FTD · BY THE SCREENS

FTD-style by GUI: register and build a policy in FTD Manager

The firewall side is ready: FTD1 has its management address and names MGR1 as its manager (configure manager add, on its console, because a managed firewall has no screens). Everything else happens in FTD Manager: select MGR1 and press Open FTD Manager. Each screen shows the commands it sends, and the console under the screens takes the same lines.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Devices › Device Management › Add › Device: step 1 Registration key and Basic, Next; step 2 Hostname or IP address 10.0.0.2, Display name FTD1, Registration key LABKEY, Next; step 3 Access control policy: + Create a new policy ACP1 (Block all traffic), Add device. Device Management lists FTD1.
Devices › Interfaces and Zones: Add a security zone INSIDE and OUTSIDE. Device Management › FTD1 › Interfaces: Edit Gi0/0 (Name inside, Security Zone INSIDE, Enabled, IPv4 192.168.1.1/24), OK; Gi0/1 (outside, OUTSIDE, 203.0.113.1/24), OK; Save. FTD1 › Routing: a default route on outside via 203.0.113.2.
Objects › Object Management: Add a network object LAN 192.168.1.0/24. Policies › Access Control › ACP1: Add Rule INSIDE-OUT (allow, INSIDE to OUTSIDE, icmp), Apply. Devices › NAT: Create NAT1; Hide a network (PAT) HIDE-LAN for LAN, INSIDE to OUTSIDE. FTD1 › Device: Assign policies ACP1 and NAT1.
Deploy (top right): tick FTD1, read the preview, Deploy. PC1 reaches 198.51.100.1.

Start this lab

Before you start

An interface change is saved only when you press Save on the Interfaces tab (the unsaved banner says so). Nothing reaches the firewall until you deploy: the Deploy button counts what is waiting. The model solution shows the same work as console lines.

Concept

The screens and the console do the same thing

A manager’s screens are forms that produce configuration lines. Here every screen shows those lines before it sends them, and the console takes the same lines, so either way gives the same result. A managed firewall’s own management address and manager stay on its console, because the manager reaches it through them.

Concept

A managed firewall takes its policy from a manager

An FTD-style firewall has a console for showing and testing, and it refuses configuration. Its policy lives on a manager and arrives by deployment. Before that, the two must register over a separate management network: each needs an address, the firewall names its manager and a key, and the manager adds the device with the same key.