Cisco CBRFIR (300-215) cheat sheet

Cisco Secure Firewall (formerly Firepower) platforms: hardware (Firepower 1000/2100/4100/9300), virtual (FPRv, ASAv), and cloud-native (Secure Firewall Cloud Native). Management options: on-box Firepower Device Manager (FDM) for small deployments, centralized Firepower Management Center (FMC) for multi-device, and cloud-delivered Cisco Defense Orchestrator (CDO).

The data plane uses the Snort 3 (or Snort 2) intrusion prevention engine; the control plane runs the Lina (ASA-like) engine for access control, NAT, VPN, and routing. Firepower Threat Defense (FTD) combines both; ASA with FirePOWER Services is the legacy option.

Interface types on FTD: routed (L3 with IP), transparent (L2 bridge with BVI), inline (fail-closed or fail-open tap for IPS-only), passive (IDS-only), and switched (rare). Only routed and transparent interfaces support access control; inline/passive are for intrusion detection/prevention without routing.

Security zones group interfaces with similar security requirements (e.g., inside, outside, dmz). Access control rules match on zone pairs; traffic not matching any zone pair is dropped by the default action. Zones are mandatory for FTD policy application.

Firepower Threat Defense high availability: Active/Standby failover (two appliances, synchronized configuration and state) and Active/Active (limited, mainly for VPN). Clustering (up to 16 nodes) provides scalability on hardware and virtual platforms; clustering requires a cluster control link and a cluster bootstrap configuration.

NAT on FTD is configured as policy objects (Network Object NAT or Manual NAT) with order of evaluation: Manual NAT (twice NAT) before Auto NAT; within each, rules are evaluated top-down. NAT is separate from access control policy; access rules see pre- or post-NAT addresses depending on platform and rule settings.

Default actions in FTD access control policy: 'Block all traffic' (default), 'Block all traffic with reset', 'Allow all traffic' (not recommended), or 'Intrusion Prevention' (allow and inspect). The default action applies to traffic not matching any rule and can be logged.

Licensing: Cisco Smart Licensing (registration to Smart Software Manager or satellite). Feature licenses: Essentials (firewall, routing, site-to-site VPN, clustering), Advantage (IPS, URL filtering, malware/AMP, application control), and Threat (Security Intelligence/Umbrella). Without Advantage, many NGIPS features are unavailable.

Deployment modes: FTD can be managed locally (FDM) or centrally (FMC). FMC can manage FTD, ASA with FirePOWER, and NGIPSv; it cannot manage classic ASA (without FirePOWER) or Meraki MX. FMC high availability (primary/secondary) and FMC clustering are supported for scale.

Initial FTD setup via CLI: run the setup wizard (or configure manually) to set management IP, gateway, DNS, NTP, and registration key. Then register to FMC (configure manager add <FMC_IP> ) or complete FDM initial setup via browser (https://).

FMC initial configuration: run the setup wizard for hostname, IP, DNS, NTP, and passwords; then access the web UI (https://). Add devices via Devices > Device Management > Add Device, providing device IP, registration key, and access policy selection.

Device registration prerequisites: management IP reachability, correct registration key, NTP synchronization (within 5 minutes recommended), and matching FMC/FTD versions (or supported upgrade path). If registration fails, check key, connectivity, and NTP.

Interface configuration on FTD: assign IP addresses, set security zones, enable management access (HTTPS/SSH) on the management interface only. Data interfaces need IP and zone before access control rules can apply. For transparent mode, configure bridge group and BVI.

Routing: static routes, ECMP (up to 8 equal-cost paths), and dynamic routing (OSPF, BGP, EIGRP) supported on FTD. For FMC-managed devices, routing is configured per device in Devices > Device Management > Routing tab. Virtual routers allow multiple routing tables (FTD 6.5+).

NTP is critical: certificates, logging, and HA require accurate time. Configure NTP servers on FMC and FTD; use 'show ntp status' to verify synchronization. Time zone differences between FMC and FTD can cause policy deployment issues.

Licensing registration: after adding a device to FMC, register Smart Licensing (or use a satellite). Check license status in FMC System > Licenses > Smart Licenses. Ensure the correct feature licenses (Essentials/Advantage/Threat) are enabled for the intended policies.

Backup and restore: FMC backup includes configuration and events (optional); FTD backup via FMC (Devices > Device Management > Backup) or CLI. Restore requires matching software version and platform. For FMC, use 'backup' and 'restore' commands in CLI.

Upgrades: FMC and FTD should be upgraded in a supported order (FMC first, then FTD). Use the Cisco Software Upgrade Wizard or CLI. Pre-upgrade checklist: read release notes, verify compatibility, backup configuration, and ensure sufficient disk space. For HA pairs, upgrade standby first, then switch roles.

Access control policy structure: prefilter policy (fast-path/tunnel rules) → access control rules (top-down) → default action. Prefilter rules are evaluated before access control and can bypass inspection (fast-path) or handle tunneled traffic (e.g., GRE, IP-in-IP).

Prefilter policy: two types of rules - Tunnel and Analyze (for tunneled traffic) and Fastpath (bypass inspection). Fastpath rules can match on source/destination zone, network, port, and application. Use fastpath for trusted traffic to reduce load; use tunnel rules to inspect inner traffic.

Access control rule components: source/destination zones, networks, ports, applications (Snort/OpenAppID), users (identity policy), URL categories (URL filtering), and time range. Actions: Allow, Block, Trust (allow without further inspection), Monitor (allow with logging only), and Interactive Block (block with user override).

Rule order matters: first match wins. Place specific rules above general ones. Use the rule search and grouping features. The default action (block or allow) applies to unmatched traffic; logging can be enabled per rule and on default action.

Application control requires the Snort engine and application detection (OpenAppID). Applications can be filtered by risk, business relevance, category, and tags. Application filters dynamically update as new app detectors are added.

URL filtering requires a URL Filtering license (part of Advantage) and a URL category set (from Cisco Talos or custom). URL categories can be used in access control rules; uncategorized URLs can be blocked or allowed. SSL decryption is often needed to see full URL.

Identity policy: integrate with Microsoft AD, LDAP, or Cisco ISE for user-based rules. Methods include passive authentication (AD logging), active authentication (captive portal), and ISE pxGrid. User identity is matched in access control rules via realm and user/group.

Intrusion policy can be attached per access control rule (Allow action) or as the default action. If no intrusion policy is attached, traffic is not inspected for intrusions. Use variable sets to define home networks and ports for accurate inspection.

Logging: access control rules can log at beginning or end of connection, with events sent to FMC. Use 'log at end' for connection summaries; 'log at beginning' for immediate visibility. Syslog can be configured for external logging. Events are stored in the FMC database and can be analyzed via dashboards.

Intrusion policies: Snort 3 (or Snort 2) rule sets. Cisco Talos provides recommended policies: Balanced Security and Connectivity, Security Over Connectivity, Connectivity Over Security, No Rules Active, and Maximum Detection. These are base policies that can be tuned.

Rule actions in intrusion policy: Alert, Drop, Reject, Pass, and Generate Events. Drop blocks the packet and logs; Reject blocks and sends TCP reset or ICMP unreachable. Rules can be grouped by category, class, or SID. Use rule overrides to change action or disable rules.

Variables: define HOME_NET (protected networks), EXTERNAL_NET, HTTP_PORTS, etc. Incorrect variables cause false positives/negatives. In FMC, edit variable sets under Objects > Intrusion Rules > Variable Sets. Default variables may need adjustment for your network.

Performance: intrusion inspection can be tuned via rule suppression, event filtering, and performance profiles. Use 'show snort statistics' on FTD to monitor. Snort 3 uses a multi-threaded architecture; Snort 2 is single-threaded per instance. Consider fastpath for high-bandwidth trusted traffic.

Malware and file policy: file policy inspects files for malware (AMP), file reputation (Talos), and file type detection. It requires a Malware license (part of Advantage/Threat). File rules can block malware, block files with poor reputation, or submit files for dynamic analysis.

File policy actions: Detect Files (log only), Block Files (block malware), Malware Cloud Lookup (query Talos), and Block Malware. File types include PDF, PE, Office, archive, etc. Dynamic analysis submits files to Cisco Threat Grid (cloud) for sandboxing.

SSL decryption is often required for intrusion and file inspection of encrypted traffic. Configure SSL policy with rules to decrypt (with certificate authority) or not. Decryption can be based on URL category, network, or user. Undecryptable traffic can be blocked or allowed.

Security Intelligence (SI) feeds: block lists for IPs, URLs, and domains from Talos (known bad) and custom lists. Configure in FMC Policies > Access Control > Security Intelligence. SI is evaluated before access control rules; use it to block known malicious traffic with minimal performance impact.

Event analysis: FMC provides intrusion events, malware events, file events, and connection events. Use the context menu to drill down, view packet data, and create rule overrides. Thresholding and suppression can reduce event noise. Alerts can be sent via syslog, SNMP, or email.

Troubleshooting tools on FTD CLI: 'show interface', 'show route', 'show conn' (Lina connections), 'show snort statistics', 'show perfmon', 'show policy-config', 'show access-control-config', and 'show nat'. Use 'packet-tracer' on FTD (Lina) to simulate packet flow through access control and NAT.

FMC troubleshooting: use the health monitor (System > Health > Monitor) to check device status, policy deployment, and license status. The Tasks page shows deployment status and errors. Use 'show policy-deployment-status' on FTD CLI to check policy application.

Deployment failures: common causes include configuration conflicts (e.g., overlapping networks), missing interface/zone, license issues, and version mismatch. Check the deployment error details in FMC; use 'show policy-deployment-status' and review 'show running-config' on FTD.

Packet capture: on FTD, use 'capture' command (Lina) with access-list and interface; on FMC, use the packet capture tool (Devices > Device Management > Packet Capture) for troubleshooting. For Snort-level captures, use 'show capture' and 'show snort capture' (if available).

Logging and events: FMC collects connection, intrusion, malware, and file events. Use the Analysis > Connections > Events page to filter by time, IP, port, and action. Export events to CSV. Syslog can be configured for external SIEM; eStreamer for custom integrations.

Health monitoring: FMC health monitor checks device health (CPU, memory, disk, interface status, policy deployment). Configure alerts and thresholds. Use 'show health-monitor' on FTD CLI. SNMP traps can be sent to external monitoring.

Backup and recovery: FMC backup via CLI ('backup' command) or GUI (System > Tools > Backup/Restore). FTD backup via FMC (Devices > Device Management > Backup). Restore requires same version and platform. For disaster recovery, keep off-box backups.

Performance tuning: monitor CPU and memory via FMC health monitor or 'show cpu' and 'show memory' on FTD. Use fastpath for high-throughput trusted traffic, tune intrusion policies, and disable unnecessary logging. For virtual platforms, ensure adequate resources (vCPU, RAM, disk).

Common issues: registration failure (check key, NTP, connectivity), policy deployment failure (check conflicts, licenses), HA failover (check failover status with 'show failover' on FTD), and high CPU (check Snort statistics, rule count, and traffic patterns). Use 'show tech-support' for TAC cases.