FTD · BY THE SCREENS

FTD-style by GUI: a standalone firewall from the setup wizard

A new firewall for a small office, set up the way the device’s own manager expects: with the Device Setup wizard, then its pages. Select FTD1 and press Open Device Manager. Every page shows the commands it sends before it sends them, and the console under the pages takes the same lines. PC1 is on the inside, and R1 is the ISP router (198.51.100.1 is behind it).

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Management address: the first page asks for it (as at the firewall’s first boot). Address 10.0.0.2, mask 255.255.255.0, Apply, Send.
Device Setup, step 1, Connect firewall to Internet: outside on Gi0/1, Manual, 203.0.113.1 / 255.255.255.0, gateway 203.0.113.2; inside on Gi0/0, 192.168.1.1 / 255.255.255.0, DHCP server on; Firewall Hostname edge1. Next, Send. Step 2, Time Setting: Time Zone UTC+05:00, Next, Send. Step 3: an evaluation licence, Finish, Finish.
PC1 takes an address from FTD1’s DHCP server (on PC1: ip dhcp), and reaches 198.51.100.1.
Policies › Access Control: Create Access Rule NO-TELNET: block, from inside_zone to outside_zone, tcp port 23, Place before Inside_Outside_Rule. Apply, Send, then Deploy › Preview and deploy › Deploy.

Start this lab

Before you start

Read each preview before you send: it is exactly what the console would take, as fdm lines. Setup’s initial rule trusts inside to outside, so put the block rule above it. The wizard runs once; after it, every setting has its own page under Device. The model solution shows the same work as console lines.

Concept

The screens and the console do the same thing

A manager’s screens are forms that produce configuration lines. Here every screen shows those lines before it sends them, and the console takes the same lines, so either way gives the same result. A managed firewall’s own management address and manager stay on its console, because the manager reaches it through them.

Concept

A firewall needs names and the right time

A firewall resolves names for itself over its management interface (NTP server names, updates, licensing) and, separately, on its data interfaces. It keeps time by NTP, also over the management interface. Licences, certificates and log times depend on the clock. The defaults point to the Internet, so a site without it needs its own servers.