Cisco Firepower Online Training

Cisco Firepower Online Training guides students through the Cisco Firepower Threat Defense technology (FTD) along with Firepower Management Center (FMC) as a security management and reporting environment.

Taking this course, students will be able to understand the Firepower concept, implement Firepower security rules on an operational level, build the secure Internet Edge for corporate access as well as use Next Generation functions like creating Cisco Anti-Malware protection (AMP) policy, URL filtering, File policies and Intrusion Policies to protect the network. The course as a part of the Grandmetric bootcamp series teaches also how to efficiently troubleshoot security issues and Firepower solutions.

This 3-day instructor-led operational level course is prepared for participants who do not have time to travel to the Grandemtric training centre location and can take the course remotely via the Internet and Online meeting tools.

Who should attend?

• Network consultants
• Security analysts
• Network engineers
• Network specialists
• IT Administrators

Cisco Firepower Online Training Agenda:

1) Day 1

1. Lets know each other.
   1. Who are you?
   2. What is your background?
   3. Do you have hobbies out of the computer world?
2. What is Cisco Firepower Threat Defense?
   1. IPS/IDS
   2. Snort
   3. Sourcefire
   4. Firepower
   5. FTD ~ Cisco Firepower + Cisco ASA = NGFW
3. Components explained and management consoles
   1. Sensors –
      1. FTD (2100, 4100, 9300, ASA, virtual + ISR ),
      2. SFR
      3. NGIPS (7000, 8000, virtual)
   2. Firepower Management Center
   3. ASDM
   4. FDM
4. Licensing
   1. Classic licenses
   2. Smart license – TASK Activate Evaluation !

1. Registration process with Tasks
   1. FTD initial config
   2. Compatibility checks
   3. Routing
   4. No NAT
   5. With NAT
2. Policies explained
   1. Access control policies + simple Task
   2. Intrusion policy
   3. Network analysis policy
   4. Prefilter policy
   5. Network Discovery policy
   6. File policy
   7. DNS policy
   8. Identity policy
   9. SSL policy
   10. Health policy

2) Day 2

1. Access control policy in details + Tasks
   1. Rules
      1. AND match
      2. OR match
      3. Logging
   2. Actions
      1. Allow
      2. Trust
      3. Monitor
      4. Block
      5. Block with reset
      6. Interactive block
      7. Interactive block with reset
   3. Security intelligence
   4. HTTP response pages
   5. Policy assignments
   6. Inheritance settings and policy management
   7. Rule categories
   8. ACP report

Break 45 minutes

1. Intrusion policy in details
   1. Cisco provided policies
   2. Rule action modifications
   3. Rule search
   4. Rule edit
      1. Thresholds
      2. Suppressions
      3. Alerts
   5. Rule creation
2. Malware and File policy
   1. Rule creation
   2. Action types
   3. Types of analysis
   4. Advanced options
      1. Encrypted files
      2. File lists

3) Day 3

1.  Troubleshooting data path

1. Features for traffic processing investigation:
   1. > system support trace
   2. > system support firewall-engine-debug
   3. > packet-tracer input Inside tcp 192.168.0.2 http 54.78.56.192 http
   4. > packet-tracer input Inside tcp 192.168.0.2 http 54.78.56.192 http detailed
   5. > capture-traffic
   6. OR
   7. > system support capture-traffic

Similar to tcpdump

1. Enter to ASA cli:

>system support diagnostic-cli

Firepower>en

Lina-cli#

Break 45 minutes

1. Tasks