I85PREP
⌘ K
Cisco 300-710 SNCF study materials
Cisco 300-710 SNCF study resources

Cisco 300-710 SNCF: Deployment and Initial Configuration

Cisco 300-710 SNCF · Work through your exam, one topic at a time.

All guide sections

Deployment and Initial Configuration

Domain 1 (Deployment and Initial Configuration) tests how you choose a manager for a Firepower Threat Defense (FTD) device, register it, license it, and select a deployment mode before any policy exists. Questions are scenario-based: a device that never appears in FMC, a feature missing in transparent mode, an entitlement that is absent.

Management plane

  • An FTD is managed by exactly one manager at a time: the on-box Firepower Device Manager (FDM), an FMC, or a cloud-delivered manager. Switching is a re-registration, not a toggle.
  • Registration starts on the device CLI: configure manager add <ip-or-host> <registration-key> [nat-id]. The FMC administrator types the same key in Add Device. A key mismatch leaves the device pending and the tunnel never forms.
  • FTD dials FMC over TCP 8305 (sftunnel) from the management interface; that path must be routed, and NTP must agree on both sides.
  • Behind NAT use configure manager add DONTRESOLVE <key> <nat-id>; in FMC you then enter the NAT ID in the device address field.

Deployment mode

  • Routed: per-interface IPs, static/dynamic routing, NAT, site-to-site and remote-access VPN.
  • Transparent: bridged data interfaces with no IP addressing; no NAT, no dynamic routing, no remote-access VPN - a classic exam trap.
  • Inline sets and passive interfaces support IPS-only (no firewall) deployments; inline sets can fail open or fail closed.
  • HA pairs are active/standby with stateful failover and must match in model, interface layout, and licensing; clustering is available on higher-end appliances through FXOS.

Licensing

  • Smart Licensing: FTD requests entitlements from FMC; FMC is registered to CSSM directly or through an on-premises Smart Software Manager. Entitlements are Essentials, Threat, URL Filtering, and Malware; unentitled devices fall back to evaluation.

Worked example

A branch FTD at 10.10.10.5 sits behind NAT and FMC is at 203.0.113.10 with no inbound path. Run configure manager add DONTRESOLVE <key> branch-ftd-01 on the FTD; in FMC add the device with the address field set to branch-ftd-01 and the same key. FMC stores that identifier, the FTD opens the tunnel outbound, and you deploy the initial policy.

Traps

  • Changing FMC's IP or hostname breaks every registered device.
  • Expecting NAT or dynamic routing in transparent mode.
  • Registering with a stale key and blaming firewall rules.
  • Forgetting the first deploy: registration alone pushes no policy.