Step 1

Choose Devices > Device Management, and click Edit () for the firewall.

Step 2

Click Interfaces.

Step 3

To create breakout ports from a 40-Gb or larger interface, click the Break icon for the interface.

Step 4

Click Edit () for the interface that you want to use for inside.

1. From the Security Zone drop-down list, choose an existing inside security zone or add a new one by clicking New.

   For example, add a zone called inside_zone. You apply your security policy based on zones or groups. For example, configure your access control policy to enable traffic to go from the inside zone to the outside zone, but not from outside to inside.

2. Enter a Name up to 48 characters in length.

   For example, name the interface inside.

3. Check the Enabled check box.

4. Leave the Mode set to None.

5. Click the IPv4 and/or IPv6 tab.

   • IPv4—Choose Use Static IP from the drop-down list, and enter an IP address and subnet mask in slash notation.

     For example, enter 192.168.1.1/24

     

   • IPv6—Check the Autoconfiguration check box for stateless autoconfiguration.

     

6. Click OK.

Step 5

Click Edit () for the interface that you want to use for outside.

1. From the Security Zone drop-down list, choose an existing outside security zone or add a new one by clicking New.

   For example, add a zone called outside_zone.

   If the outside interface was pre-configured, the rest of these fields are optional.

2. Enter a Name up to 48 characters in length.

   For example, name the interface outside.

3. Check the Enabled check box.

4. Leave the Mode set to None.

5. Click the IPv4 and/or IPv6 tab.

   • IPv4—Choose Use DHCP, and configure the following optional parameters:

     • Obtain default route using DHCP—Obtains the default route from the DHCP server.

     • DHCP route metric—Assigns an administrative distance to the learned route, between 1 and 255. The default administrative distance for the learned routes is 1.

     

   • IPv6—Check the Autoconfiguration check box for stateless autoconfiguration.

     

6. Click OK.

Step 6

Configure a DMZ interface to host a web server, for example.

1. Click Edit () for the interface you want to use.

2. From the Security Zone drop-down list, choose an existing DMZ security zone or add a new one by clicking New.

   For example, add a zone called dmz_zone.

3. Enter a Name up to 48 characters in length.

   For example, name the interface dmz.

4. Check the Enabled check box.

5. Leave the Mode set to None.

6. Click the IPv4 and/or IPv6 tab and configure the IP address as desired.

7. Click OK.

Step 7

Click Save.

Step 1

Choose Devices > Device Management, and click Edit () for the device.

Step 2

Choose DHCP > DHCP Server.

Step 3

In the Server area, click Add and configure the following options.

• Interface—Choose the interface name from the drop-down list.

• Address Pool—Set the range of IP addresses. The IP addresses must be on the same subnet as the selected interface and cannot include the IP address of the interface itself.

• Enable DHCP Server—Enable the DHCP server on the selected interface.

Step 4

Click OK.

Step 5

Click Save.

Step 1

Choose Devices > Device Management, and click Edit () for the device.

Step 2

Choose Routing > Static Route.

If you received a default route from the DHCP server, it will show in this table.

Step 3

Click Add Route, and set the following options.

• Type—Click the IPv4 or IPv6 radio button depending on the type of static route that you are adding.

• Interface—Choose the egress interface; typically the outside interface.

• Available Network—Choose any-ipv4 for an IPv4 default route, or any-ipv6 for an IPv6 default route, and click Add to move it to the Selected Network list.

• Gateway or IPv6 Gateway—Enter or choose the gateway router that is the next hop for this route. You can provide an IP address or a Networks/Hosts object.

Step 4

Click OK.

Step 5

Click Save.

Step 1

Choose Devices > NAT, and click New Policy.

Step 2

Name the policy, select the devices that you want to use the policy, and click Save.

The policy is added the management center. You still have to add rules to the policy.

Step 3

Click Add Rule.

Step 4

Configure the basic rule options:

• NAT Rule—Choose Auto NAT Rule.

• Type—Choose Dynamic.

Step 5

On the Interface Objects page, add the outside zone from the Available Interface Objects area to the Destination Interface Objects area.

Step 6

On the Translation page, configure the following options:

• Original Source—Click Add () to add a network object for all IPv4 traffic (0.0.0.0/0).

  

  Note	You cannot use the system-defined any-ipv4 object, because Auto NAT rules add NAT as part of the object definition, and you cannot edit system-defined objects.

• Translated Source—Choose Destination Interface IP.

Step 7

Click Save to add the rule.

Step 8

Click Save on the NAT page to save your changes.

Step 1

Choose Policy > Access Policy > Access Policy, and click Edit () for the access control policy assigned to the device.

Step 2

Click Add Rule, and set the following parameters.

1. Name this rule, for example, inside-to-outside.

2. Select the inside zone from Zones

3. Click Add Source Zone.

4. Select the outside zone from Zones.

5. Click Add Destination Zone.

Leave the other settings as is.

Step 3

(Optional) Customize associated policies by clicking on the policy type in the packet flow diagram.

Prefilter, Decryption, Security Intelligence, and Identity policies are applied before an access control rule. Customizing these policies is not required, but after you know your network's needs, they let you improve network performance by either fastpathing trusted traffic (bypassing processing) or blocking traffic so no further processing is required.

• Prefilter Rules—The Default Prefilter Policy passes all traffic for the other rules to act on (analyzes). The only change to the default policy you can make is to block tunnel traffic. Otherwise, you can create a new prefilter policy to associate with the access control policy that can analyze (pass on), fastpath (bypass further checks) or block.

  Prefiltering lets you improve performance by dealing with traffic before it gets any further, by either blocking or fastpathing. In a new policy, you can add tunnel rules and prefilter rules. A tunnel rule lets you fastpath, block, or rezone plaintext (non-encrypted), passthrough tunnels. A prefilter rule lets you fastpath or block non-tunneled traffic identified by IP address, port, and protocol.

  For example, if you know you want to block all FTP traffic on your network, but fastpath SSH traffic from an administrator, you can add a new prefilter policy.

• Decryption—Decryption is not applied by default. Decryption is a way to expose network traffic to deep inspection. In most cases, you don't want to decrypt traffic, and can only do so if it is legally allowed. For maximum network protection, a decryption policy might be a good idea for traffic going to critical servers or coming from untrusted network segments.

• Security Intelligence—(Requires the IPS license) Security Intelligence is enabled by default. Security Intelligence is another early defense against malicious activity applied before passing connections to the access control policy for further processing. Security Intelligence uses reputation intelligence to quickly block connections to or from IP addresses, URLs, and domain names provided by Talos, the threat intelligence organization at Cisco. You can add or delete additional IP addresses, URLs, or domains if desired.

  Note	If you do not have the IPS license, this policy will not be deployed even though it shows in your access control policy as enabled.

• Identity—Identity is not applied by default. You can require a user to authenticate before allowing traffic to be processed by the access control policy.

Step 4

(Optional) Add an Intrusion policy that is applied after the access control rule.

1. Click the Intrusion Policy drop-down list.

   

2. Choose one of the system-provided policies from the list.

Step 5

(Optional) Add a File policy that is applied after the access control rule.

1. Click the File Policy drop-down list and choose either an existing policy or add one by choosing the Open File Policy List.

   

   For a new policy, the Policies > Malware & File page opens in a separate tab.

2. See the Cisco Secure Firewall Device Manager Configuration Guide for details on creating the policy.

3. Return to the Add Rule page and select the newly created policy from the drop-down list.

Step 6

Click Apply.

Step 7

Click Save.

Step 1

Click Deploy in the upper right.

Step 2

For a quick deployment, check specific devices and then click Deploy.

Or click Deploy All to deploy to all devices.

Otherwise, for additional deployment options, click Advanced Deploy.

Step 3

Ensure that the deployment succeeds. Click the icon to the right of the Deploy button in the menu bar to see status for deployments.