The Firepower feature set is powerful and flexible enough to support basic and advanced configurations. Use the following sections to quickly set up a Firepower Management Center and its managed devices to begin controlling and analyzing traffic.

Although the FMC can manage devices running previous versions (as specified in the compatibility matrix available at Cisco Secure Firewall Threat Defense Compatibility Guide), this guide only includes features supported on the latest version of device software.

For features that are only supported on old device versions, refer to the guide that matches your version.

In a typical deployment, multiple traffic-handling devices report to one Firepower Management Center, which you use to perform administrative, management, analysis, and reporting tasks.

A FTD device is a next-generation firewall (NGFW) that also has NGIPS capabilities. NGFW and platform features include site-to-site and remote access VPN, robust routing, NAT, clustering, and other optimizations in application inspection and access control.

FTD is available on a wide range of physical and virtual platforms.

You can use the global search feature to quickly locate and navigate to elements of your Firepower Management Center configuration.

Note	This feature is supported in Light and Dusk themes only. To change the theme, see Change the Web Interface Appearance.

You can search the FMC configuration for the following entities:

• Names of web interface pages in top-level menus. (See Search for Web Interface Menu Options.)

• For certain policy types:

  • Policy names

  • Policy descriptions

  • Rule names

  • Rule comments

  (See Search for Policies.)

• For certain object types:

  • Object names

  • Object descriptions

  • Configured values

  (See Search for Objects .)

• How To walkthroughs.

  The search returns a list of walkthroughs that contain the search term, with links to each. (See Search for How To Walkthroughs.)

Keep the following in mind when using global search:

• When you open the global search tool, the most recent ten searches appear in a history list below the search text box. You can select an item from this list to re-execute a search.

• When you type a search expression, the interface replaces the search history with search results that update as you type your search; you do not need to press Enter to execute the search.

• You can navigate the history list or the search results using the mouse or the keyboard arrow keys and the Enter key. Pressing the Enter key selects the currently highlighted item in the search results. In the case of results for web interface pages, this causes the FMC interface to display the highlighted page. For objects and policies, this displays details about the found entity.

• Search is not case-sensitive.

• You can use the following wildcard characters in your search:

  • ? matches any single character.

  • * matches any 0 or more characters.

  • ^ anchors the search term it precedes to the beginning of matched entities.

  • $ anchors the search term it follows to the end of matched entities.

  Wildcards cannot be escaped.

• For greater efficiency, global search does not return indirect search results; that is, global search does not return policies or objects that reference objects where a search term is found. However, you can determine which policies or objects reference many found objects by viewing the Usages tab for the found object in the search detail pane.

• Global search returns the top results for your search expression determined by its relevance to the most commonly used configuration entities in the FMC. If global search fails to return something you are expecting to find, try refining your search, try using the search or filter tool that appears at the top of many GUI pages, or try some of the configuration-specific search features the web interface offers:

  • Searching for Rules in the Firepower Management Center Device Configuration Guide

  • Searching and Filtering the NAT Rule Table in the Firepower Management Center Device Configuration Guide

  • Searching for Events

  • Searching Custom Tables

Global Search in a Multidomain Deployment

In a multidomain deployment, by default search returns only objects and policies defined within the current domain and its ancestor domains. You can see objects and policies in child domains by toggling an option in the search results dialog.

For an object search, if your search expression is found in objects defined in domains other than your current domain, the search results display the names of the domains within which those objects reside. If your search expression is found in objects defined within your current domain, the search results display the object values.

In the example screenshot below, the deployment consists of three domains at three levels: Global, Domain1, and SubDomainA. The user, whose current domain is Domain1, has entered a search for the string “example” in both ancestor and child domains.

1	The user has chosen to search child domains (SubDomainA) as well as the current domain (Domain1) and its ancestor (Global).	2	A matching network object ExampleHostOne defined in the parent domain Global is displayed with the domain name, and the External Domain () icon indicating the user must switch domains to edit details.
3	The matching network object ExampleHostThree defined in the child domain SubDomainA is displayed with the domain name, and the External Domain () icon indicating the user must switch domains to edit details. This object is currently selected.	4	The matching network object ExampleHostThree is currently selected, and information is provided in the right pane. The External Domain () icon indicates that when the user clicks Edit (), the system will prompt the user to confirm a domain change before allowing edit access to the object.
5	The matching network object ExampleHostTwo, defined in the current domain, is displayed with the object value, and with the Current Domain () icon indicating the user may edit this object without switching domains.	6	The matching access control policy ExampleACPolicyOne defined in the parent domain Global is displayed with the domain name, and the External Domain () icon indicating the user must switch domains to edit details.
7	The matching access control policy ExampleACPolicyThree defined in the child domain SubDomainA is displayed with the domain name, and the External Domain () icon indicating the user must switch domains to edit details.	8	The matching access control policy ExampleACPolicyTwo defined in the current domain is displayed with the Current Domain () icon indicating the user may edit details without switching domains.

Certain pages in the web interface support a right-click (most common) or left-click context menu that you can use as a shortcut for accessing other features. The contents of the context menu depend where you access it—not only the page but also the specific data.

For example:

• IP address hotspots provide information about the host associated with that address, including any available whois and host profile information.

• SHA-256 hash value hotspots allow you to add a file’s SHA-256 hash value to the clean list or custom detection list, or view the entire hash value for copying.

On pages or locations that do not support the context menu, the normal context menu for your browser appears.

Policy Editors

Many policy editors contain hotspots over each rule. You can insert new rules and categories; cut, copy, and paste rules; set the rule state; and edit the rule.

Intrusion Rules Editor

The intrusion rules editor contains hotspots over each intrusion rule. You can edit the rule, set the rule state, configure thresholding and suppression options, and view rule documentation. Optionally, after clicking Rule documentation in the context menu, you can click Rule Documentation in the documentation pop-up window to view more-specific rule details.

Event Viewer

Event pages (the drill-down pages and table views available under the Analysis menu) contain hotspots over each event, IP address, URL, DNS query, and certain files’ SHA-256 hash values. While viewing most event types, you can:

• View related information in the Context Explorer.

• Drill down into event information in a new window.

• View the full text in places where an event field contains text too long to fully display in the event view, such as a file’s SHA-256 hash value, a vulnerability description, or a URL.

• Open a web browser window with detailed information about the element from an external source, using the Contextual Cross-Launch feature. For more information, see Event Investigation Using Web-Based Resources.

While viewing connection events, you can add items to the default Security Intelligence Block and Do Not Block lists:

• An IP address, from an IP address hotspot.

• A URL or domain name, from a URL hotspot.

• A DNS query, from a DNS query hotspot.

While viewing captured files, file events, and malware events, you can:

• Add a file to or remove a file from the clean list or custom detection list.

• Download a copy of the file.

• View nested files inside an archive file.

• Download the parent archive file for a nested file.

• View the file composition.

• Submit the file for local malware and dynamic analysis.

While viewing intrusion events, you can perform similar tasks to those in the intrusion rules editor or an intrusion policy:

• Edit the triggering rule.

• Set the rule state, including disabling the rule.

• Configure thresholding and suppression options.

• View rule documentation. Optionally, after clicking Rule documentation in the context menu, you can click Rule Documentation in the documentation pop-up window to view more-specific rule details.

Intrusion Event Packet View

Intrusion event packet views contain IP address hotspots. The packet view uses a left-click context menu.

Dashboard

Many dashboard widgets contain hotspots to view related information in the Context Explorer. Dashboard widgets can also contain IP address and SHA-256 hash value hotspots.

Context Explorer

The Context Explorer contains hotspots over its charts, tables, and graphs. If you want to examine data from graphs or lists in more detail than the Context Explorer allows, you can drill down to the table views of the relevant data. You can also view related host, user, application, file, and intrusion rule information.

The Context Explorer uses a left-click context menu, which also contains filtering and other options unique to the Context Explorer.

You can reach the online help from the web interface:

• By clicking the context-sensitive help link on each page

• By choosing Help > Page-level Help

How To is a widget that provides walkthroughs to navigate through tasks on the FMC. The walkthroughs guide you to perform the steps required to achieve a task by taking you through each step, one after the other irrespective of the various UI screens that you may have to navigate, to complete the task. The How To widget is enabled by default. To disable the widget, choose User Preferences from the drop-down list under your user name, and uncheck the Enable How-Tos check box in How-To Settings. To open the How To widget, choose Help > How-Tos.

Note	The walkthroughs are generally available for all UI pages, and are not user role sensitive. However, depending on the privileges of the user, some of the menu items will not appear on the FMC interface. Thereby, the walkthroughs will not execute on such pages.

The following walkthroughs are available on FMC:

For a list of feature walkthroughs supported in the FMC, see Feature Walkthroughs Supported in Secure Firewall Management Center.

You can find additional documentation using the documentation roadmap:

Navigating the Cisco Secure Firewall Threat Defense Documentation.

You can use IPv4 Classless Inter-Domain Routing (CIDR) notation and the similar IPv6 prefix length notation to define address blocks in many places in the system.

When you use CIDR or prefix length notation to specify a block of IP addresses, the system uses only the portion of the network IP address specified by the mask or prefix length. For example, if you type 10.1.2.3/8, the system uses 10.0.0.0/8.

In other words, although Cisco recommends the standard method of using a network IP address on the bit boundary when using CIDR or prefix length notation, the system does not require it.