Here's a Cisco link for the Cisco Firepower 1010 setup guide and videos for configuring Cisco FTD via Firepower Device Manager (FDM). The Firepower 1010 security appliance is the replacement for the Cisco ASA 5506-X. There are also free tranining videos from Cisco for their Next-Generation Firewall (NGFW).
Below is the front panel and the chassis looks similar to a Cisco WLC 3504 wireless controller.
You'll find the chassis serial number in the bottom.
The Status LED for Power, Status (System OS) and Active (Failover) are located on the top chassis.
In the back panel, you'll find the power socket, 8x GE ports, Management port, 2x console ports: RJ45 and USB Mini B, External USB 3.0 Type A (for disk1 storage), Kensington lock slot and the reset button.
The 8x GE ports are used as follows: Ethernet1/1 (WAN/ISP), Ethernet1/2 - 8 (Layer 2 switch ports) with ports 7 and 8 that supports PoE+ (30 watts per port).
The Firepower 1010 uses an AC power adapter (FPR1K-DT-PWR-AC) with an IEC 60320/C5 connector (shaped like a Mickey Mouse head). I used a Europe plug (CAB-AC-C5-UK).
In FTD 6.4 and earlier, the Management1/1, FMC or FDM machines are connected using a Layer 2 switch. This is in contrast with FTD 6.5 and above wherein you can directly use the FTD Layer 2 ports to connect Management1/1 without the need for an additional Layer 2 switch.
Below is the Firepower 1010 initial bootup.
*******************************************************************************
Cisco System ROMMON, Version 1.0.05, RELEASE SOFTWARE
Copyright (c) 1994-2019 by Cisco Systems, Inc.
Compiled Wed 04/03/2019 18:07:24.29 by builder
*******************************************************************************
Current image running: Boot ROM0
Last reset cause: PowerOn (0x00000001)
DIMM0 : Present
Platform FPR-1010 with 8192 MBytes of main memory
BIOS has been successfully locked !!
MAC Address: 5c:5a:c7:b8:f7:80
Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.
Boot in 6
seconds. // SIMILAR TO ASA 10 SECONDS COUNTER TO INTERRUPT BOOTUP AND ENTER ROMMON
Use SPACE to begin boot immediately.
File size is 0x0000003b
Located .boot_string
Image size 59 inode num 16, bks cnt 1 blk size 8*512
Attempt autoboot: "boot disk0:installables/switch/fxos-k8-fp2k-lfbff.2.6.1.133.SPA"
File size is 0x0a270820
Located installables/switch/fxos-k8-fp2k-lfbff.2.6.1.133.SPA
Image size 170330144 inode num 114027, bks cnt 41585 blk size 8*512
########################################################################################################################################################################################
<OUTPUT TRUNCATED>
###############################################################################################################################################################################################
+-------------------------------------------------------------------+
+------------------------- SUCCESS ---------------------------------+
+-------------------------------------------------------------------+
| |
| LFBFF signature authentication passed !!! |
| |
+-------------------------------------------------------------------+
LFBFF signature verified.
+-------------------------------------------------------------------+
+------------------------- SUCCESS ---------------------------------+
+-------------------------------------------------------------------+
| |
| LFBFF controller type check passed !!! |
| |
+-------------------------------------------------------------------+
INIT: version 2.88 booting
Starting udev
Configuring network interfaces... done.
Populating dev cache
Primary SSD discovered
fsck from util-linux 2.26.2
[/sbin/fsck.ext3 (1) -- /dev/sda1] fsck.ext3 -a /dev/sda1
/dev/sda1: clean, 8827/488640 files, 409748/1953024 blocks
fsck(/dev/sda1) returned 0
fsck from util-linux 2.26.2
[/sbin/fsck.ext3 (1) -- /dev/sda2] fsck.ext3 -a /dev/sda2
/dev/sda2: clean, 137/61056 files, 36376/244224 blocks
fsck(/dev/sda2) returned 0
fsck from util-linux 2.26.2
[/sbin/fsck.ext3 (1) -- /dev/sda3] fsck.ext3 -a /dev/sda3
/dev/sda3: clean, 145/61056 files, 13258/244224 blocks
fsck(/dev/sda3) returned 0
fsck from util-linux 2.26.2
[/sbin/fsck.ext3 (1) -- /dev/sda4] fsck.ext3 -a /dev/sda4
/dev/sda4: clean, 13/1831424 files, 158996/7324160 blocks
fsck(/dev/sda4) returned 0
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
FIPS POST Test Script
NOTICE: The FIPS POST is not run because the FIPS feature is not enabled
Running postinst /etc/rpm-postinsts/100-dnsmasq...
Running postinst /etc/rpm-postinsts/101-dnsmasq...
INIT: Entering runlevel: 3
Starting system message bus: dbus.
Stopping all devices.
Starting all devices.
Processing /etc/c3xxx_dev0.conf
Checking status of all devices.
There is 1 QAT acceleration device(s) in the system:
qat_dev0 - type: c3xxx, inst_id: 0, node_id: 0, bsf: 01:00.0, #accel: 3 #engines: 6 state: up
ip6tables: Applying firewall rules: [ OK ]
iptables: Applying firewall rules: [ OK ]
Starting OpenBSD Secure Shell server: sshd
done.
Starting rpcbind daemon...done.
starting statd: done
Starting Advanced Configuration and Power Interface daemon: acpid.
acpid: starting up with netlink and the input layer
acpid: 1 rule loaded
acpid: waiting for events: event logging is off
starting 8 nfsd kernel threads: done
starting mountd: done
Starting ntpd: done
Starting internet superserver: xinetd.
No makedumpfile found.
Starting fan control daemon: fancontrol... done.
INFO: in validating image ...
INFO: manager_validate_image: fxmgr_absfilename /mnt/boot/installables/switch/fxos-k9-fp2k-manager.2.6.1.133.SPA
INFO: Validating image /mnt/boot/installables/switch/fxos-k9-fp2k-manager.2.6.1.133.SPA signature ...
: File /mnt/boot/installables/switch/fxos-k9-fp2k-manager.2.6.1.133.SPA size 26206720
Computed Hash SHA2: 408939ad0cb649d8b5522446f36c5287
6e1ec865fae6f11b273242a50b79871b
71d91931543658a9c9a12a4e69073a8f
8bae413f2b4953a7d4a3d01ee5043c8e
Embedded Hash SHA2: 408939ad0cb649d8b5522446f36c5287
6e1ec865fae6f11b273242a50b79871b
71d91931543658a9c9a12a4e69073a8f
8bae413f2b4953a7d4a3d01ee5043c8e
The digital signature of the file: fxos-k9-fp2k-manager.2.6.1.133.SPA verified successfully
INFO: beginning of manager_install
INFO: manager_install: fxmgr=/mnt/boot/installables/switch/fxos-k9-fp2k-manager.2.6.1.133.SPA chmgr= update=false
INFO: mkdir -p /tmp/fxmgr
INFO: /bin/tar -xvzf /tmp/fxmgr/fxos-kp-manager.2.6.1.133.tgz ...
INFO: manager_install: shutting down the old version ...
INFO: Terminating DME and all AGs ...
INFO: --
INFO: manager_install: Unlinking a old libraries ...
INFO: manager_install: Deleting the old manager image ...
INFO: manager_install: Installing the new image ...
INFO: deleting unnecessary xml file..!!
INFO: deleted unnecessary xml file..!!
INFO: manager_post_install ...
INFO: manager_post_install: fxmgr=/mnt/boot/installables/switch/fxos-k9-fp2k-manager.2.6.1.133.SPA chmgr= update=false
INFO: manager_post_install: Linking libraries ...
INFO: manager_post_install: Linking binaries ...
INFO: Trying to add iptables and ip6tables rules ...
INFO: Set up Application Diagnostic Interface ...
INFO: Configure management interface ...
Firepower 1xxx platform..
RTNETLINK answers: File exists
RTNETLINK answers: File exists
Assigning ip to eth0 in FPR-1xxx platform
INFO: Configure rmu interface ...
Bring up rmu and swp1-swp10 switch interfaces
create and bringup lldp sub-interface on lldp-swp7, lldp-swp8
create and bringup lacp and mgmt sub-interface on (lacp-swp1 to lacp-swp8), (mgmt-swp1 to mgmt-swp8)
Stopping rpcbind daemon...
done.
stopping mountd: done
stopping nfsd: .done
INFO: Configure system files ...
INFO: System Name is: firepower
Starting sensors logging daemon: sensord... done.
INFO: manager_startup: setting up fxmgr apache ...
INFO: manager_startup: Start manager httpd setup...
INFO: manager_startup: using HTTPD_INFO persistent cache
/bin/rm: cannot remove '/tmp/openssl.conf': No such file or directory
httpdRegister INFO: [httpd.3520 -s -4 172.16.2.14 -n localhost]
httpdRegister INFO: SKIP httpd syntax check
httpdRegister INFO: Starting httpd setup/registration...
httpdRegister INFO: Completed httpd setup/registration!
INFO: httpdRegister [httpd.3520 script exit]
INFO: manager_startup: Completed manager httpd setup!
Starting crond: OK
1:/opt/cisco/csp/cores
/opt/cisco/csp/cores 31457280
Threat Defense System: CMD=-bootup, CSP-ID=cisco-ftd.6.4.0.102__ftd_001_JMX2324G1THA28AI31, FLAG=''
System is booting up ...
Cisco FTD booted up successfully.
INFO: System Disk /dev/sda present. Status: Operable.
Cisco FPR Series Security Appliance
firepower login:
Waiting for Application infrastructure to be ready...
Verifying the signature of the Application image...
Creating FXOS swap file ...
Sep 7 02:16:01 firepower port-manager : Alert: Internal1/2 link changed to UP
Sep 7 02:16:01 firepower port-manager : Alert: Internal1/1 link changed to UP
ipsec_starter[9666]: Starting strongSwan 5.3.3 IPsec [starter]...
scepclient[9915]: fingerprint: c51d46087deeb88c00d78860ac138702
scepclient[9915]: transaction ID: 11665FBA795D1DC911B4A98A188BC252
ipsec_starter[9945]: charon (9947) started after 160 ms
Sep 7 02:17:28 firepower port-manager : Alert: Ethernet1/1 link changed to UP
Cisco FTD initializing ...
Verify FSIC, File System Integrity Check
Obtained uid 501 and gid 501 for external user
verify_fsic(start)
Do not run FSIC twice for SSP systems...
Initializing Threat Defense ... [ OK ]
Starting system log daemon... [ OK ]
Adding swapfile /ngfw/Volume/.swaptwo
Flushing all current IPv4 rules and user defined chains: ...success
Clearing all current IPv4 rules and user defined chains: ...success
Applying iptables firewall rules:
Flushing chain `PREROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `POSTROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Applying rules successed
Flushing all current IPv6 rules and user defined chains: ...success
Clearing all current IPv6 rules and user defined chains: ...success
Applying ip6tables firewall rules:
Flushing chain `PREROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `POSTROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Applying rules successed
Starting nscd...
mkdir: created directory '/var/run/nscd' [ OK ]
Starting , please wait......complete.
cleaning up *.TMM and *.TMD files
Configuring NTP... [ OK ]
Stopping all devices.
Starting all devices.
Processing /etc/c3xxx_dev0.conf
Checking status of all devices.
There is 1 QAT acceleration device(s) in the system:
qat_dev0 - type: c3xxx, inst_id: 0, node_id: 0, bsf: 01:00.0, #accel: 3 #engines: 6 state: up
SIOCSIFADDR: No such device
br0: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: No such device
br0: ERROR while getting interface flags: No such device
Not reconfigurating
Mon Sep 7 02:18:16 UTC 2020
Starting MySQL...
Pinging mysql
Pinging mysql, try 1
Found mysql is running
Running initializeObjects...
Stopping MySQL...
Killing mysqld with pid 15033
Wait for mysqld to exit\c
done
Mon Sep 7 02:18:26 UTC 2020
Skipping sfifd for this platform...
Starting Cisco Firepower 1010 Threat Defense, please wait...No PM running!
...started.
Cisco FTD initialization finished successfully.
memif is not enabled.
IO Memory Nodes: 1
IO Memory Per Node: 549453824 bytes num_pages = 134144 page_size = 4096
Global Reserve Memory Per Node: 786432000 bytes Nodes=1
LCMB: got 1073741824 bytes on numa-id=0, phys=0x200000000, virt=0x2b7e00000000
LCMB: HEAP-CACHE POOL got 784334848 bytes on numa-id=0, virt=0x2b7e40000000
total mem 3079146512 new 3079146512 old 659707216 reserv 1858076672 pri new 1233403878 pri old 0 system 8394846208 kernel 12334038 image 110253392
Processor memory: 3079146512
POST started...
POST finished, result is 0 (hint: 1 means it failed)
Compiled on Tue 02-Jul-19 17:13 PDT by builders
SSL Hardware Offload is Enabled
Using configured value (300000) from /mnt/disk0/.private/ctm_scb_handles.conf
FPR-1010 platformpci_do_probe_wc(): Adding WC-NIC vid = 0x8086 did = 0x15c2
Total NICs found: 6
x550em_kr rev 0x11 10 Gigabit Ethernet, index 00 MAC: 00a0.c900.0000
en_vtun rev00 Backplane Ext-Mgmt Interface @ index 02 MAC: 5c5a.c7b8.f781
en_vtun rev00 Backplane Tap Interface @ index 03 MAC: 0000.0100.0001
en_vtun rev00 Backplane Control Interface @ index 05 MAC: 0000.0300.0101
WARNING: Attribute already exists in the dictionary.
*** Intel QAT Crypto on-board accelerator detected
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
****************************** Warning *******************************
This product contains cryptographic features and is
subject to United States and local country laws
governing, import, export, transfer, and use.
Delivery of Cisco cryptographic products does not
imply third-party authority to import, export,
distribute, or use encryption. Importers, exporters,
distributors and users are responsible for compliance
with U.S. and local country laws. By using this
product you agree to comply with applicable laws and
regulations. If you are unable to comply with U.S.
and local laws, return the enclosed items immediately.
A summary of U.S. laws governing Cisco cryptographic
products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by
sending email to export@cisco.com.
******************************* Warning *******************************
Copyright (c) 1996-2017 by Cisco Systems, Inc.
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Error No such device in set_linux_mac_address: Failed to assign MAC address for br0
Reading from flash...
!..
Cryptochecksum (unchanged): 219d676b d19c7cb2 38101f20 513e3534
INFO: Power-On Self-Test in process.
.......................................................................
INFO: Power-On Self-Test complete.
INFO: Starting SW-DRBG health test...
INFO: SW-DRBG health test passed.
M_MMAP_THRESHOLD 65536, M_MMAP_MAX 46984
User enable_1 logged in to firepower
Logins over the last 1 days: 1.
Failed logins since the last login: 0.
Type help o '?.
list of available commands.
firepower> // FTD INITIALIZED AROUND 5 MINS
firepower login: admin // DEFAULT LOGIN: admin / Admin123
Password:
Last login: Wed Aug 26 05:45:41 UTC 2020 on ttyS0
Successful login attempts for user 'admin' : 1
Copyright 2004-2019, Cisco and/or its affiliates. All rights reserved.
Cisco is a registered trademark of Cisco Systems, Inc.
All other trademarks are property of their respective owners.
Cisco Fire Linux OS v6.4.0 (build 2)
Cisco Firepower 1010 Threat Defense v6.4.0.3 (build 29)
Cisco Firepower Extensible Operating System (FX-OS) Software
TAC support: http://www.cisco.com/tac
Copyright (c) 2009-2019, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained in this software are
owned by other third parties and used and distributed under
license.
Certain components of this software are licensed under the "GNU General Public
License, version 3" provided with ABSOLUTELY NO WARRANTY under the terms of
"GNU General Public License, Version 3", available here:
http://www.gnu.org/licenses/gpl.html. See User Manual (''Licensing'') for
details.
Certain components of this software are licensed under the "GNU General Public
License, version 2" provided with ABSOLUTELY NO WARRANTY under the terms of
"GNU General Public License, version 2", available here:
http://www.gnu.org/licenses/old-licenses/gpl-2.0.html. See User Manual
(''Licensing'') for details.
Certain components of this software are licensed under the "GNU LESSER GENERAL
PUBLIC LICENSE, version 3" provided with ABSOLUTELY NO WARRANTY under the terms
of "GNU LESSER GENERAL PUBLIC LICENSE" Version 3", available here:
http://www.gnu.org/licenses/lgpl.html. See User Manual (''Licensing'') for
details.
Certain components of this software are licensed under the "GNU Lesser General
Public License, version 2.1" provided with ABSOLUTELY NO WARRANTY under the
terms of "GNU Lesser General Public License, version 2", available here:
http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html. See User Manual
(''Licensing'') for details.
Certain components of this software are licensed under the "GNU Library General
Public License, version 2" provided with ABSOLUTELY NO WARRANTY under the terms
of "GNU Library General Public License, version 2", available here:
http://www.gnu.org/licenses/old-licenses/lgpl-2.0.html. See User Manual
(''Licensing'') for details.
firepower#
connect ftd // CONNECT TO FTD CLI (# PROMPT IS FOR FXOS CLI)
> ? // CLISH PROMPT (REGULAR FTD CLI)
aaa-server Specify a AAA server
activate-tunnel-group-scripts Reload ASDM generated scripts for username-from-certificate
app-agent Configure appagent features
asp Configure ASP parameters
attribute Modify a monitored attribute
blocks Set block diagnostic parameters
capture Capture inbound and outbound packets on one or more interfaces
capture-traffic Display traffic or save to specified file
clear Reset functions
cluster Cluster exec mode commands
configure Change to Configuration mode
connect Connect to another component.
copy Copy from one file to another
cpu general CPU stats collection tools
crypto Execute crypto Commands
debug Debugging functions (see also 'undebug')
delete Delete a file
dir List files on a filesystem
dns List files on a filesystem
dynamic-access-policy-config Activates the DAP selection configuration file.
eotool Change to Enterprise Object Tool Mode
exit Exit this CLI session
expert Invoke a shell
failover Perform failover operation in Exec mode
file Change to File Mode
fips Execute FIPS tests
fsck Filesystem check
help Interactive help for commands
history Display the current session's command line history
ldapsearch Test LDAP configuration
logging Configure flash file name to save logging buffer
logout Logout of the current CLI session
memory Memory tools
more Display the contents of a file
no Negate a command or set its defaults
nslookup Look up an IP address or host name with the DNS servers
packet-tracer trace packets in F1 data path
perfmon Change or view performance monitoring options
pigtail Tail log files for debugging (pigtail)
ping Test connectivity from specified interface to an IP address
pmtool Change to PMTool Mode
reboot Reboot the sensor
redundant-interface Redundant interface
restore This command is used to restore FTD from sfr prompt
sftunnel-status Show sftunnel status
show Show running system information
shun Manages the filtering of packets from undesired hosts
shutdown Shutdown the sensor
system Change to System Mode
tail-logs Tails the logs selected by the user
test Test subsystems, memory, interfaces, and configurations
traceroute Find route to remote network
undebug Disable debugging functions (see also 'debug')
verify Verify a file
vpn-sessiondb Configure the VPN Session Manager
webvpn-cache Remove cached object
> show ?
access-control-config audit-cert audit-log
coredump cpu database
disk disk-manager dns
high-availability https-access-list ipv6-icmp
log-events-to-ramdisk managers memory
model network network-dhcp-server
network-static-routes ntp packet
perfstats process-tree processes
serial-number snort ssh-access-list
ssl-policy-config ssl-protocol summary
syslog-config tech-support time
unified-logging user version
aaa aaa-server access-list
app-agent arp arp-inspection
as-path-access-list asp banner
bfd bgp blocks
bootvar bridge-group capture
chassis checkheaps checksum
chunkstat clns cluster
community-list config-cli configuration
conn console-output counters
crashinfo crypto ctiqbe
ctl-provider curpriv ddns
debug dhcpd dhcprelay
diameter disk0: disk1:
eigrp failover file
firewall flash: flow-export
fqdn fragment gc
h225 h245 h323
idb igmp inline-set
interface inventory ip
ipv6 isakmp isis
kernel key lisp
local-host logging mac-address-table
mac-learn message-layer mfib
mgcp mode monitor-interface
mrib mroute nameif
nat object-group ospf
packet-tracer pager parser
password pclu perfmon
pim policy-list policy-route
prefix-list priority-queue quota
resource rip rollback-status
route route-map rule
running-config sctp service-policy
shun sip skinny
sla snmp-server snort
ssl startup-config sunrpc-server
tcpstat threat-detection time-range
tls-proxy track traffic
vlan vpdn vpn
vpn-sessiondb wccp webvpn
xlate zone
> show interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Ethernet1/1 unassigned YES unset up up
Ethernet1/2 unassigned YES unset admin down down
Ethernet1/3 unassigned YES unset admin down down
Ethernet1/4 unassigned YES unset admin down down
Ethernet1/5 unassigned YES unset admin down down
Ethernet1/6 unassigned YES unset admin down down
Ethernet1/7 unassigned YES unset admin down down
Ethernet1/8 unassigned YES unset admin down down
Internal-Control1/1 unassigned YES unset up up
Internal-Data1/1 169.254.1.1 YES unset up up
Internal-Data1/2 unassigned YES unset up up
Management1/1 unassigned YES unset up up
> show interface Management 1/1
Interface
Management1/1 "diagnostic", is up, line protocol is up // DIAGNOSTIC IS A LOGICAL INTERFACE; ONLY ALLOWS MANAGEMENT TRAFFIC; IT DOESN'T SUPPORT SSH; USED FOR SNMP AND SYSLOG
Hardware is en_vtun rev00, BW Unknown Speed-Capability, DLY 1000 usec
Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
Input flow control is unsupported, output flow control is unsupported
MAC address 5c5a.c7b8.f781, MTU 1500
IP address unassigned
1730 packets input, 149633 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
1 L2 decode drops, 0 demux drops
0 packets output, 0 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 input reset drops, 0 output reset drops
input queue (blocks free curr/low): hardware (0/0)
output queue (blocks free curr/low): hardware (0/0)
Traffic Statistics for "diagnostic":
1728 packets input, 125257 bytes
0 packets output, 0 bytes
1309 packets dropped
1 minute input rate 1 pkts/sec, 58 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 1 pkts/sec, 91 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec
Management-only interface. Blocked 0 through-the-device packets
There are various FTD CLI modes: FTD CLI (> prompt), expert mode ($ prompt) and FXOS CLI mode (# prompt). Just type exit to return to FXOS CLI.
> exit
firepower# ?
acknowledge Acknowledge
backup Backup
commit-buffer Commit transaction buffer
connect Connect to Another CLI
discard-buffer Discard transaction buffer
end Go to exec mode
exit Exit from command interpreter
scope Changes the current mode
set Set property values
show Show system information
terminal Set terminal line parameters
top Go to the top mode
up Go up one mode
where Show information about the current mode
firepower# show ?
chassis Chassis
cli CLI Information
clock Clock
configuration Configuration
eth-uplink Ethernet Uplink
event Event Management
fabric-interconnect Show NGFW
fault Fault
fxos-mode Fxos-mode
identity Identity
ntp-overall-status NTP Overall Time-Sync Status
registry-repository Registry Repository
security security mode
server Server
system Systems
timezone Set timezone
version System version
I was
unable to initially access the management IP address 192.168.45.45 via HTTPS so I performed a
"factory reset" using the reset button. Just
press and hold for 10 seconds using a pen or pencil point then release.
> 2020-09-07 02:38:50 logmonitor[15948]: syslog-ng not running. starting it.
(®+‘…ÍÑmessage from root@firepower (Mon Sep 7 02:38:54 2020)2020-09-07 02:38:55 logmonitor[15948]: Failed to start syslog-ng.
Stopping all devices.
device busy
Stopping OpenBSD Secure Shell server: sshd
stopped /usr/sbin/sshd (pid 9932)
done.
Stopping Advanced Configuration and Power Interface daemon: stopped /usr/sbin/acpid (pid 1655)
acpid.
Stopping system message bus: dbus.
stopping mountd: done
stopping nfsd: done
Stopping ntpd: stopped process in pidfile '/var/run/ntp.pid' (pid 10253)
done
Stopping internet superserver: xinetd.
stopping statd: done
no /etc/sysconfig/kdump.conf
Stopping rpcbind daemon...
not running.
Stopping fan control daemon: fancontrol... no process in pidfile '/var/run/fancontrol.pid' found; none killed
done.
Stopping sensors logging daemon: sensord... stopped /usr/sbin/sensord (pid 3495)
done.
Deconfiguring network interfaces... done.
ip6tables: Setting chains to policy ACCEPT: mangle filter [ OK ]
ip6tables: Flushing firewall rules: [ OK ]
ip6tables: Unloading modules: [ OK ]
iptables: Setting chains to policy ACCEPT: mangle filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
SSP-Security-Module is shutting down ...
Mon Sep 7 02:38:57 UTC 2020 SHUTDOWN WARNING: Beginning System Shutdown request for CSP Apps
Mon Sep 7 02:38:57 UTC 2020 SHUTDOWN WARNING: Continue System Shutdown request for CSP Apps
/bin/ls: cannot access /opt/cisco/config/heimdall/etc: No such file or directory
/bin/ls: cannot access /opt/cisco/csp/applications/configs: No such file or directory
ls: cannot access /opt/cisco/config/heimdall/etc: No such file or directory
Mon Sep 7 02:38:57 UTC 2020 SHUTDOWN WARNING: Nothing to do for Apps-Services-Down
Sending ALL processes the TERM signal ...
ipsec_starter[9945]: charon stopped after 400 ms
ipsec_starter[9945]: ipsec starter stopped
Note: SIGKILL_ALL will be triggered after after 0 + 2 secs ...
Sending ALL processes the KILL signal ...
Deactivating swap...
Unmounting local filesystems...
Rebooting... [ 1467.752977] reboot: Restarting system
firepower-1010# connect ftd
Error: Application is not installed.
firepower-1010#
Threat Defense System: CMD=-install, CSP-ID=cisco-ftd.6.4.0.102__ftd_001_JMX2324G1THPHT8K11, FLAG=''
System begins installation ...
Cisco FTD installation finished successfully.
Verifying signature for cisco-ftd.6.4.0.102 ...
Verifying signature for cisco-ftd.6.4.0.102 ... success
Threat Defense System: CMD=-start, CSP-ID=cisco-ftd.6.4.0.102__ftd_001_JMX2324G1THPHT8K11, FLAG=''
System starting ...
Registering to process manager ...
Cisco FTD started successfully.
Cisco FTD initializing ...
Verify FSIC, File System Integrity Check
Configuring model to 78A...
firepower-1010#
Obtained uid 501 and gid 501 for external user
/ngfw/usr/bin/clish: error while loading shared libraries: libclish.so.1: cannot open shared object file: No such file or directory
firepower-1010# verify_fsic(start)
Do not run FSIC twice for SSP systems...
Initializing Threat Defense ... [ OK ]
Starting system log daemon... [ OK ]
Disk free check passed, creating swap...
Building swapfile /ngfw/Volume/.swaptwo of size 5508236kb
firepower-1010#
5508236+0 records in
5508236+0 records out
5640433664 bytes (5.6 GB) copied, 19.3411 s, 292 MB/s
Setting up swapspace version 1, size = 5.3 GiB (5640429568 bytes)
no label, UUID=fea3f797-62d5-4a65-ab19-a3316ba05ec6
Adding swapfile /ngfw/Volume/.swaptwo
Flushing all current IPv4 rules and user defined chains: ...success
Clearing all current IPv4 rules and user defined chains: ...success
Applying iptables firewall rules:
Flushing chain `PREROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `POSTROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Applying rules successed
Flushing all current IPv6 rules and user defined chains: ...success
Clearing all current IPv6 rules and user defined chains: ...success
Applying ip6tables firewall rules:
Flushing chain `PREROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `POSTROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Applying rules successed
Starting nscd...
mkdir: created directory '/var/run/nscd' [ OK ]
Starting , please wait......complete.
cleaning up *.TMM and *.TMD files
Firstboot detected, executing scripts
Executing S01virtual-machine-reconfigure [ OK ]
Executing S01z_copy_startup-config [ OK ]
Executing S02aws-pull-cfg [ OK ]
Executing S02configure_onbox [ OK ]
Executing S04fix-httpd.sh [ OK ]
Executing S05set-default-ipv4.pl
You must accept the EULA to continue.
Press <ENTER> to display the EULA: <HIT ENTER TO CONTINUE>
<OUTPUT TRUNCATED - HIT SPACE BAR>
18. Integration. If any portion of this EULA is found to be void or
unenforceable, the remaining provisions of the EULA shall remain in full force
and effect. Except as expressly stated or as expressly amended in a signed
agreement, the EULA constitutes the entire agreement between the parties with
respect to the license of the Software and supersedes any conflicting or
additional terms contained in any purchase order or elsewhere, all of which
terms are excluded. The parties agree that the English version of the EULA will
govern in the event of a conflict between it and any version translated into
another language.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco
and/or its affiliates in the U.S. and other countries. To view a list of Cisco
trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks
mentioned are the property of their respective owners. The use of the word
partner does not imply a partnership relationship between Cisco and any other
company.
System initialization in progress. Please stand by. |
********** Attention **********
Initializing the system's localization settings. Depending on available
system resources (CPU, memory, and disk), this may take 10 minutes
or more to complete.
********** Attention **********
Executing S97update_modprobe.pl [ OK ]
Executing S98check-db-integrity.sh [ OK ]
Executing S98htaccess-init [ OK ]
Executing S99configure_mysql [ OK ]
Executing S99correct_ipmi.pl [ OK ]
Executing S99ssl_hw_mode.sh [ OK ]
Executing S99start-system [ OK ]
Executing S99z_db_restore [ OK ]
Firstboot scripts finished.
Configuring NTP... [ OK ]
Stopping all devices.
Starting all devices.
Processing /etc/c3xxx_dev0.conf
Checking status of all devices.
There is 1 QAT acceleration device(s) in the system:
qat_dev0 - type: c3xxx, inst_id: 0, node_id: 0, bsf: 01:00.0, #accel: 3 #engines: 6 state: up
SIOCSIFADDR: No such device
br0: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: No such device
br0: ERROR while getting interface flags: No such device
Model reconfigure detected, executing scripts
Pinging mysql
Found mysql is running
Executing 45update-sensor.pl [ OK ]
Executing 55recalculate_arc.pl [ OK ]
Mon Sep 7 03:00:45 UTC 2020
Starting MySQL...
Pinging mysql
Pinging mysql, try 1
Found mysql is running
Running initializeObjects...
Stopping MySQL...
Killing mysqld with pid 7993
Wait for mysqld to exit\c
done
Mon Sep 7 03:00:56 UTC 2020
Skipping sfifd for this platform...
Starting Cisco Firepower 1010 Threat Defense, please wait...No PM running!
...started.
Cisco FTD initialization finished successfully.
memif is not enabled.
IO Memory Nodes: 1
IO Memory Per Node: 549453824 bytes num_pages = 134144 page_size = 4096
Global Reserve Memory Per Node: 786432000 bytes Nodes=1
LCMB: got 1073741824 bytes on numa-id=0, phys=0x200000000, virt=0x2b8740000000
LCMB: HEAP-CACHE POOL got 784334848 bytes on numa-id=0, virt=0x2b8705400000
total mem 3079146512 new 3079146512 old 659684624 reserv 1858076672 pri new 1233403878 pri old 0 system 8394846208 kernel 12334038 image 110230800
Processor memory: 3079146512
POST started...
POST finished, result is 0 (hint: 1 means it failed)
Compiled on Mon 22-Apr-19 08:39 PDT by builders
SSL Hardware Offload is Enabled
FPR-1010 platformpci_do_probe_wc(): Adding WC-NIC vid = 0x8086 did = 0x15c2
Total NICs found: 6
x550em_kr rev 0x11 10 Gigabit Ethernet, index 00 MAC: 00a0.c900.0000
en_vtun rev00 Backplane Ext-Mgmt Interface @ index 02 MAC: 5c5a.c7b8.f781
en_vtun rev00 Backplane Tap Interface @ index 03 MAC: 0000.0100.0001
en_vtun rev00 Backplane Control Interface @ index 05 MAC: 0000.0300.0101
WARNING: Attribute already exists in the dictionary.
License mode file was not found. Assuming this is the initial bootup. Setting the license mode to Smart Licensing.
INFO: Unable to read firewall mode from flash
Writing default firewall mode (single) to flash
INFO: Unable to read cluster interface-mode from flash
Writing default mode "None" to flash
*** Intel QAT Crypto on-board accelerator detected
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
Encryption hardware device : Cisco FP Crypto on-board accelerator (revision 0x11)
Driver version : 4.1.0
-
****************************** Warning *******************************
This product contains cryptographic features and is
subject to United States and local country laws
governing, import, export, transfer, and use.
Delivery of Cisco cryptographic products does not
imply third-party authority to import, export,
distribute, or use encryption. Importers, exporters,
distributors and users are responsible for compliance
with U.S. and local country laws. By using this
product you agree to comply with applicable laws and
regulations. If you are unable to comply with U.S.
and local laws, return the enclosed items immediately.
A summary of U.S. laws governing Cisco cryptographic
products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by
sending email to export@cisco.com.
******************************* Warning *******************************
Copyright (c) 1996-2017 by Cisco Systems, Inc.
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Error No such device in set_linux_mac_address: Failed to assign MAC address for br0
Reading from flash...
!
Cryptochecksum (changed): 6929aede 6646bb60 e7c2f077 d48e4bc9
INFO: Power-On Self-Test in process.
.......................................................................
INFO: Power-On Self-Test complete.
INFO: Starting SW-DRBG health test...
INFO: SW-DRBG health test passed.
User enable_1 logged in to firepower
Logins over the last 1 days: 1.
Failed logins since the last login: 0.
Type help o '?' for a list of available commands.
firepower> \
You must change the password for 'admin' to continue.
Sep 7 03:02:54 firepower port-manager : Alert: Ethernet1/1 link changed to DOWN
Enter new
password:
Confirm new password:
You must configure the network to continue.
Unable To Read Running Config: Unable to get current network information:SF::Util::getApplianceUUID: NO APPLIANCE UUID DEFINED......INVALID STATE at /usr/local/sf/lib/perl/5.10.1/SF/NetworkConf.pm line 81.
Printing stack trace:
called from /ngfw/usr/lib/perl5/site_perl/5.10.1/Error.pm (150)
called from /ngfw/usr/lib/perl5/site_perl/5.10.1/Error.pm (396)
called from /usr/local/sf/lib/perl/5.10.1/SF/NetworkConf.pm (82)
called from /usr/local/sf/bin/cli_firstboot (219)
called from /usr/local/sf/bin/cli_firstboot (1085)
I'm still
unable to access FDM (HTTPS) even though i can ping the Management IP.
C:\Windows\System32>ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 192.168.45.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
C:\Windows\System32>ping 192.168.45.45 // DEFAULT MANAGEMENT IP ADDRESS
Pinging 192.168.45.45 with 32 bytes of data:
Reply from 192.168.45.45: bytes=32 time<1ms TTL=64
Reply from 192.168.45.45: bytes=32 time=1ms TTL=64
Reply from 192.168.45.45: bytes=32 time=1ms TTL=64
Reply from 192.168.45.45: bytes=32 time=1ms TTL=64
Ping statistics for 192.168.45.45:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
You can access the FTD CLI using the connect ftd command and to begin the initial configuration setup wizard.
firepower# connect ftd
System initialization in progress. Please stand by.
You must configure the network to continue.
You must configure at least one of IPv4 or IPv6.
Do you want to configure IPv4? (y/n) [y]: < HIT ENTER TO ACCEPT DEFAULT OPTION>
Do you want to configure IPv6? (y/n) [n]: < HIT ENTER TO ACCEPT DEFAULT OPTION>
Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]: < HIT ENTER TO ACCEPT DEFAULT OPTION>
Enter an IPv4 address for the management interface [192.168.45.45]: < HIT ENTER TO ACCEPT DEFAULT OPTION>
Enter an IPv4 netmask for the management interface [255.255.255.0]: < HIT ENTER TO ACCEPT DEFAULT OPTION>
Enter the IPv4 default gateway for the management interface [data-interfaces]: 192.168.45.1
Enter a fully qualified hostname for this system [firepower]: fpr1010-ftd-lab
Enter a comma-separated list of DNS servers or 'none' [208.67.222.222,208.67.220.220]: < HIT ENTER TO ACCEPT DEFAULT OPTION>
Enter a comma-separated list of search domains or 'none' []: lab.com
If your networking information has changed, you will need to reconnect.
Setting DNS servers: 208.67.222.222 208.67.220.220
Setting DNS domains:lab.com
Setting hostname as fpr1010-ftd-lab
DHCP server is enabled with pool: 192.168.45.46-192.168.45.254. You may disable with configure network ipv4 dhcp-server-disable
Setting static IPv4: 192.168.45.45 netmask: 255.255.255.0 gateway: 192.168.45.1 on management0
Updating routing tables, please wait...
All configurations applied to the system. Took 3 Seconds.
Saving a copy of running network configuration to local disk.
For HTTP Proxy configuration, run 'configure network http-proxy'
Sep 7 03:11:22 fpr1010-ftd-lab port-manager : Alert: Ethernet1/1 link changed to UP
Manage the device locally? (yes/no) [yes]: < HIT ENTER TO ACCEPT DEFAULT OPTION> // FOR FDM ACCESS INSTEAD OF FMC
Configuring firewall mode to routed
Update policy deployment information
- add device configuration
Successfully performed firstboot initial configuration steps for Firepower Device Manager for Firepower Threat Defense.
> show managers
Managed locally.
> show interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Ethernet1/1 116.87.123.45 YES DHCP up up // ISP WAN
Ethernet1/2 192.168.1.1 YES unset down down
Ethernet1/3 192.168.1.1 YES unset down down
Ethernet1/4 192.168.1.1 YES unset down down
Ethernet1/5 192.168.1.1 YES unset down down
Ethernet1/6 192.168.1.1 YES unset down down
Ethernet1/7 192.168.1.1 YES unset down down
Ethernet1/8 192.168.1.1 YES unset down down
Internal-Control1/1 unassigned YES unset up up
Internal-Data1/1 169.254.1.1 YES unset up up
Internal-Data1/2 unassigned YES unset up up
Management1/1 unassigned YES unset up up
BVI1 192.168.1.1 YES manual up up
> show route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 116.87.123.45 to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [1/0] via 116.87.123.45, outside // OBTAINED VIA DHCP FROM ISP
C 116.87.192.0 255.255.192.0 is directly connected, outside
L 116.87.195.156 255.255.255.255 is directly connected, outside
C 192.168.1.0 255.255.255.0 is directly connected, inside
L 192.168.1.1 255.255.255.255 is directly connected, inside
> configure password // CHANGE THE PASSWORD FOR "admin" ACCOUNT
Enter current password:
Enter new password:
Confirm new password:
Password Update successful.
It took around 5 mins to access FDM after the FTD had fully initialized. Just accept the self-signed certificate on the web browser to continue.
Login using the changed password for admin account.
You first need to configure the Internet Connection (WAN IP address on Ethernet1/1).
Configure IPv4 > Using DHCP (default). I
chose DHCP since I get a Dynamic IP address from my ISP.
IPv6 is disabled/Off by default.
I left the Management Interface settings since these were configured during the initial setup wizard. Click Next.
Select a Time Zone: UTC+08:00 Asia/Singapore > select NTP Time Server: Default NTP Servers (Cisco/Sourcefire public NTP servers) > click Next.
I'll skip the Register
the FTD device with Cisco Smart Software Manager for now.
Select Start 90-day evaluation period without registration > click Finish.
This would allow me to test all the FTD Smart License features: Threat, Malware and URL.
You can reconfigure the inside interface IP address (default is 192.168.1.0/24) and other system settings in the next steps.
