I85PREP
⌘ K
Cisco CBRFIR (300-215) study materials
Cisco CBRFIR (300-215) study resources

Cisco CBRFIR (300-215): Cisco Secure Firewall Deployment and Initial Configuration

Cisco CBRFIR (300-215) · Work through your exam, one topic at a time.

All guide sections

Cisco Secure Firewall Deployment and Initial Configuration

This domain tests initial deployment choices and the steps that make an FTD manageable, licensed, and highly available. Most failures at this stage are registration, licensing, or time-synchronization problems.

Platforms and management

  • Hardware FTD appliances include the 1000, 2100, 3100, 4100, and 9300 series. Virtual FTDv runs on VMware, KVM, AWS, and Azure.
  • Choose FMC for multi-device, centralized management and FDM for single-device deployments. An FTD cannot be managed by FMC and FDM simultaneously.
  • A routed mode deployment needs IP addresses on interfaces and a default route. Transparent mode uses bridge groups and can be inserted without readdressing the network.

Registration and licensing

  • From the FTD CLI, register to FMC with configure manager add <FMC-IP-or-hostname> <registration-key> [nat-id]. The registration key must match what you enter on the FMC when adding the device.
  • If NAT sits between FTD and FMC, configure a NAT ID on both sides. Without it, registration succeeds but management connectivity fails.
  • Licensing uses Cisco Smart Licensing through CSSM or an on-premises server. Feature tiers are Essentials and Advantage; malware and URL licenses may be separate depending on the tier. Policies cannot deploy correctly without the required licenses.
  • Configure DNS and NTP before registration. Certificate validation and HA both depend on accurate time.

High availability

  • Failover is active/standby and requires matching hardware, software version, and a dedicated failover link. Stateful failover replicates connections.
  • Clustering scales throughput across multiple units and uses a control link and data links.

Worked example

A new FTDv has management IP 192.0.2.10/24 and gateway 192.0.2.1. You configure DNS and NTP, then run configure manager add 198.51.100.20 RegKey123. On the FMC you add device 192.0.2.10, enter RegKey123, and leave NAT ID blank because there is no NAT between them. The device registers and shows as managed. If you had entered a NAT ID on the FTD but left it blank on the FMC, registration would fail.

Traps that cost marks

  • Forgetting NTP, which breaks registration and HA.
  • Mismatched registration keys or NAT IDs.
  • Assuming a license is applied automatically after registration.
  • Mixing FMC and FDM management on the same FTD.