Cisco Firepower 2100, Getting Started Manual

Page: 156 / 222

• Identity —If you want to correlate network activity to individual users, or control network access based
on user or user group membership, use the identity policy to determine the user associated with a given
source IP address.
• Security Intelligence —Use the Security Intelligence policy to quickly drop connections from or to
blacklisted IP addresses or URLs. By blacklisting known bad sites, you do not need to account for them
in your access control policy. Cisco provides regularly updated feeds of known bad addresses and URLs
so that the Security Intelligence blacklist updates dynamically. Using feeds, you do not need to edit the
policy to add or remove items in the blacklist.
•
Access Control
—Use the access control policy to determine which connections are allowed on the
network. You can filter by security zone, IP address, protocol, port, application, URL, user or user group.
You also apply intrusion and file (malware) policies using access control rules. Use this policy to
implement URL filtering.
The following example shows how to allow traffic between the inside-zone and dmz-zone in the access control
policy. In this example, no options are set on any of the other tabs except for
Logging , where At End of
Connection is selected.
Figure 48: Access Control Policy
Step 9 Locate the
Security Database Updates
section to create a scheduled task to check and update the security
databases for an FTD device.
When you onboard an FTD device to CDO, part of the onboarding process allows you to
Enable scheduled
recurring updates for databases
. This option is checked by default. When enabled, CDO immediately checks
for and applies any security updates as well as automatically schedules the device to check for additional
updates. You are able to modify the date and time of the scheduled task after the device is onboarded.
If you are using intrusion policies, set up regular updates for the Rules and VDB databases. If you use Security
Intelligence feeds, set an update schedule for them. If you use geolocation in any security policies as matching
criteria, set an update schedule for that database.
Step 10 Click the Preview and Deploy button in the menu, then click the Deploy Now button, to deploy your changes
to the device.
Changes are not active on the device until you deploy them.
Cisco Firepower 2100 Getting Started Guide
154
Firepower Threat Defense Deployment with CDO
Configure the Device in CDO