Sourcefire - Firepower 8260

Similar Questions

• ASA with the power of fire, no need for the license of botnet?

  1. We are looking to upgrade our ASA of legacy IDS/IPS in firepower (to buy SSDS), we use the botnet license, go to firepower would make redundant botnet as sourcefire/firepower does the same job?
  2. We are looking to buy 2 new 5516 for a site with the power of fire, so I need to know to add the botnet on the agenda.     Cheers - more to see: https://supportforums.cisco.com/discussion/12527741/asa-firepower-any-ne...

  See you soon

  1. We are looking to upgrade our ASA of legacy IDS/IPS in firepower (to buy SSDS), we use the botnet license, go to firepower would make redundant botnet as sourcefire/firepower does the same job?
  2. We are looking to buy 2 new 5516 for a site with the power of fire, so I need to know to add the botnet on the agenda.

  See you soon

  -See more at: https://supportforums.cisco.com/discussion/12527741/asa-firepower-any-ne...

  1. We are looking to upgrade our ASA of legacy IDS/IPS in firepower (to buy SSDS), we use the botnet license, go to firepower would make redundant botnet as sourcefire/firepower does the same job?
  2. We are looking to buy 2 new 5516 for a site with the power of fire, so I need to know to add the botnet on the agenda.

  See you soon

  -See more at: https://supportforums.cisco.com/discussion/12527741/asa-firepower-any-ne...

  1. We are looking to upgrade our ASA of legacy IDS/IPS in firepower (to buy SSDS), we use the botnet license, go to firepower would make redundant botnet as sourcefire/firepower does the same job?
  2. We are looking to buy 2 new 5516 for a site with the power of fire, so I need to know to add the botnet on the agenda.

  See you soon

  -See more at: https://supportforums.cisco.com/discussion/12527741/asa-firepower-any-ne...

  Double - answered in the other display.

• Sourcefire Defense Center with the new firepower of Cisco 7115

  Hi all

  I have a client who has DC3500 with 18 Sourcefire NGIPS recorded thereon.

  This customer needs to add additional 7115 NGIPS to the existing DC3500.

  My Question is, the 7115 to DC3500 new registration will be good or not?

  Best regards, Mohamed Amin

  Course - as long as you have the licenses to apply on the new sensor. The DC 3500 (now called Firesight 3500) is rated for up to 150 sensors managed (devices) and 300,000 guests/users.

• Upgrade to version 6.0 SourceFire Module questions

  We have just implemented SourceFire Module version 5.4.1 on our ASA recently, but want to upgrade to version 6.0. I've been through Notes version 6.0 for the upgrade, which are dated to November 2015, but had a few questions that I was hoping someone here could answer:

  -Our FireSIGHT Management Center is a virtual appliance of 64-bit. Can we install version 6.0 on a virtual appliance VMWare running on EXSi 6.0? The only issue date list 5.1 and 5.5 ESXi ESXi.

  -Should what files I use for the update? The Release Notes say to use "SourceFire_3d_Defense_Center_S3_upgrade - 6.0.0 - 1005.sh. My choice on Cisco's Support site are: asasfr-sys - 6.0.0 - 1005.pkg, asasfr-5500 x-boot - 6.0.0 - 1005.img and Cisco_Network_Sensor_Upgrade - 6.0.0 - 1005.sh. I guess the sys-asasfr - 1005.pkg - 6.0.0 is for CME, and the Cisco_Network_Sensor_Upgrade - 6.0.0 - 1005.sh is for the ASAs.Is that right?

  -How long will the update for FMC and ASAs? The ASA is a 5516 x and the release notes look like they say that the update will take about 41 minutes.

  ESXi 6.0 is not officially supported so that your experience may vary. If you get stuck, you may TAC by telling you that you're on your own.

  "Cisco_Network_Sensor_Upgrade - 6.0.0 - 1005.sh" is used to upgrade the fire ASA power module in the Manager of firepower.

  If you were a fabricated construction or reimage then you would use the boot images and sys respectively.

  41 minutes for CME is right. As mentioned Philip, 2 hours is a better estimate of the ASA module, especially on a smaller area as the X 5516.

• Sourcefire learning resources

  Looking for a good book (or several books also) on Sourcefire / ASA with firepower, any recommendations?

  Are it certifications for Sourcefire? haven't seen any on the cisco learning site.

  Thank you

  No books that I know, but the config guide is decent. I took the in-class training and it is very good as well. There are some free resources on community partners also.

• Sourcefire DC1000 support?

  Cisco continues to support DC devices or clients who already have Defense Center devices need to purchase them trash and go FMC devices?

  Also is the same as the Cisco FirePOWER 8130 8130 3? Just different naming?

  For most Cisco products, we usually see a document EoL that lists all the EoL, EoS information and what is the upgrade path.

  the Sourcefire 3500 3, I found the EoL, information, EoS, but no upgrade path. That we go to?

  Thank you

  Defense Center devices continue to be supported until they have individual EoS / EoL announcements - like all other Cisco products. Only the name of the product has changed.

  That said, the DC750 and the DC1000 may have slipped through the cracks. There was an EoS DC1500 and DC3500 and the other two products (750 and 1000) no longer appear in the Cisco ordering system. (Although you can always order a new service contract).

  I believe that this version of the software 5.4.1.1 is available for older domain controllers.

  The 8130 3 is just a rebranding. It's the same product under running the same software.

  Upgrade for the Sourcefire 3500 3 would be along the lines of a power of fire Cisco 3 7125 or AMP 7150 (based on the flow rate and the General numbers interfaces). However, your environment should be assessed more closely to make an appropriate recommendation. We would take in required interfaces, current and projected account, features used etc.

• ASA 5545 firepower question X

  Hi all

  I have an urgent matter, I bougth 2 ASAs 5545 x with firepower, both ASAs Sourcefire inside of the Flash, but only has the State upwards.

  When I run the show module command,

  ASA1

  ==========================================================================================

  ciscoasa # sh module

  Model serial number of map mod
  ---- -------------------------------------------- ------------------ -----------
  0 ASA 5545 - X with SW, GE 8 data, 1 GE Mgmt ASA5545 FCH19207Y7G
  IPS unknown n/a FCH19207Y7G
  cxsc unknown n/a FCH19207Y7G
  SFR unknown n/a FCH19207Y7G

  MAC mod Fw Sw Version Version Version Hw address range
  ---- --------------------------------- ------------ ------------ ---------------
  d8b1.9040.ba11 0 to d8b1.9040.ba1a 1.0 9,0000 8 2,0000 4
  IPS d8b1.9040.ba0f to d8b1.9040.ba0f / o
  cxsc d8b1.9040.ba0f to d8b1.9040.ba0f / o
  SFR d8b1.9040.ba0f to d8b1.9040.ba0f / o

  The Application name of the SSM status Version of the Application of SSM mod
  ---- ------------------------------ ---------------- --------------------------
  IPS unknown current Image number does not apply
  cxsc unknown No. current Image does not apply

  Data on the State of mod aircraft compatibility status
  ---- ------------------ --------------------- -------------
  0 to Sys does not apply
  IPS does not is not Applicable
  cxsc does not not Applicable
  SFR does not not Applicable

  Mod name license status time remaining license
  ---- -------------- --------------- ---------------
  IPS IPS Module perpetual mobility

  =================================================================================

  ASA2

  ==========================================================================================

  ciscoasa # sh module

  Model serial number of map mod
  ---- -------------------------------------------- ------------------ -----------
  0 ASA 5545 - X with SW, GE 8 data, 1 GE Mgmt ASA5545 FCH19207Y7G
  IPS unknown n/a FCH19207Y7G
  cxsc unknown n/a FCH19207Y7G
  SFR FirePOWER Services Software Module ASA5545 FCH19207Y7G

  MAC mod Fw Sw Version Version Version Hw address range
  ---- --------------------------------- ------------ ------------ ---------------
  d8b1.9040.ba11 0 to d8b1.9040.ba1a 1.0 9,0000 8 2,0000 4
  IPS d8b1.9040.ba0f to d8b1.9040.ba0f / o
  cxsc d8b1.9040.ba0f to d8b1.9040.ba0f / o
  SFR d8b1.9040.ba0f at d8b1.9040.ba0f s/o s/o 5.3.1 - 152

  The Application name of the SSM status Version of the Application of SSM mod
  ---- ------------------------------ ---------------- --------------------------
  IPS unknown current Image number does not apply
  cxsc unknown No. current Image does not apply
   SFR ASA FirePOWER Up 5.3.1 - 152

  Data on the State of mod aircraft compatibility status
  ---- ------------------ --------------------- -------------
  0 to Sys does not apply
  IPS does not is not Applicable
  cxsc does not not Applicable
  SFR Up Up

  Mod name license status time remaining license
  ---- -------------- --------------- ---------------
  IPS IPS Module perpetual mobility

  =================================================================================

  I tried these commands to retrieve the firewall

  SW-module module sfr recover configure image disk0:asasfr - 5500 x-boot - 5.3.1 - 152.img
  SW-module module sfr recover boot

  The threshold of State the same thing, but I can connect to the module of firepower through console session sfr.

  Please can you help me?

  If you started the recovery image, you have a partial installation. You need to go in the module with the command of session and launch the installation. Once you have a Setup "bootstrap" in place, you can complete the recovery process by installing the full image.

  Something like this:

   ciscoasa# session sfr console Opening console session with module sfr. Connected to module sfr. Escape sequence is 'CTRL-^X'. Cisco ASA SFR Boot Image 5.3.1 asasfr login: admin Password: Admin123

  Then run the installation program, followed by 'system install' to load the full image (pkg) package as follows:

   asasfr-boot> system install ftp://@/asasfr-sys-5.3.1-152.pkg Verifying Downloading Extracting Package Detail Description: Cisco ASA-SFR 5.3.1-152 System Install Requires reboot: Yes Do you want to continue with upgrade? [y]: Y Warning: Please do not interrupt the process or turn off the system. Doing so might leave system in unusable state. Upgrading Starting upgrade process... Populating new system image Reboot is required

  Once you reboot, the module of sfr should show that up to. You can then connect back (using admin / Sourcefire), accept the EULA, and end with the re-definition of addressing, and then adding the definition of a Manager.

• Block the Page - Asa Firepower

  Hello world

  Now I m working with an ASA 5506 X and Sourcefire module, by now it s works well, but I have a problem with the calibrated block page (Https response) only works with Internet Explorer and the other browser does, and Don t show also the http response when the page is running with securty (HTTPS).

  URL filtering policies are working correctly, the problem is that I can't see the block page that I customized with browsers like Mozilla or Chrome and when the page uses port 443.

  No one knows why this happens?

  Thanks for reading. :)

  Hello

  For Https Web sites, we will not receive a message block, it is because https with encrypted data and fire power module does not have the ability to decipher the encrypted traffic. Only the material fire power and now the latest version 6.0 Drambuie devices will have the ability to decrypt SSL traffic.

  Only FirePOWER series-3 device support SSL at the moment so, this is the expected behavior.

  Kind regards

  Aastha

  Rate if this can help!

• Firepower supported devices

  There are differences in supported features of firepower for the series 2 and 3 materials. Is there a clear vision of what devices are series 2 and 3 series which devices?

  Material series 2 are the oldest brand devices Sourcefire. They were all end of 2012 sales or more.

  They include the following models: 3D500, 3 D 1000, 3 D 2000, 3 2100, 3 D 2500, 3500 3, 3 4500, 6500 3.

  All other dedicated NGIPS devices can be considered as the 3 series.

  (Modules ASA power of fire and any new firepower 9300 and 4000 series is in a separate category and neither series 2 or 3).

• FirePOWER vs 7000 Series Appliances Cisco Cisco FirePOWER 5000 Series Appliances and Security more

  Good evening

  I put this thread to better understand that we enter firepower vs FirePOWER 5000 Cisco Cisco 7000 series devices Series Appliances are stronger for AMP, IPS and URL protection.

  It is accurate to say that Cisco FirePOWER 7000 series devices is more powerful and safer such as defence AMP IPS and url vs Cisco Appliances of series 5000 firepower?

  about security Plus (a feature of the router ASA5506H-SP-BUN-K8) whose security it provides?

  have a good answer

  8000 and 7000 series devices are devices that came with the acquisition of Sourcefire. Strictly, they perform the Sourcefire software only and do not have the features of the ASA (routing, AnyConnect VPN and many others). They usually also provide larger flow capacities during execution of all services of firepower (IPS, AMP, AVC and characteristics of the URL). So if you don't need all the features ASA then the 7000/8000 series devices is probably a better choice.

  The ASA5500-X series includes the best of both worlds. The ASA and Sourcefire software are running on the same box. So you can still use all of the functionality of the SAA and then also re - direct specific traffic to the Sourcefire module for additional inspection.

  I hope this helps!

  Thank you for evaluating useful messages!

• error when downloading the software of firepower

  Hello team,

  We encountered some problems when downloading the software of firepower.

  See error below.

  #!/bin/sh
  # This script was generated using Makeself 2.1.5
  
  SHA512="f618026ab402b52d1c8b9714db5976f29413416e0935250943d96bcb62293b220bdefe199a3dee68daee99255243b201dcc03f3ac153d3b4287259f8d51f974c"
  CRCsum="910147708"
  MD5="c66a288f0f74d0bb79997f70b7a615c1"
  TMPROOT=${TMPDIR:=/var/tmp}
  RETURN_STRING="MD5"
  label="Sourcefire 3D Device S3 Upgrade / Thu Oct  2 16:38:40 UTC 2014"
  script="./upgrade.sh"
  scriptargs=""
  targetdir="upgrade-root"
  filesizes="570522744"
  keep=n

  Hi John,.

  Do not know what are these errors, but if you still can't download the software and then open evidence of the TAC, available engineer will publish the image of the software required for you.

  If it's because of a question of privilege, you can try to email him at [email protected] / * / as well with your contract information.

  I hope this helps.

  Kind regards

  Dinesh Verma

• Methods of deployment of firepower 7120

  Good day to all,

  Is it possible to deploy a firepower of 7120 in active/active, if yes is there a method that anyone can link me to a guide configuration?

  Thank you very much.

  Hello

  For 7120, you cannot configure stacking, but you can configure Clustering for same.

  Reference: http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/3d-system/5...

  Kind regards

  Aastha Bhardwaj

  Rate if this is useful!

• Security information about Sourcefire URL or IP address

  Hi all

  I have recently deployed module SFR on ASA 5512-X and I am faced with the following question: a Web site that is used on a daily basis is blocked since we deployed the service of firepower. In fact, it is classified as "Site of Malware" with a bad reputation "high risk."

  I've added this URL to a white list, so we can get there but the customer wants to collect information about why it's been categorized like that. My question is: is there a tool where you can see the history of a particular domain or IP address Sourcefire or Cisco?

  I checked on senderbase.org but there is no information like this and I know that Sourcefire does not anyway SenderBase.

  My guess is maybe that this site has been hacked in the past and delivers malware since.

  Thanks in advance,

  Vincent

  I think that Sourcefire using brightcloud as a web reputation. Check how by category is site you access.

  http://www.brightcloud.com/tools/change-request-URL-IP.php

• Configuration of firepower 5515 ASA

  Hi all

  Can someone help me to configure ASA 5515 with service of firepower.

  1. the environment IPsec VPN deployment.

  2. where to install the license of firepower.

  3. how to integrate with FireSIGHT VMware server.

  Thank you

  Kamlesh

  VPN traffic could be analized before encryption occur in the ASA, when you transfer the traffic to the module it supposed to be without any encryption and based on political access control you can perform any action on the traffic or the return traffic to the ASA and continue the process of encryption or build the VPN appliance of SourceFire.

• Virtual appliance for device of firepower

  Hello people,

  I have a few questions re: unit of firepower. We mixed environment of ASA 5505/5520/5540 5525 X ASA models. We know that we can get a software module model X and start using the power of fire - PoC complete.

  Here's the concern:

  -Can be used stand-alone device of fire power to integrate with the traditional ASA firewall?

  There he virtualization OPTIONS because we do not want to buy hardware

  Your response would be greatly appreciated!

  Thank you

  G1

  You can put the Cisco of Sourcefire hardware brand devices the legacy online with your ASAs older (or newer) who do not have the fire power modules.

  Similarly, you can route your traffic through a virtual sensor if your VMware ESXi (Xen or PHEVS) hosts can be configured to sit instead in your network. Here is a link to plug (still in the former location of Sourcefire salesforce.com).