Choose Device, then click View Configuration in the Smart License group.

For example, an enabled Threat license should look like the following:

If you wired other interfaces, choose Device, then click the link in the Interfaces summary, and then click the interfaces type to view the list of interfaces.

Click the edit icon () for each interface to define the IP address and other settings.

The following example configures an interface to be used as a “demilitarized zone” (DMZ), where you place publically-accessible assets such as your web server. Click Save when you are finished.

If you configured new interfaces, choose Objects, then select Security Zones from the table of contents.

Edit or create new zones as appropriate. Each interface must belong to a zone, because you configure policies based on security zones, not interfaces. You cannot put the interfaces in zones when configuring them, so you must always edit the zone objects after creating new interfaces or changing the purpose of existing interfaces.

The following example shows how to create a new dmz-zone for the dmz interface.

If you want internal clients to use DHCP to obtain an IP address from the device, choose Device, then System Settings > DHCP Server. Select the DHCP Servers tab.

There is already a DHCP server configured for the inside interface, but you can edit the address pool or even delete it. If you configured other inside interfaces, it is very typical to set up a DHCP server on those interfaces. Click + to configure the server and address pool for each inside interface.

You can also fine-tune the WINS and DNS list supplied to clients on the Configuration tab.

The following example shows how to set up a DHCP server on the inside2 interface with the address pool 192.168.4.50-192.168.4.240.

Choose Device, then click View Configuration in the Routing group and configure a default route.

The default route normally points to the upstream or ISP router that resides off the outside interface. A default IPv4 route is for any-ipv4 (0.0.0.0/0), whereas a default IPv6 route is for any-ipv6 (::0/0). Create routes for each IP version you use. If you use DHCP to obtain an address for the outside interface, you might already have the default routes that you need.

The routes you define on this page are for the data interfaces only. They do not impact the management interface. Set the management gateway on System Settings > Management Interface.

The following example shows a default route for IPv4. In this example, isp-gateway is a network object that identifies the IP address of the ISP gateway (you must obtain the address from your ISP). You can create this object by clicking Create New Network at the bottom of the Gateway drop-down list.

Choose Policies and configure the security policies for the network.

The device setup wizard enables traffic flow between the inside-zone and outside-zone, and interface NAT for all interfaces when going to the outside interface. Even if you configure new interfaces, if you add them to the inside-zone object, the access control rule automatically applies to them.

However, if you have multiple inside interfaces, you need an access control rule to allow traffic flow from inside-zone to inside-zone. If you add other security zones, you need rules to allow traffic to and from those zones. These would be your minimum changes.

In addition, you can configure other policies to provide additional services, and fine-tune NAT and access rules to get the results that your organization requires. You can configure the following policies:

• SSL Decryption—If you want to inspect encrypted connections (such as HTTPS) for intrusions, malware, and so forth, you must decrypt the connections. Use the SSL decryption policy to determine which connections need to be decrypted. The system re-encrypts the connection after inspecting it.

• Identity—If you want to correlate network activity to individual users, or control network access based on user or user group membership, use the identity policy to determine the user associated with a given source IP address.

• Security Intelligence—Use the Security Intelligence policy to quickly drop connections from or to selected IP addresses or URLs. By blocking known bad sites, you do not need to account for them in your access control policy. Cisco provides regularly updated feeds of known bad addresses and URLs so that the Security Intelligence block lists update dynamically. Using feeds, you do not need to edit the policy to add or remove items in the block lists.

• NAT (Network Address Translation)—Use the NAT policy to convert internal IP addresses to externally routeable addresses.

• Access Control—Use the access control policy to determine which connections are allowed on the network. You can filter by security zone, IP address, protocol, port, application, URL, user or user group. You also apply intrusion and file (malware) policies using access control rules. Use this policy to implement URL filtering.

• Intrusion—Use the intrusion policies to inspect for known threats. Although you apply intrusion policies using access control rules, you can edit the intrusion policies to selectively enable or disable specific intrusion rules.

The following example shows how to allow traffic between the inside-zone and dmz-zone in the access control policy. In this example, no options are set on any of the other tabs except for Logging, where At End of Connection is selected.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

To gain insight into user behavior, you need to configure an identity policy to ensure that the user associated with a connection is identified.

1. Click Policies in the main menu, then click Identity.

   The identity policy is initially disabled. When using active authentication, the identity policy uses your Active Directory server to authenticate users and associate them with the IP address of the workstation they are using. Subsequently, the system will identify traffic for that IP address as being the user's traffic.

2. Click Enable Identity Policy.

3. Click the Create Identity Rule button, or the + button, to create the rule to require active authentication.

   In this example, we will assume you want to require authentication for everyone.

4. Enter a Name for the rule, which can be anything you choose, for example, Require_Authentication.

5. On the Source/Destination tab, leave the defaults, which apply to Any criteria.

   You can constrain the policy as you see fit to a more limited set of traffic. However, active authentication will only be attempted for HTTP traffic, so it does not matter that non-HTTP traffic matches the source/destination criteria. For more details about identity policy properties, see Configure Identity Rules

6. For Action, select Active Auth.

   Assuming you have not configured the identity policy settings, the Identity Policy Configuration dialog box will open because there are some undefined settings.

7. Configure the Captive Portal and SSL Decryption settings that are required for active authentication.

   When an identity rule requires active authentication for a user, the user is redirected to the captive portal port on the interface through which they are connected and then they are prompted to authenticate. Captive portal requires SSL decryption rules, which the system will generate automatically, but you must select the certificate to use for the SSL decryption rules.

   • Server Certificate—Select the internal certificate to present to users during active authentication. You can select the predefined self-signed DefaultInternalCertificate, or you can click Create New Internal Certificate and upload a certificate that your browsers already trust.

     Users will have to accept the certificate if you do not upload a certificate that their browsers already trust.

   • Port—The captive portal port. The default is 885 (TCP). If you configure a different port, it must be in the range 1025-65535.

   • Decrypt Re-Sign Certificate—Select the internal CA certificate to use for rules that implement decryption with re-signed certificates. You can use the pre-defined NGFW-Default-InternalCA certificate (the default), or one that you created or uploaded. If the certificate does not yet exist, click Create Internal CA to create it. (You are prompted for the decrypt re-sign certificate only if you have not yet enabled the SSL decryption policy.)

     If you have not already installed the certificate in client browsers, click the download button () to obtain a copy. See the documentation for each browser for information on how to install the certificate. Also see Downloading the CA Certificate for Decrypt Re-Sign Rules.

   Example:

   The Identity Policy Configuration dialog box should now look like the following.

   
   

   

   
   

8. Click Save to save the active authentication settings.

   The Active Authentication tab now appears below the Action setting.

9. On the Active Authentication tab, select HTTP Negotiate.

   This allows the browser and directory server to negotiate the strongest authentication protocol, in order, NTLM, then HTTP basic.

   Note

   For the HTTP Basic, HTTP Response Page, and NTLM authentication methods, the user is redirected to the captive portal using the IP address of the interface. However, for HTTP Negotiate, the user is redirected using the fully-qualified DNS name firewall-hostname.AD-domain-name . If you want to use HTTP Negotiate, you must also update your DNS server to map this name to the IP addresses of all inside interfaces where you are requiring active authentication. Otherwise, the redirection cannot complete, and users cannot authenticate. If you cannot, or do not want to, update the DNS server, select one of the other authentication methods.

10. For AD Identity Source, click Create New Identity Realm.

    If you already created your realm server object, simply select it and skip the steps for configuring the server.

    Fill in the following fields, then click OK.

    • Name—A name for the directory realm.

    • Type—The type of directory server. Active Directory is the only supported type, and you cannot change this field.

    • Directory Username, Directory Password—The distinguished username and password for a user with appropriate rights to the user information you want to retrieve. For Active Directory, the user does not need elevated privileges. You can specify any user in the domain. The username must be fully qualified; for example, Administrator@example.com (not simply Administrator).

      Note

      The system generates ldap-login-dn and ldap-login-password from this information. For example, Administrator@example.com is translated as cn=adminisntrator,cn=users,dc=example,dc=com. Note that cn=users is always part of this translation, so you must configure the user you specify here under the common name “users” folder.

    • Base DN—The directory tree for searching or querying user and group information, that is, the common parent for users and groups. For example, dc=example,dc=com. For information on finding the base DN, see Determining the Directory Base DN.

    • AD Primary Domain— The fully qualified Active Directory domain name that the device should join. For example, example.com.

    • Hostname/IP Address—The hostname or IP address of the directory server. If you use an encrypted connection to the server, you must enter the fully-qualified domain name, not the IP address.

    • Port—The port number used for communications with the server. The default is 389. Use port 636 if you select LDAPS as the encryption method.

    • Encryption—To use an encrypted connection for downloading user and group information, select the desired method, STARTTLS or LDAPS. The default is None, which means that user and group information is downloaded in clear text.

      • STARTTLS negotiates the encryption method, and uses the strongest method supported by the directory server. Use port 389. This option is not supported if you use the realm for remote access VPN.

      • LDAPS requires LDAP over SSL. Use port 636.

    • Trusted CA Certificate—If you select an encryption method, upload a Certificate Authority (CA) certificate to enable a trusted connection between the system and the directory server. If you are using a certificate to authenticate, the name of the server in the certificate must match the server Hostname / IP Address. For example, if you use 10.10.10.250 as the IP address but ad.example.com in the certificate, the connection fails.

    Example:

    For example, the following image shows how to create an unencrypted connection for the ad.example.com server. The primary domain is example.com, and the directory username is Administrator@ad.example.com. All user and group information is under the Distinguished Name (DN) ou=user,dc=example,dc=com.

    
    

    

    
    

11. For AD Identity Source, select the object you just created.

    The rule should look similar to the following.

    
    

    

    
    

12. Click OK to add the rule.

    If you look in the upper right of the window, you can see that the Deploy icon button now has a dot, which indicates that there are undeployed changes. Making changes in the user interface is not sufficient for getting the changes configured on the device, you must deploy changes. Thus, you can make a set of related changes before you deploy them, so that you do not face the potential problems of having a partially-configured set of changes running on the device. You will deploy changes later in this procedure.

    
    

    

    
    

Change the action on the Inside_Outside_Rule access control rule to Allow.

1. Click Access Control on the Policies page.

2. Hover over the Actions cell on the right side of the Inside_Outside_Rule row to expose the edit and delete icons, and click the edit icon () to open the rule.

3. Select Allow for the Action.

   
   

   

   
   

4. Click OK to save the change.

Enable logging on the access control policy default action.

1. Click anywhere in the default action at the bottom of the access control policy page.

   
   

   

   
   

2. Select Select Log Action > At Beginning and End of Connection.

3. Click OK.

Set an update schedule for the vulnerability database (VDB).

1. Click Device.

2. Click View Configuration in the Updates group.

   
   

   

   
   

3. Click Configure in the VDB group.

   
   

   

   
   

4. Define the update schedule.

   Choose a time and frequency that will not be disruptive to your network. Also, please understand that the system will do an automatic deployment after downloading the update. This is necessary to activate the new detectors. Thus, any configuration changes that you have made and saved but have not yet deployed will also be deployed.

   For example, the following schedule updates the VDB once a week on Sunday at 12:00 AM (using the 24-hour clock notation).

   
   

   

   
   

5. Click Save.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

If you have not already done so, enable the Threat license.

1. Click Device.

2. Click View Configuration in the Smart License group.

   
   

   

   
   

3. Click Enable in the Threat group.

   The system registers the license with your account, or activates the evaluation license, as appropriate. The group should indicate that the license is enabled, and the button changes to a Disable button.

   
   

   

   
   

Select an intrusion policy for one or more access rules.

1. Click Policies in the main menu.

   Ensure that the Access Control policy is displayed.

2. Hover over the Actions cell on the right side of the Inside_Outside_Rule row to expose the edit and delete icons, and click the edit icon () to open the rule.

3. If you have not already done so, select Allow for the Action.

   
   

   

   
   

4. Click the Intrusion Policy tab.

5. Click the Intrusion Policy toggle to enable it, then select the intrusion policy.

   The Balanced Security and Connectivity policy is appropriate for most networks. It provides a good intrusion defense without being overly aggressive, which has the potential of dropping traffic that you might not want to be dropped. If you determine that too much traffic is getting dropped, you can ease up on intrusion inspection by selecting the Connectivity over Security policy.

   If you need to be aggressive about security, try the Security over Connectivity policy. The Maximum Detection policy offers even more emphasis on network infrastructure security with the potential for even greater operational impact.

   
   

   

   
   

6. Click OK to save the change.

(Optional.) Go to Policies > Intrusion, click the gear icon, and configure a syslog server for the intrusion policy.

Set an update schedule for the intrusion rule database.

1. Click Device.

2. Click View Configuration in the Updates group.

   
   

   

   
   

3. Click Configure in the Rule group.

   
   

   

   
   

4. Define the update schedule.

   Choose a time and frequency that will not be disruptive to your network. Also, please understand that the system will do an automatic deployment after downloading the update. This is necessary to activate the new rules. Thus, any configuration changes that you have made and saved but have not yet deployed will also be deployed.

   For example, the following schedule updates the rule database once a week on Monday at 12:00 AM (using the 24-hour clock notation).

   
   

   

   
   

5. Click Save.

Configure the Security Intelligence policy to preemptively drop connections with known bad hosts and sites.

1. Click Device, then click View Configuration in the Updates group.

2. Click Update Now in the Security Intelligence Feeds group.

3. Also, click Configure and set a recurring update for the feeds. The default, Hourly, is appropriate for most networks but you can decrease the frequency if necessary.

4. Click Policies, then click the Security Intelligence policy.

5. Click Enable Security Intelligence if you have not already enabled the policy.

6. On the Network tab, click + in the block/drop list, and select all of the feeds on the Network Feeds tab. You can click the i button next to a feed to read a description of each feed.

   If you see a message that there are no feeds yet, please try again later. The feeds download has not yet completed. If this problem persists, ensure that there is a path between the management IP address and the Internet.

7. Click OK to add the selected feeds.

   If you know of additional bad IP addresses, you can click + > Network Objects and add the objects that contain the addresses. You can click Create New Network Object at the bottom of the list to add them now.

8. Click the URL tab, then click + > URL Feeds in the block/drop list, and select all of the URL feeds. Click OK to add them to the list.

   Similar to the network list, you can add your own URL objects to the list to block additional sites that are not in the feeds. Click + > URL Objects. You can add new objects by clicking Create New URL Object at the end of the list.

9. Click the gear icon, and enable Connection Events Logging, to enable the policy to generate Security Intelligence events for matched connections. Click OK to save your changes.

   If you do not enable connection logging, you will have no data to use to evaluate whether the policy is performing to expectations. If you have an external syslog server defined, you can select it now so that the events are also sent to that server.

   
   

   

   
   

10. As needed, you can add network or URL objects to the Do Not Block list on each tab to create exceptions to the blocked list.

    The Do Not Block lists are not real "allow" lists. They are exception lists. If an address or URL in the exception list also appears in the blocked list, the connection for the address or URL is allowed to pass on to the access control policy. This way, you can block a feed, but if you later find that a desirable address or site is being blocked, you can use the exception list to override that block without needing to remove the feed entirely. Keep in mind that these connections are subsequently evaluated by access control, and if configured, an intrusion policy. Thus, if any connections do contain threats, they can be identified and blocked during intrusion inspection.

    Use the Access and SI Rules dashboard, and the Security Intelligence view in the Event Viewer, to determine what traffic is actually being dropped by the policy, and whether you need to add addresses or URLs to the Do Not Block lists.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

If you have not already done so, enable the Malware and Threat licenses.

1. Click Device.

2. Click View Configuration in the Smart License group.

   
   

   

   
   

3. Click Enable in the Malware group, and if not already enabled, the Threat group.

   The system registers the license with your account, or activates the evaluation license, as appropriate. The group should indicate that the license is enabled, and the button changes to a Disable button.

   
   

   

   
   

Select a file policy for one or more access rules.

1. Click Policies in the main menu.

   Ensure that the Access Control policy is displayed.

2. Hover over the Actions cell on the right side of the Inside_Outside_Rule row to expose the edit and delete icons, and click the edit icon () to open the rule.

3. If you have not already done so, select Allow for the Action.

   
   

   

   
   

4. Click the File Policy tab.

5. Click the file policy you want to use.

   Your main choice is between Block Malware All, which drops any files that are considered malware, or Cloud Lookup All, which queries the AMP Cloud to determine the file's disposition, but does no blocking. If you want to first see how files are being evaluated, use cloud lookup. You can switch to the blocking policy later if you are satisfied with how files are being evaluated.

   There are other policies available that block malware. These policies are coupled with file control, blocking the upload of Microsoft Office, or Office and PDF, documents. That is, these policies prevent users from sending these file types to other networks in addition to blocking malware. You can select these policies if they fit your needs.

   For this example, select Block Malware All.

   

   
   

   

   
   

6. Click the Logging tab and verify that Log Files under File Events is selected.

   By default, file logging is enabled whenever you select a file policy. You must enable file logging to get file and malware information in events and dashboards.

   
   

   

   
   

7. Click OK to save the change.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

If you have not already done so, enable the URL license.

1. Click Device.

2. Click View Configuration in the Smart License group.

   
   

   

   
   

3. Click Enable in the URL License group.

   The system registers the license with your account, or activates the evaluation license, as appropriate. The group should indicate that the license is enabled, and the button changes to a Disable button.

   
   

   

   
   

Create a URL filtering access control rule.

1. Click Policies in the main menu.

   Ensure that the Access Control policy is displayed.

2. Click + to add a new rule.

3. Configure the order, title, and action.

   • Order—The default is to add new rules to the end of the access control policy. However, you must place this rule ahead of (above) any rule that would match the same Source/Destination and other criteria, or the rule will never be matched (a connection matches one rule only, and that is the first rule it matches in the table). For this rule, we will use the same Source/Destination as the Inside_Outside_Rule created during initial device configuration. You might have created other rules as well. To maximize access control efficiency, it is best to have specific rules early, to ensure the quickest decision on whether a connection is allowed or dropped. For the purposes of this example, select 1 as the rule order.

   • Title—Give the rule a meaningful name, such as Block_Web_Sites.

   • Action—Select Block.

   
   

   

   
   

4. On the Source/Destination tab, click + for Source > Zones, select inside_zone, then click OK in the zones dialog box.

   Adding any of the criteria works the same way. Clicking + opens a little dialog box, where you click the items you want to add. You can click multiple items, and clicking a selected item de-selects it; the check marks indicate the selected items. But nothing is added to the policy until you click the OK button; simply selecting the items is not sufficient.

   
   

   

   
   

5. Using the same technique, select outside_zone for Destination > Zones.

   
   

   

   
   

6. Click the URLs tab.

7. Click the + for Categories, and select the categories you want to fully or partially block.

   For purposes of this example, select Botnets, Malicious Sites, Malware Sites, and Social Networking. There are additional categories that you would most likely want to block. If you know of a site that you want to block, but you are unsure of the category, enter the URL in the in the URL to Check field and click Go. You will be taken to a web site that shows the results of the lookup.

   
   

   

   
   

8. To implement reputation-sensitive blocking for the Social Networking category, click Reputation: Risk Any for that category, deselect Any, then move the slider to Questionable. Click away from the slider to close it.

   
   

   

   
   

   The left of the reputation slider indicates sites that will be allowed, the right side are sites that will be blocked. In this case, only Social Networking sites with reputations in the Questionable and Untrusted ranges will be blocked. Thus, your users should be able to get to commonly-used Social Networking sites, where there are fewer risks.

   Select the Include Sites with Unknown Reputation option to have URLs with unknown reputation included in the reputation match. New sites typically are unrated, and there can be other reasons a site's reputation is unknown or cannot be determined.

   Using reputation, you can selectively block sites within a category you otherwise want to allow.

9. Click the + next to the URLS list to the left of the categories list.

10. At the bottom of the popup dialog box, click the Create New URL link.

11. Enter badsite.example.com for both the name and URL, then click OK to create the object.

    You can name the object the same as the URL or give the object a different name. For the URL, do not include the protocol portion of the URL, just add the server name.

    
    

    

    
    

12. Select the new object, then click OK.

    Adding new objects while editing policies simply adds the object to the list. The new object is not automatically selected.

    
    

    

    
    

13. Click the Logging tab and select Select Log Action > At Beginning and End of Connection.

    You must enable logging to get category and reputation information into the web category dashboard and connection events.

14. Click OK to save the rule.

(Optional.) Set preferences for URL filtering.

1. Click Device.

2. Click System Settings > Traffic Settings > URL Filtering Preferences.

3. Select Query Cisco CSI for Unknown URLs.

4. Select a reasonable URL Time to Live, such as 24 hours.

5. Click Save.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

Create the application-based access control rule.

1. Click Policies in the main menu.

   Ensure that the Access Control policy is displayed.

2. Click + to add a new rule.

3. Configure the order, title, and action.

   • Order—The default is to add new rules to the end of the access control policy. However, you must place this rule ahead of (above) any rule that would match the same Source/Destination and other criteria, or the rule will never be matched (a connection matches one rule only, and that is the first rule it matches in the table). For this rule, we will use the same Source/Destination as the Inside_Outside_Rule created during initial device configuration. You might have created other rules as well. To maximize access control efficiency, it is best to have specific rules early, to ensure the quickest decision on whether a connection is allowed or dropped. For the purposes of this example, select 1 as the rule order.

   • Title—Give the rule a meaningful name, such as Block_Anonymizers.

   • Action—Select Block.

   
   

   

   
   

4. On the Source/Destination tab, click + for Source > Zones, select inside_zone, then click OK in the zones dialog box.

   
   

   

   
   

5. Using the same technique, select outside_zone for Destination > Zones.

   
   

   

   
   

6. Click the Applications tab.

7. Click the + for Applications, and then click the Advanced Filter link at the bottom of the popup dialog box.

   Although you can create application filter objects beforehand and select them on the Application Filters list here, you can also specify criteria directly in the access control rule, and optionally save the criteria as a filter object. Unless you are writing a rule for a single application, it is easier to use the Advanced Filter dialog box to find applications and construct appropriate criteria.

   As you select criteria, the Applications list at the bottom of the dialog box updates to show exactly which applications match the criteria. The rule you are writing applies to these applications.

   Look at this list carefully. For example, you might be tempted to block all very high risk applications. However, as of this writing, TFPT is classified as very high risk. Most organizations would not want to block this application. Take the time to experiment with various filter criteria to see which applications match your selections. Keep in mind that these lists can change with every VDB update.

   For purposes of this example, select anonymizers/proxies from the Categories list.

   
   

   

   
   

8. Click Add in the Advanced Filters dialog box.

   The filter is added and shown on the Applications tab.

   
   

   

   
   

9. Click the Logging tab and select Select Log Action > At Beginning and End of Connection.

   You must enable logging to get information about any connections blocked by this rule.

10. Click OK to save the rule.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

Click Monitoring and evaluate the results.

Configure the interface.

1. Click Device, click the link in the Interfaces summary, and then click the interfaces type to view the list of interfaces.

2. Hover over the Actions cell on the right side of the row for the interface you wired, and click the edit icon ().

3. Configure the basic interface properties.

   • Name—A unique name for the interface. For this example, inside_2.

   • Mode—Select Routed.

   • Status—Click the status toggle to enable the interface.

   • IPv4 Address tab—Select Static for Type, then enter 192.168.2.1/24.

   
   

   

   
   

4. Click Save.

   The interface list shows the updated interface status and the configured IP address.

   
   

   

   
   

Configure the DHCP server for the interface.

1. Click Device.

2. Click System Settings > DHCP Server.

3. Click the DHCP Servers tab.

   The table lists any existing DHCP servers. If you are using the default configuration, the list includes one for the inside interface.

4. Click + above the table.

5. Configure the server properties.

   • Enable DHCP Server—Click this toggle to enable the server.

   • Interface—Select the interface on which you are providing DHCP services. In this example, select inside_2.

   • Address Pool—The addresses the server can supply to devices on the network. Enter 192.168.2.2-192.168.2.254. Make sure you do not include the network address (.0), the interface address (.1), or the broadcast address (.255). Also, if you need static addresses for any devices on the network, exclude those addresses from the pool. The pool must be a single continuous series of addresses, so choose static addresses from the beginning or ending of the range.

   
   

   

   
   

6. Click Add.

   
   

   

   
   

Add the interface to the inside security zone.

1. Click Objects in the main menu.

2. Select Security Zones from the objects table of contents.

3. Hover over the Actions cell on the right side of the row for the inside_zone object, and click the edit icon ().

4. Click + under Interfaces, select the inside_2 interface, and click OK in the interfaces list.

   
   

   

   
   

5. Click Save.

   
   

   

   
   

Create an access control rule that allows traffic between the inside networks.

1. Click Policies in the main menu.

   Ensure that the Access Control policy is displayed.

2. Click + to add a new rule.

3. Configure the order, title, and action.

   • Order—The default is to add new rules to the end of the access control policy. However, you must place this rule ahead of (above) any rule that would match the same Source/Destination and other criteria, or the rule will never be matched (a connection matches one rule only, and that is the first rule it matches in the table). For this rule, we will use unique Source/Destination criteria, so adding the rule to the end of the list is acceptable.

   • Title—Give the rule a meaningful name, such as Allow_Inside_Inside.

   • Action—Select Allow.

   
   

   

   
   

4. On the Source/Destination tab, click + for Source > Zones, select inside_zone, then click OK in the zones dialog box.

   
   

   

   
   

5. Using the same technique, select inside_zone for Destination > Zones.

   A security zone must contain at least two interfaces to select the same zone for source and destination.

   
   

   

   
   

6. (Optional.) Configure intrusion and malware inspection.

   Although the inside interfaces are in a trusted zone, it is typical for users to connect laptops to the network. Thus, a user might unknowingly bring a threat inside your network from an outside network or a Wi-Fi hot spot. Thus, you might want to scan for intrusions and malware in traffic that goes between your inside networks.

   Consider doing the following.

   • Click the Intrusion Policy tab, enable the intrusion policy, and use the slider to select the Balanced Security and Connectivity policy.

   • Click the File Policy tab, then select the Block Malware All policy.

7. Click the Logging tab and select Select Log Action > At Beginning and End of Connection.

   You must enable logging to get information about any connections that match this rule. Logging adds statistics to the dashboard as well as showing events in the event viewer.

8. Click OK to save the rule.

Verify that required policies are defined for the new subnet.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

Configure a switch port as a SPAN (Switched Port Analyzer) port and configure a monitoring session for the source interfaces.

switch(config)# interface Ethernet1/48 
switch(config-if)# switchport monitor 
switch(config-if)# exit 
switch(config)# monitor session 1 
switch(config-monitor)# source interface ethernet 1/7 
switch(config-monitor)# source interface ethernet 1/8 
switch(config-monitor)# destination interface ethernet 1/48 
switch(config-monitor)# no shut 

switch# show monitor session 1 brief 
   session 1
---------------
type              : local
state             : up
source intf       :
    rx            : Eth1/7        Eth1/8
    tx            : Eth1/7        Eth1/8
    both          : Eth1/7        Eth1/8
source VSANs      :
destination ports : Eth1/48

Legend: f = forwarding enabled, l = learning enabled

Connect the FTD interface to the SPAN port on the switch.

Configure the FTD interface in passive mode.

1. Click Device, then click the link in the Interfaces summary, and then click Interfaces or EtherChannels.

2. Click the edit icon () for the physical interface or EtherChannel you want to edit.

   Pick a currently unused interface. If you intend to convert an in-use interface to a passive interface, you need to first remove the interface from any security zone and remove all other configurations that use the interface.

3. Set the Status slider to the enabled setting ().

4. Configure the following:

   • Interface Name—The name for the interface, up to 48 characters. Alphabetic characters must be lower case. For example, monitor.

   • Mode—Select Passive.

   
   

   

   
   

5. Click OK.

Create a passive security zone for the interface.

1. Select Objects, then select Security Zones from the table of contents.

2. Click the + button.

3. Enter a Name for the object and optionally, a description. For example, passive_zone.

4. For Mode, select Passive.

5. Click + and select the passive interface.

   
   

   

   
   

6. Click OK.

Configure one or more access control rules for the passive security zone.

1. Select Policies > Access Control.

2. Click + to add a rule allowing all traffic, but applying an intrusion policy.

3. Select 1 as the rule order. This rule is more specific than the default rule, but does not overlap with it. If you already have custom rules, select an appropriate position so that traffic to the passive interface is not matched to those rules instead.

4. Enter a name for the rule, for example, Passive_IDS.

5. Select Allow as the Action.

6. On the Source/Destination tab, select the passive zone under Source > Zones. Do not configure any other options on the tab.

   When running in evaluation mode, the rule should look like the following at this point:

   
   

   

   
   

7. Click the Intrusion Policy tab, click the slider to On, and select an intrusion policy such as the Balanced Security and Connectivity policy, which is recommended for most networks.

   
   

   

   
   

8. Click the Logging tab and select At End of Connection for the logging option.

   
   

   

   
   

9. Click OK.

10. Click + to add a rule that will require that the system do deep inspection to determine the URL and category for all HTTP requests.

    This rule makes it possible for you to see URL category information in the dashboards. To save processing time and improve performance, the system determines URL category only if there is at least one access control rule that specifies a URL category condition.

11. Select 1 as the rule order. This will place it above the previous rule (Passive_IDS). If you place it after that rule (which applies to all traffic), the rule you are creating now would never be matched.

12. Enter a name for the rule, for example, Determine_URL_Category.

13. Select Allow as the Action.

    Alternatively, you could select Block. Either action will accomplish your goal for this rule.

14. On the Source/Destination tab, select the passive zone under Source > Zones. Do not configure any other options on the tab.

    
    

    

    
    

15. Click the URLs tab, click the + next to the Categories heading, and select any of the categories. For example, Search Engines and Portals. You can optionally select a reputation level, or leave it at the default Any.

    
    

    

    
    

16. Click the Intrusion Policy tab, click the slider to On, and select the same intrusion policy you chose for the first rule.

17. Click the Logging tab and select At End of Connection for the logging option.

    However, if you selected Block as the action, select At Beginning and End of Connection. Because blocked connections are not ended per se, you get log information at the beginning of the connection only.

18. Click OK.

(Optional.) Configure other security policies.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

Use the monitoring dashboards to analyze the kinds of traffic and threats that are coming across the network. If you decide you want the FTD device to actively drop unwanted connections, redeploy the device so that you can configure active routed interfaces that provide firewall protection for the monitored network.