Cisco 300-710 SNCF cheat sheet

Management Center (FMC) is the central manager; managed devices are FTD (threat defense) or classic devices (ASA with FirePOWER, NGIPSv). FMC manages policy, not traffic - traffic flows through the managed device, not the FMC.

FTD deployment modes: routed (interface with IP, participates in routing), transparent (bridge group, no IP on data interfaces, inline with optional management IP), and inline set (IPS-only, no IP addressing, fail-open or fail-closed).

Device registration: on FTD run 'configure manager add '; FMC then adds the device by IP and matching key. NAT between FTD and FMC requires 'configure manager add DONTRESOLVE ' and FMC-side NAT ID.

Initial FTD setup via CLI console wizard sets management IP, gateway, DNS, NTP, and admin password; management interface must be reachable from FMC. FMC itself is deployed as a VMware/KVM/AWS virtual appliance or the physical FMC 1600/2600/4600 series.

High availability: FTD supports HA pairs (active/standby) with stateful failover and separate failover link; FMC supports FMC high availability in active/standby pairs requiring identical versions and a dedicated failover link.

Licensing: Smart Licensing (registration token or specific license reservation) delivers Essentials, IPS, Malware (AMP), URL Filtering, and Threat (Cisco SecureX/Umbrella) entitlements. Malware and URL licenses require the corresponding base.

Version compatibility matters: FMC version must be equal to or higher than managed FTD version, and the FTD must be within the supported upgrade path. Check the Cisco compatibility matrix before adding a device.

Sizing: FMC model or virtual spec is chosen by number of managed devices, event rate (EPS), and flows; undersized FMC causes event loss and slow UI. FTD throughput depends on platform (e.g., 1010, 1120, 2130, 4110) and enabled features (IPS, malware, SSL decryption).

Policy hierarchy: Access Control Policy (ACP) is the top-level policy and references - in order - Security Intelligence (SI) feeds, SSL policy, Identity policy, prefilter policy, and per-rule intrusion/malware/file policies.

ACP rule evaluation is top-down, first match wins; rules can be Monitor, Trust, Block, Allow, or Interactive Block, and each rule has an action plus optional inspection (intrusion, file, malware) policies.

Default action is at the bottom of the ACP and applies to traffic matching no rule; it is typically Intrusion Prevention or Access Control: Block All. The default action cannot be reordered above rules.

Objects are reusable: network/host/range objects, port objects, URL objects, geolocation, application filters (with risk, business relevance, category), and variable sets. Editing an object updates every policy referencing it.

Prefilter policy runs before the ACP for tunnel/SSL-decapsulated traffic and fastpath; prefilter rules can Fastpath (bypass further inspection) or send traffic to the ACP or tunnel rules.

Security Intelligence blocks by IP, DNS, URL, or SHA-256 reputation lists (TID, custom lists) before the ACP; SI objects are global and per-policy allow/block lists override global feed actions.

Policy apply workflow: save, then Deploy (push) to devices. Pending changes are shown per device; deployment can be scoped to specific devices and includes policy, object, and platform settings deltas.

Health and tasks: FMC Health Monitor shows device status (CPU, disk, interface, policy status); Task Status shows deploy, backup, and upgrade jobs. Scheduled backups and remote storage are configured under System > Tools.

Rule order determines outcome; place specific rules (host, port, application) above broad rules (any/any). Trust rules bypass all further inspection and are the fastest path.

Application control uses Snort/OpenAppID signatures; application filters can combine category, risk (Very High–Very Low), business relevance, and tags. Application detection requires the traffic to be inspected (not trusted).

URL filtering requires the URL Filtering license; URL categories are matched by reputation and category, and can be used in ACP rules or in the SI URL list. HTTPS category matching requires SSL decryption or the category is derived from the SNI/certificate only.

User/Identity control requires an Identity policy (passive AD/LDAP, ISE, or captive portal) and a realm; ACP rules can then match users and groups. Passive identity needs domain controller eventing.

SSL policy controls decryption: Do Not Decrypt (default), Decrypt (with certificate re-sign or known-key), and Decrypt with a CA certificate. Undecryptable traffic (pinned, unsupported ciphers) can be blocked or allowed.

Interactive Block shows a customizable block page to HTTP users; Block drops silently. Both can be combined with a 'Block with reset' option for TCP.

QoS and rate limiting are configured in the ACP per rule (rate limit) or via a QoS policy attached to the ACP; rate limits apply to matched flows, not individual packets.

Geolocation and network objects can be used in rules; a rule can match source/destination country. Traffic from a blocked country is dropped at the rule, not at SI, unless configured there.

Intrusion policy = set of Snort rules with a base policy (Balanced Security and Connectivity, Security over Connectivity, Connectivity over Security, No Rules Active) and rule-state overrides (Drop, Alert, Disabled, Generate Events).

Variable sets define $HOME_NET, $EXTERNAL_NET, and port variables; incorrect $HOME_NET causes false positives or missed detections. Variables are referenced by rules and can be overridden per policy.

Rule actions: Alert (IDS) and Drop (IPS). A rule set to Drop in an inline deployment blocks the packet; in a passive/IDS deployment Drop behaves as Alert.

Thresholding and suppression: event filters (suppress, threshold, rate-based) reduce event volume; rule comments and SNORT rules can be tuned per policy.

File policy inspects files for malware (AMP) using Spero/ClamAV and the cloud lookup (Talos) with file types limited by the file policy; Malware license is required.

Malware protection modes: Detect Files (alert only), Block Files (block malicious), and Block Malware (block malicious and unknown). File rules can also block by file type or size.

File and malware inspection requires the file to pass through an ACP rule with a File Policy attached; Trust rules and Fastpath skip file inspection.

SSL decryption is a prerequisite for inspecting encrypted malware and intrusions; without decryption, only metadata (SNI, certificate) is visible.

Tuning workflow: enable IPS in Detect mode, review events in the FMC, then convert to Block for confirmed true positives; use rule-level overrides rather than disabling whole categories.

Check device registration and connectivity first: FMC > Devices > Device Management shows registration status; CLI 'show managers' on FTD confirms the manager and registration state.

Policy deployment failures are usually caused by unreachable devices, version mismatch, or object references. Review Task Status detail and the deployment log; a failed deploy leaves the previous policy active.

Event troubleshooting: verify the ACP rule action (Trust/Monitor), the intrusion policy attachment, and the rule's logging configuration. Events appear under Analysis > Intrusions / Malware / Connections.

Connection events show the matched ACP rule, action, and reason; use them to confirm whether a flow was allowed, blocked, or trusted, and whether decryption occurred.

Packet capture and troubleshooting tools: FTD CLI 'capture-traffic', FMC packet capture (troubleshooting), and 'show conn' / 'show traffic' on the device help isolate drops.

Health Monitor alerts: disk full, CPU high, interface down, and policy out of date. Disk full on FMC stops event logging; check System > Health > Monitor and clean up old events.

NTP and time sync are required for correct event correlation and certificate validation; verify NTP status on both FMC and FTD.

Upgrade verification: check the compatibility matrix, run the pre-upgrade readiness check, and verify the FMC and FTD versions match the plan. Rollback requires a backup.

Common causes of missing events: rule set to Trust, logging disabled, event rate exceeded (FMC undersized), or Security Intelligence blocking before the ACP rule (SI events appear separately).