusion detection and prevention allows you to analyze network traffic for intrusions and exploits and, optionally, drop offending packets.
- File control allows you to detect and, optionally, block users from uploading (sending) or downloading (receiving) files of specific types over specific application protocols. With a Malware license (see Malware), you can also inspect and block a restricted set of those file types based on their malware dispositions.
- Security Intelligence filtering allows you to blacklist—deny traffic to and from—specific IP addresses, before the traffic is subjected to analysis by access control rules. Dynamic feeds allow you to immediately blacklist connections based on the latest intelligence. Optionally, you can use a “monitor-only” setting for Security Intelligence filtering.
A Protection license is automatically included (along with a Control license) in the purchase of an ASA FirePOWER module. This license is perpetual, but you must also purchase a TA subscription to enable system updates.
Although you can configure an access control policy to perform Protection-related inspection without a license, you cannot apply the policy until you first add a Protection license to the ASA FirePOWER module.
If you delete your Protection license from the ASA FirePOWER module, the ASA FirePOWER module stops detecting intrusion and file events. Additionally, the ASA FirePOWER module will not contact the internet for either Cisco-provided or third-party Security Intelligence information. You cannot reapply existing policies until you re-enable Protection.
Because a Protection license is required for URL Filtering, Malware, and Control licenses, deleting or disabling a Protection license has the same effect as deleting or disabling your URL Filtering, Malware, or Control license.
Control
A Control license allows you to implement user and application control by adding user and application conditions to access control rules. To enable Control, you must also enable Protection.
A Control license is automatically included (along with a Protection license) in the purchase of an ASA FirePOWER module. This license is perpetual, but you must also purchase a TA subscription to enable system updates.
Although you can add user and application conditions to access control rules without a Control license, you cannot apply the policy until you first add a Control license to the ASA FirePOWER module.
If you delete your Control license, you cannot reapply existing access control policies if they include rules with user or application conditions.
URL Filtering
URL filtering allows you to write access control rules that determine the traffic that can traverse your network based on URLs requested by monitored hosts, correlated with information about those URLs, which is obtained from the Cisco cloud by the ASA FirePOWER module. To enable URL Filtering, you must also enable a Protection license.
Tip
Without a URL Filtering license, you can specify individual URLs or groups of URLs to allow or block. This gives you granular, custom control over web traffic, but does not allow you to use URL category and reputation data to filter network traffic.
You can purchase a URL Filtering license as a services subscription combined with Threat & Apps (TAC) or Threat & Apps and Malware (TAMC), or as an add-on subscription (URL) for an ASA FirePOWER module where Threat & Apps (TA) is already enabled.
Although you can add category and reputation-based URL conditions to access control rules without a URL Filtering license, the ASA FirePOWER module will not contact the cloud for URL information. You cannot apply the access control policy until you first add a URL Filtering license to the ASA FirePOWER module.
You may lose access to URL filtering if you delete the license from the ASA FirePOWER module. Also, URL Filtering licenses may expire. If your license expires or if you delete it, access control rules with URL conditions immediately stop filtering URLs, and your ASA FirePOWER module can no longer contact the cloud. You cannot reapply existing access control policies if they include rules with category and reputation-based URL conditions.
Malware
A Malware license allows you to perform advanced malware protection, that is, use devices to detect and block malware in files transmitted over your network. To enable Malware on a device, you must also enable Protection.
You configure malware detection as part of a file policy, which you then associate with one or more access control rules. File policies can detect your users uploading or downloading files of specific types over specific application protocols. The Malware license allows you to inspect a restricted set of those file types for malware. The Malware license also allows you to add specific files to a file list and enable the file list within a file policy, allowing those files to be automatically allowed or blocked on detection.
You can purchase a Malware license as a subscription combined with Threat &Apps (TAM) or Threat & Apps and URL Filtering (TAMC), or as an add-on subscription (AMP) for an ASA FirePOWER module where Threat & Apps (TA) is already enabled.
Although you can add a malware-detecting file policy to an access control rule without a Malware license, the file policy is marked with a warning icon (
) in the access control rule editor. Within the file policy, Malware Cloud Lookup rules are also marked with the warning icon. Before you can apply an access control policy that includes a malware-detecting file policy, you must add a Malware license. If you later delete the license, you cannot reapply an existing access control policy to those devices if it includes file policies that perform malware detection.
If you delete your Malware license or it expires, the ASA FirePOWER module stops performing malware cloud lookups, and also stops acknowledging retrospective events sent from the Cisco cloud. You cannot reapply existing access control policies if they include file policies that perform malware detection. Note that for a very brief time after a Malware license expires or is deleted, the system can use cached dispositions for files detected by Malware Cloud Lookup file rules. After the time window expires, the system assigns a disposition of Unavailable to those files, rather than performing a lookup.
Understanding Service Subscriptions
A service subscription enables specific features on an ASA FirePOWER module for a set length of time. Service subscriptions can be purchased in one-, three-, or five-year terms. If a subscription expires, Cisco notifies you that you must renew the subscription. If a subscription expires, you might not be able to use the related features, depending on the feature type.
Your purchase of an ASA FirePOWER module automatically includes Control and Protection licenses. These licenses are perpetual, but you must also purchase a TA service subscription to enable system updates. Additional service subscriptions are optional.
Service subscriptions correspond to the licenses you assign in the FirePOWER System, as follows:
|
|
|
|---|---|
Control + Protection (a.k.a. "Threat & Apps," required for system updates) |
|
Viewing Your Licenses
Use the Licenses page to view the licenses for an ASA FirePOWER module.
Other than the Licenses page, there are a few other ways you can view licenses and license limits:
- The Product Licensing dashboard widget provides an at-a-glance overview of your licenses.
- The Device page ( Configuration > ASA FirePOWER Configuration > Device Management > Device) lists the licenses.
Step 1 Select Configuration > ASA FirePOWER Configuration > Licenses.
Adding a License to the ASA FirePOWER module
Before you add a license to the ASA FirePOWER module, make sure you have the activation key provided by Cisco when you purchased the license. You must add licenses before you can use licensed features.
Note If you add licenses after a backup has completed, these licenses will not be removed or overwritten if this backup is restored. To prevent a conflict on restore, remove those licenses before restoring the backup, noting where the licenses were used, and add and reconfigure them after restoring the backup. If a conflict occurs, contact Support.
Step 1 Select Configuration > ASA FirePOWER Configuration > Licenses.
Step 3 Did you receive an email with your license?
If the license is correct, the license is added. Skip the rest of the procedure.
The Licensing Center web site appears. If you cannot access the Internet, switch to a computer that can. Note the license key at the bottom of the page and browse to https://keyserver.sourcefire.com/.
Step 4 Follow the on-screen instructions to obtain your license, which will be sent to you in an email.
Tip You can also request a license on the Licenses tab after you log into the Support Site.
Step 5 Copy the license from the email, paste it into the License field in the ASA FirePOWER module’s web user interface, and click Submit License.
If the license is valid, it is added.
Deleting a License
Use the following procedure if you need to delete a license for any reason. Keep in mind that because Cisco generates licenses based on each ASA FirePOWER module’s unique license key, you cannot delete a license from one ASA FirePOWER module and then reuse it on a different ASA FirePOWER module.
In most cases, deleting a license removes your ability to use features enabled by that license. For more information, see Understanding Licensing.
Step 1 Select Configuration > ASA FirePOWER Configuration > Licenses.
Step 2 Next to the license you want to delete, click the delete icon (
).
Step 3 Confirm that you want to delete the license.
Feedback