Cisco Add FirePOWER Module to FirePOWER Management Center

Posted on 25/04/2016 by PeteLong

KB ID 0001178

Problem

If you only have one FirePOWER service module you can now manage it from the ASDM;

ASA 5505-X / 5508-X Setup FirePOWER Services (for ASDM)

But if you have got more than one, and you can manage them centrally with the FirePOWER Management Center, (formally SourceFIRE Defence Center).

WARNING: If you are going to use FMC DON’T register your licences in the ASDM, they all need to be registered in the FMC.

Solution

Before you can register the SFR module in the FMC, you need to have set it up, and have ran though the initial setup. The process is the same if you intend to use the ASDM or the FMC. You can then choose whether to register from command line in the SFR, or via the ASDM.

Register SFR with FMC via Command Line

Connect to the parent firewall and open a session with the sfr module;

[box]

PETES-ASA# session sfr
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.

PETES-SFR login: admin
Password:{pasword}
Last login: Fri Apr  8 05:04:49 UTC 2016 on ttyS1

Copyright 2004-2015, Cisco and/or its affiliates. All rights reserved.
Cisco is a registered trademark of Cisco Systems, Inc.
All other trademarks are property of their respective owners.

Cisco Fire Linux OS v6.0.0 (build 258)
Cisco ASA5506 v6.0.0 (build 1005)

>

[/box]

You can then add the FMC as a manager, you will need to supply a registration key.

[box]

> configure manager add 10.9.20.25 password123
Manager successfully configured.
Please make note of reg_key as this will be required while adding Device in FMC.

[/box]

Register SFR with FMC via ASDM

Connect to the ASDM > Configuration > ASA FirePOWER Configuration > Integration >Remote Management > Add Manager.

Specify the IP of the FMC Appliance, and registration key > Save.

It should then say ‘pending registration’.

Configure the FirePOWER Management Appliance to Accept the SFR Registration

Log into FMC > Devices > Device Management > Add Device.

Provide the IP of the SFR module, a display name, the registration key you used above. If you have setup a group you can use it and select your Access Control Policy (dont panic if you have not configured one yet) > Register.

It can take a while, but eventually it should register like so;

Problems

Could not establish a connection with sensor. Make sure the registration keys match, that the software versions are compatible,and that the network is not blocking the connection.

Had this problem for a while, (Credit to Craig Paolozzi for finding the fix.) Both the SFR, and the FMC console needed static routes adding to them (even though they could ping each other!) Pointing to each other.

Cisco FirePOWER – Update Fails ‘Peer Registration Failed: Registration in Progress’

Posted on 02/03/2016 by PeteLong

KB ID 0001162

Problem

If you attempt to perform an update on the FirePOWER services module in your firewall, you may see the following error;

Error
Installation Failed: Peer registration in progress. 
Please retry in a few moments

I found myself in this situation because I’d attempted to register the firewall in the FirePOWER Management Center Appliance, and the process failed, (because the versions were different). So when I attempted to update the firewalls sfr module to match, it then fails because it’s waiting to register with the management center, (Catch 22).

Solution

Essentially you need to ‘kill’ the registration then, perform the upgrade and then attempt to add it as a managed device again. You can do this from within the ADSM. Configuration > ASA FirePOWER Configuration > Integration > Remote Management > Locate the registration and ‘Delete’.

Usually it says its ‘failed’, I’m assuming it’s referring to the peer registration itself, because it does get removed.

You can then attempt to do the upgrade, (which takes ages by the way!)

Note: I’ve also found you need to manually restart the sfr module when its complete. The upgrade takes ages on small firewalls like the 5506-X its a bit quicker on the larger firewalls like the 5515-X, but I would still leave the update running overnight and then restart the module in the morning.

FMC – AMP Malware Inspection

Posted on 15/02/2016 by PeteLong

KB ID 0001159

Problem

If you take a look in your SourceFire dashboard, and there is no data shown on the malware threat section like so;

Solution

The message is pretty descriptive, and it’s telling you exactly what you need to do. Now I’m making the assumption that you have added a valid AMP / Malware licence like so;

Policies > Access Control > Edit your access control policy > Then Edit the file policy.

Add in “Block Malware with Reset”.

You can test the rule is applying correctly by trying to download the eicar test infected files;

Then after a short time, you should start to see the malware threats window start to show some data.

Cisco FireSIGHT – Enable Active Directory (LDAP) Authentication

Posted on 17/11/2015 by Migrated

KB ID 0001102

WARNING this is for older versions of the FirePOWER Management Platform, go to the following link for newer versions

Cisco FirePOWER Management Appliance – Allowing Domain Authentication

Problem

To save you creating multiple users on your FireSIGHT appliance, and assigning roles to them you can utilise your existing Active Directory. In fact FireSIGHT does a good job of enabling granular administration based on AD Groups, by assigning them to ‘roles’ on the appliance.

Below I’m just going to create one AD group and assign the administrator role to that group,as you would in a small organisation. but I will point out how to enable RBAC on the appliance.

I had to work out how to do this, because the official documentation just does not work? Or at least it did not work for me with my 2012 R2 domain controller.

Solution

1. Log into FireSIGHT > System > Local > User Management > Create External Authentication Object.

2. Authentication Method = LDAP > Name = Something descriptive > Description = {optional} > Primary Server IP = IP of you Domain Controller > Port = 389.

Note: If you change the authentication method below to SSL the port will automatically change to 636 (LDAPS).

3. Enter a secondary domain controller IP if you have one.

4. In my AD I’ve created a user for the appliance to connect to AD with (svc_sourcefire), and a group called Sourcefire-Admins that I’ve put my administrative users in.

5. In the FireSIGHT console you have to enter domain objects by their DN. If you’re unused to using DN notation, on the domain controller run LDP (Connection > Connect > Server=Localhost > OK > Connection > Bind > OK > View > Tree > OK) In the left window you can expand and navigate up and down your domain tree. When you find th group/user you want right click copy DN, Then you can paste it into FireSIGHT without having to write it out.

6. Set the Base DN (usually the root of the domain) e.g.

[box]DC=petenetlive,DC=com[/box]

Enter the DN for the user the appliance will use to bind to Active Directory, e.g.

[box]CN=svc_sourcefire,OU=Service-Accounts,DC=petenetlive,DC=com[/box]

Enter the user (above) password. Set the UIAccess Attribute and the Shell Access Attribute to;

[box]sAMAccountName[/box]

Note: The drop down arrow unlocks the advanced options if you wanted to use LDAPS then this is where you would select it and upload the root CA certificate.

7. Expand Group Controlled Access Roles (Optional) > Enter your AD group against the role you want to assign to it e.g.

[box]CN=Sourcefire-Admins,OU=Service-Accounts,DC=petenetlive,DC=com[/box]

Note: These are the built in roles, you can clone and create new ones. (System > Local > User Management > User Roles).

Set the Default user role to ‘Security Analyst (Read Only)’.

8. Group Member attribute = member > Shell Access Filter = ‘Same as Base Filter’ > Username enter an administrative username form the group you specified above > Password = password for the user you are testing > Test.

Note: Shell Access Filter wont actually do anything in this instance.

9.You will get a lot of info, but hopefully you will see ‘Success’.

10. Now you need to use this authentication method for the appliance. System > Local > System Policy > Select the policy in use > Edit, (pencil icon).

11. External Authentication > Status = Enabled > Default User Role = Security Analyst (read Only), No I don’t know why you do this twice > Change the ‘slider button’ to enabled > Save Policy and Exit.

12. Because the policy has changed and not updated > Update.

13. Select All > Apply.

14. Success.

15. You can not log in with your administrative AD accounts.

16. You will also notice the users appear under local user management > Users.

17. You could, (if you wished) Untick the ‘Use External Authentication Method’ option and turn this user into a ‘local’ user.

PeteNetLive

Technology that 'Just Works'

Tag Archives: Sourcefire

Cisco Add FirePOWER Module to FirePOWER Management Center

Problem

Solution

Register SFR with FMC via Command Line

Register SFR with FMC via ASDM

Configure the FirePOWER Management Appliance to Accept the SFR Registration

Problems

Related Articles, References, Credits, or External Links

Cisco FirePOWER – Update Fails ‘Peer Registration Failed: Registration in Progress’

Problem

Solution

Related Articles, References, Credits, or External Links

FMC – AMP Malware Inspection

Problem

Solution

Related Articles, References, Credits, or External Links