Cisco CBRFIR (300-215) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FTD management options

Cisco Firepower Threat Defense can be managed locally via Firepower Device Manager (FDM) or centrally via Firepower Management Center (FMC) or Cisco Defense Orchestrator (CDO). FMC supports multi-device management and advanced policies.

Security zones purpose

Security zones group interfaces with similar security requirements, such as inside, outside, and DMZ. Access control rules match on zone pairs, and traffic not matching any zone pair is dropped by the default action.

FTD interface types

FTD supports routed (L3), transparent (L2 bridge), inline (IPS-only, fail-closed/open), and passive (IDS-only) interfaces. Routed and transparent interfaces support access control; inline and passive are for intrusion detection/prevention without routing.

FTD high availability

FTD supports Active/Standby failover for redundancy and Active/Active for limited scenarios like VPN. Clustering (up to 16 nodes) provides scalability. Failover requires a dedicated failover link and state synchronization.

Smart Licensing feature tiers

Cisco Secure Firewall uses Smart Licensing with tiers: Essentials (firewall, routing, VPN, clustering), Advantage (IPS, URL filtering, malware, app control), and Threat (Security Intelligence/Umbrella). Feature availability depends on the license tier.

NAT evaluation order

On FTD, Manual NAT (twice NAT) rules are evaluated before Auto NAT (network object NAT). Within each section, rules are processed top-down. NAT is separate from access control and can affect which addresses access rules see.

Default action in ACP

The default action in an FTD access control policy applies to traffic not matching any rule. Options include Block all traffic (default), Block with reset, Allow, or Intrusion Prevention. Logging can be enabled for the default action.

FTD registration to FMC

To register FTD to FMC, run 'configure manager add <FMC_IP> <registration_key>' on FTD, then add the device in FMC with the same key. Ensure management IP reachability, NTP synchronization, and compatible software versions.

FMC initial setup

FMC initial configuration uses a CLI setup wizard to set hostname, IP, DNS, NTP, and passwords. After setup, access the web UI via HTTPS. FMC requires NTP for proper operation and certificate validation.

FTD transparent mode

In transparent mode, FTD acts as a Layer 2 bridge using a bridge group and Bridge Virtual Interface (BVI). Interfaces in the bridge group do not have IP addresses; the BVI holds the management IP for the bridge group.

Virtual routers on FTD

Virtual routers allow multiple independent routing tables on a single FTD device (supported in FTD 6.5+). Each virtual router can have its own interfaces, static and dynamic routes, and is configured per device in FMC.

NTP importance on FTD

NTP synchronization is critical for FTD and FMC for certificate validation, logging accuracy, HA, and policy deployment. Time zone mismatches between FMC and FTD can cause deployment issues. Verify with 'show ntp status'.

FMC backup and restore

FMC backup can be performed via CLI or GUI and includes configuration and optionally events. Restore requires the same software version and platform. FTD backups are initiated from FMC and include device configuration.

Prefilter policy rules

Prefilter rules are evaluated before access control rules. Tunnel rules analyze tunneled traffic (e.g., GRE), and Fastpath rules bypass inspection for trusted traffic. Prefilter can reduce load by fast-pathing trusted flows.

Access control rule actions

Access control rule actions include Allow, Block, Trust (allow without deep inspection), Monitor (allow with logging only), and Interactive Block (block with user override). The first matching rule determines the action.

Application control with OpenAppID

Application control uses OpenAppID detectors to identify applications regardless of port. Rules can match applications by risk, category, and tags. Application filters dynamically update as new detectors are added.

URL filtering license

URL filtering requires an Advantage license and a URL category set from Cisco Talos or custom categories. URL categories are used in access control rules. SSL decryption is often needed to see full URLs in encrypted traffic.

Identity policy integration

Identity policies integrate with Microsoft AD, LDAP, or Cisco ISE for user-based access control. Methods include passive authentication (AD logging), active authentication (captive portal), and ISE pxGrid. User identity is matched in access control rules.

Intrusion policy base policies

Cisco Talos provides recommended base intrusion policies: Balanced Security and Connectivity, Security Over Connectivity, Connectivity Over Security, No Rules Active, and Maximum Detection. These can be tuned with rule overrides.

Intrusion rule actions

Intrusion rule actions include Alert (log only), Drop (block and log), Reject (block and send reset/ICMP unreachable), Pass (ignore), and Generate Events. Rule overrides can change actions or disable rules.

Intrusion variables

Variables define network segments for intrusion inspection, such as HOME_NET and EXTERNAL_NET. Incorrect variables cause false positives or negatives. Variable sets are configured in FMC under Objects > Intrusion Rules > Variable Sets.

File policy actions

File policy actions include Detect Files (log only), Block Files (block malware), Malware Cloud Lookup (query Talos), and Block Malware. File policies require a Malware license and can submit files for dynamic analysis.

SSL decryption for inspection

SSL decryption is often required for intrusion and file inspection of encrypted traffic. SSL policy rules determine which traffic to decrypt based on URL category, network, or user. Undecryptable traffic can be blocked or allowed.

Security Intelligence feeds

Security Intelligence feeds block known malicious IPs, URLs, and domains from Talos and custom lists. Configured in FMC access control policy, SI is evaluated before access control rules and provides low-latency blocking.

Packet tracer on FTD

The 'packet-tracer' command on FTD (Lina engine) simulates a packet's flow through access control, NAT, and routing. It shows each policy check and the final result, aiding troubleshooting of rule and NAT issues.

FMC health monitor

FMC health monitor (System > Health > Monitor) checks device health, including CPU, memory, disk, interface status, and policy deployment status. Alerts and thresholds can be configured for proactive monitoring.

Policy deployment failure causes

Common deployment failures include configuration conflicts (overlapping networks), missing interfaces or zones, license issues, and version mismatches. Check FMC deployment error details and FTD 'show policy-deployment-status'.

Packet capture on FTD

FTD supports packet capture via the Lina 'capture' command with an access-list and interface. FMC also provides a packet capture tool (Devices > Device Management > Packet Capture) for troubleshooting traffic flows.

Connection events analysis

FMC collects connection events that can be filtered by time, IP, port, and action in Analysis > Connections > Events. Events can be exported to CSV or sent to external SIEM via syslog or eStreamer.

FTD performance tuning

Performance tuning includes using fastpath for trusted traffic, tuning intrusion policies, disabling unnecessary logging, and ensuring adequate resources for virtual platforms. Monitor CPU and memory via FMC health monitor.

HA failover status check

On FTD, use 'show failover' to check high-availability status, including active/standby roles, failover state, and interface status. Failover issues often stem from link failures or state synchronization problems.

show tech-support usage

'show tech-support' on FTD collects comprehensive diagnostic information for Cisco TAC cases, including configuration, logs, and system status. It is useful for troubleshooting complex issues.