When I’m working at a customer I try and setup as much task management by going to System>Tools>Scheduling, and using all the Add Task programs I can. I have to assume that about a week after I leave they will stop logging in and providing the advanced network analysis that I taught them (just like…
Did you ever deploy on your Cisco Firepower/FTD environment and then see something like this? First, understand that this does not mean your deployment failed, but instead the actual task is done but notification has never been cleared for some reason. First we’ll log into the FMC and move to root. Now we use the OmniQuery.pl…
Need to find or figure out the latest and greatest DNS servers? The best free public DNS servers include Google, Quad9, OpenDNS, Cloudflare, CleanBrowsing, Verisign, Alternate DNS, and AdGuard DNS. Here is a brand new shiny list of the best public DNS servers:
The long awaited replacement for the 5506 model is finally here and is called the Firepower 1010, and can now be found on their web site. This model has been sorely needed. There are a few other versions above this model- the 1120 and 1140, probably meant to replace the 5508 and 5516 Also, Cisco…
Here are some of the new features added to this release: IPv6 support Flexibility to clear CSM Inline grouping Selective Migration for NAT and routes (Do not migrate option) REST API for programmability 6.4 version support Support for new hardware (1000 series) Version 1.3 The Migration Tool allows you to connect to an ASA using…
A whole bunch of RDP users starting losing connections with RDP Error 0x609 when traversing Cisco Firepower Snort because of an update that was sent out by Cisco Talos. Here is how to fix this without disabling your entire IPS inspection. First, here is the update that caused this issue: let’s take a look at…
Okay, so in my last couple blogs I mentioned some undocumented or hidden “features” in the new code. Here is a reminder of the two I already mentioned: If you blacklist an IP address, the address is immediately blacklisted and all communication stops. However, in the past, if you wanted to remove the IP address…
The Todd Lammle Cisco Firepower TidBit provides cool features of Cisco Firepower/FTD in just a couple minutes! Cisco’s Firepower/FTD FastPath, Blacklist & White list. What does that have to do with the Dreaded Pirate Roberts from Princess Bride? Watch move Tidbit Of the Day (TOD) to find out!
This TidBit of the day will provide cool features of Cisco Firepower/FTD in just a couple minutes! So I received this questions from a reader: What is the best easy way to exempt a host or network from a specific snort signature/rule? I want to prevent traffic from being dropped if the source IP is…
This Tidbit of the Day will provide cool features of Cisco Firepower/FTD in just a couple minutes! In this Tidbit of the Day (TOD), I will show you how to find a hidden feature in the Dashboard>Overview in order to se your IPS “Would have Dropped” events
In the late 1990’s Dale Carnegie wrote what would become one of the most famous and popular business books ever to be written: “How to Win Friends & Influence People”. I am pretty sure that Cisco Talos has Fed Ex’d me a copy by now… In one of my current blog posts titled (4/13/19): “Which IPS…
This is a follow up blog from my initial writeup on the release of Cisco Firepower/FTD 6.4 code release. I mention in that blog that I had class that week and was going to thoroughly test the new 6.4 code, and then write a new blog on my recommendations, so here we are. To cut…
The new Cisco Firepower 6.4 code has some great features. Something for Cisco to be proud of, and I’ll list a few of the top ones in this short article. However, it seemed to me that this release had less fanfare than say the “make it or break it code of 6.2.3”, or the “powerful…
Are Law Enforcement Agencies using your equipment to spy on you or others without you even knowing? Possibly! Lawful intercept is a process that enables a Law Enforcement Agency (LEA) to perform electronic surveillance on an individual (a target) as authorized by a judicial or administrative order. Congress requires that service providers (SPs) and Internet…
So, think you know what IPS rules are enabled on your Firepower system, and do you feel comfortable with Cisco’s defaults and sleep well at night? This blog may just start keeping you up at night! A couple weeks ago I was training/consulting at a very large school district outside of Columbus, Ohio. They have…
This post goes hand-in-hand with my FMC blog Cisco FTD devices are expensive!…and they are announcing new more expensive one’s next week…here are the current as of right now: Cisco’s 2100, 4100 and 9300 FTD Devices So which one of these expensive FTD devices do you need? Did you know it’s actually pretty easy to…
In all my travels, I go to a whole heck of lot of customers with various Firepower gear and different FMC’s. What I have found is that most of my customers have either been oversold or undersold on the processing/storage/memory for their hardware FMC. To the sales persons defense, finding the right FMC for a…
…So in the last month, I had a couple customers that saw wildly different ICMP/PING delays when testing through an FTD box, however, I couldn’t replicate the issue on FTD boxes that weren’t running on top of FXOS meaning that I only saw the issue with 4100/9300’s. Cisco finally released a bug and fix, which…
Cisco Bug CSCvn57284 – Unsupported EC curve x25519 on FTD I just started running into this the last couple of days. About 1/3rd of the SSL websites I try to view with SSL decryption enabled fail with a SSL Block and the error “UNSUPPORTED_EC_CURVE (0xb9001d57)” in the connection log. Based on the x25519 curve in…
I just can’t post all the bugs and fixes from Cisco, but over the last day or so Cisco has received thousands of calls on this bug – almost more than any other! So it’s worth your time to read… It’s an older bug, but I’d wager that it recently got added to someone’s attack…
Here is what the documentation tells you about VPN traffic in 6.3. It’s an interesting read. Pay attention to the part I bolded: Quote From 6.3 Release notes: Changed default behavior for VPN traffic handling in the access control policy (sysopt connection permit-vpn ). The default behavior for how VPN traffic is handled by the…
There are a couple new important changes in Firepower 6.3 code that fixed issues for a lot of my customers and all of my students. I had always known the work arounds for these issues, but by the time a customer either came to class or contacted me, they were frustrated beyond all belief. I…
The new Cisco Firepower 6.3 code has a new feature, but you may find it more annoying than not. As soon as you login to your FMC you will be treated with a “How To” link on the bottom right of the FMC. By clicking this, you will receive a menu that you can use…
There is a new Specific License Reservation available for approved customers. This allows the using the Firepower Management Center (FMC) on an air-gapped network. Previously, the only way to use the smart license feature was to have either Internet access or a satellite license server. Now a special license can be installed which is valid…
Well, the release of Firepower 6.3 is now upon us! This release brings several long awaited features including multi-instance and FQDN Access Control rules. Let’s take a closer look at some of the highlights. Licensing There is a new Specific License Reservation available for approved customers. This allows the using the Firepower Management Center (FMC)…
What does Cisco LINA stand for? What is Cisco LINA? Both really good questions…. LINA The Cisco ASA uses a single monolithic binary (ELF) running directly on the main CPU and the ASA firmware is a Linux operating system running a single ELF called LINA. The older PIX devices ran on a custom OS called…
Nov 5th & Dec 3rd week Firepower/FTD students: There are now close to 80 hands-on labs in my intense Firepower/FTD class! www.lammle.com/firepower Receive my new FTD 6.2.3 full Video series! Rent Pods to practice labs!
In all my years of working with SourceFire and then ASA with Firepower, and now Firepower Threat Defense (FTD), I’ve never had a single problem with the VDB – until this week. Cisco put out a BAD VDB (300) that deletes the applications in your ACP. This is pretty horrible right? So let’s just delete…
Update to this post 4/15/2019 Cisco is going to be releasing a new FTD migration tool soon. Cisco has added optimizations to the tool, to help users drop objects that are not reference in any of the rules, or to disable rules that have not been hit over time. Firepower Migration Tool is the one…
Todd Lammle, LLC Cisco Firepower & Pure FTD class will teach you the fundamentals from the ground up, with no Power Points & only real life labs, how to configure, monitor and troubleshoot Firepower, and truly understand the FTD packet flow, which is critical to managing enterprise level Firepower clients. This is the only pure…
Customers and students always ask me how to see what is in the Firepower objects updated by the Cisco feed, so this blog will show you how to find this information. Security Intelligence is an object category that contains three different types of objects. These are: Network DNS URL You can find and manage all…
Let’s to through the directions on how to perform downloading advanced troubleshooting files on a 2100 as well as a 4100/9300. The commands are only slightly different between the 2100 and 4100/9300; understand that the 2100 only will create one file, and the 4100/9300 creates from 3 to 5 files, depending on the modules installed.…
Password Reset First, here is how you reset the password, and then we can get in and reset the box back to factory default 1. Reboot 2. Use BREAK, ESC or CTRL+L to interrupt boot 3. Find the boot flash command and make a note of kickstart image and system image 4. Load the kickstart…
There are 3 types of streamer issues in the Cisco Firepower FMC and in different releases. The first is the enforcement of TLS, which was introduced in 6.1. That broke the most integrations. The second issue is eStreamer documentation requires a two-way SSL authentication. At some point, the client part of authentication started failing because…
It’s hard to understand how to traverse the CLI prompts when your in the 4100/9300 FTD devices. Here is a diagram on how you can easily traverse the Cisco FTD CLI from the FXOS module. By using these commands, you won’t have to open a CLI to the FXOS AND to the FTD console.
So many customers and students ask me about how to see the NAT events in their FMC and my answer is no way, nada, nope – not going to happen. By looking at the detailed packet flow of Cisco FTD devices posted in an earlier post, we can understand why we can’t see the Lina…
It’s important to understand the packet flow for a FTD device. By understanding the flow you can both troubleshoot and create true policy, and knowing your detection process will impact 2 things: • How you analyze the data • How you tune your security appliance Optimizing detection also becomes easier when you understand the complete…
If you have a Cisco FTD high end product such as the 4100 and 9300, then you may find this post important, or at least somewhat interesting. First, if you are in expert mode from your FTD device and perform a ifconfig -a, then you’ll find some IP’s in use for internal management. When a…
When configuring the Firepower eXtensible Operating System (FXOS) on the 4100 and 9300 FTD devices, one of the first duties you need to perform is to configure your management and event interfaces, and once you’ve done this a couple times you find that it’s rather easy. However, if you need to change your management channel,…
*UPDATE: I have not seen this error since using FTD 6.2.3 code* Cisco Firepower FTD devices receive “invalid uuid passed to GetDEConfigMetadata” error when you try and deploy. It maybe possible that Cisco can fix this on your FTD maybe, just maybe, but its just faster to erase and reinstall the FTD software on your devices…
My new 6.2.3 Intensive Hands-on FTD class is out! Starting 4.2.18 class! I have new book printing as well as a new video series all coming out in a few weeks on the new Cisco Firepower Threat Defense (FTD) 6.2.3 Here is the outline for the book, videos series, and my class labs…attend my class…
*UPDATE: I have not seen this error since using FTD 6.2.3 code* When you receive the following error there is no other option other than to erase and reinstall the FTD software I’ve tried everything to fix it, and the FTD health and device status is excellent, but it just won’t deploy! I can reproduce…
If you’ve never seen an Automatic Application Bypass (AAB) error occur on your Cisco FMC, which means your SNORT is about to restart, then this is a way to get experience with such an error, although I doubt Cisco had this in mind for their SSL policy and Firepower. Understand this isn’t only a “Cisco”…
Are torrents bad? Wow, yes! One of first few rules in the ACP created for all my customers have to do with torrents. Torrents are a horrible thing on any network, even if only one host has it! I’ve been telling my clients and students for a long time about BitTorrent issues with Cisco Firepower/FTD. Cisco…
Actually, this is normal because the lina process is constantly polling the Network Interface Cards (NICs) for input traffic. In short, the lina process utilization can be safely ignored. Key Takeaway: Firepower Threat Defense is a unified operating system consisting of 2 engines (ASA and Snort). The FTD CLI shows that ‘lina’ process (ASA engine)…
Since 6.2.2.2 came out, this new code fixed a laundry list of issues, although we’re all still waiting for 6.2.3 code which is considered Cisco “Make it or Break it” code release… Error found on FTD devices: Upgraded 20 of my student pods to the latest 6.2.2.2 code for the FMC (6.2.2.2-109), which included the…
Open you ASA CLI, and if you are at the > prompt (because you had the SFR module installed), press Ctrl-Shift-6 Ctrl-Shift-6-X to get back into the ASA. Verify the ROMMON version with sh module. Version MUST be 1.1.8 or higher. If it is lower, please follow these direction: If needed: Copy the ROMMON image…
Sign up for my new Viptela 4-day Online class here with more dates coming! Get more information on why Cisco bought Viptela here FROM CISCO: Cisco iWAN technology is natural evolution of DMVPN. DMVPN was introduced by Cisco 15 years ago around 2002. Biggest driver for the technology was hybrid WAN, which provided the customers…
Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability Critical Advisory ID: cisco-sa-20180129-asa1 First Published: 2018 January 29 17:00 GMT Last Updated: 2018 January 29 22:33 GMT Version 1.2: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvg35618 CVSS Score: Base 10.0 CVE-2018-0101 CWE-415 Download CVRF Download PDF Email Summary A vulnerability…