CCNP - Securing Networks with Cisco Firepower NGFW

Explore a Cisco Firepower topology with FMC and ISE, configuring ANC, PxGrid lab, domain joined vs non-domain joined identity policies, and intrusion prevention on virtual devices.

Install FMC and FTD in routed mode on a simplified topology and boot them. Configure DMZ IPs, DNS, and HTTP servers, then verify management access and basic connectivity.

Boot the ftd and complete the asr-based installation, log in as admin, set a password, configure ipv4 manually, select routed firewall mode, and verify the management ip with show network.

Install the FMC first, then the FTD, noting a 40-minute boot time before configuration. Configure a manual IP with DNS and NTP, then login via HTTPS.

Explore the FMC GUI, switch themes, manage admins and users, configure licensing and domains, monitor health and policies, and build custom dashboards.

Add and register a firepower threat defense (ftd) sensor to the FMC, define registration keys and groups, attach licenses and policies, and verify deployment and health through back-end tasks.

Configure outside, inside, and dmz security zones, assign IPv4 addresses, explore interface types: sub, redundant, bridge group, and virtual tunnel; verify with show interface ip brief and ping tests.

Configure routing on the firepower ngfw with a default gateway, static routes, and ospf area zero. Implement rip version 2 and redistribution to connect dmz and internal networks.

Enable and configure platform settings in ftd to support ssh access from management network, dns name resolution, and interface binding for inside and outside networks, deploy, and verify with ssh.

Configure network discovery on the ftd to detect hosts, users, and applications by editing a policy and selecting inside and dmz zones, then deploy and monitor detection via network map.

Configure network address translation for inside, dmz, and outside networks using static and auto nat, manage address objects and groups, deploy changes, and enforce traffic with access lists.

Configure and deploy a Firepower NGFW access control policy, applying pre-filter and intrusion, DNS, identity, SSL, and file policies to manage inside to DMZ to outside traffic.

Learn to configure security intelligence with blacklists and whitelists, upload network lists to block specific IPs, and set up DNS policies to block app domains, with deployment insights.

Develop and implement DNS policies in Cisco Firepower NGFW, configuring DNS rules, domain not found blocking, and sinkhole behavior to illuminate who accesses blocked domains via security intelligence events.

Configure a dns sinkhole in Cisco Firepower by creating a sinkhole object, applying it to the dns policy, and deploying to redirect malware traffic.

Enable identity policy by integrating Active Directory with the FMC, configure realms, download domain users, enable discovery, and apply user-based access control to tag traffic and block apps for users.

Configure and verify the default intrusion policy in Cisco Firepower ngfw, deploy signatures, simulate an attack with kali linux, and verify automatic blocking of detected intrusions.

Configure a file and malware policy to detect and block files, including executables, and reset the connection when malware is found.

Configure SSL decryption on FTD, using the FMC as a CA to decrypt, resign, and inspect traffic between the inside network and the DMZ with a trusted certificate.

Apply Cisco Firepower policies by tracing how the FTD analyzes access control, intrusion, identity, and SSL policies through pre-filter and linear processing, ending with a Snort verdict.

Integrate the cloud-based advanced malware protection (AMP) with the Firepower Management Center (FMC) to centralize endpoint security, push rules, and view synchronized events.