Cisco NGFW Firepower Threat Defense (FTD) Training Part-2/2

Understand intrusion policy, an ips using Snort rules to detect or prevent malware, with default base policies and choices for balanced security and connectivity.

Configure and verify variable sets for intrusion policies in Cisco NGFW Firepower Threat Defense, including defining home net and external net and tailoring variables to optimize snort rule processing.

Learn how the intrusion policy main page manages ips policies, including maximum detection vs balance connectivity, snort rules, generator IDs and sid, and rule states (drop, generate, alert) and recommendations.

Configure and verify intrusion policy in Cisco FTD lab by attaching it to the access control policy, deploying, and testing with Kali Linux attacks to observe blocks.

Create and deploy a custom intrusion rule in Cisco FTD to block a DDoS attack on port 80, then verify it via FMC intrusion events and logs.

Define NAT and PAT concepts in FTD, contrast real with mapped IP and port, and outline manual net, auto net, and manual net after auto.

Explore static net NAT in Cisco FTD, performing 1-to-1, bidirectional IP translation from inside to outside using manual and auto rules, with object creation and lab verification.

Configure static PAT (port forwarding) on Cisco FTD, translating IPs and ports for inside to outside traffic, then verify with telnet tests and show net.

Learn how dynamic NAT maps an inside subnet to a pool of public IPs, including manual and auto dynamic NAT, first-come-first-served allocation, and handling IP exhaustion with lab verifications.

Explain how to configure dynamic pat to translate an inside subnet to a single public ip with per-session ports, and compare manual, dynamic net, and extra ip options, verification steps.

Configure and verify PAT pool and PAT options in Cisco FTD to translate internal subnets to multiple external IPs, using round-robin and extended PAT table.

Explore identity net concepts for site-to-site VPN, including net exemption, translation of IP addresses, and manual vs object/net configurations to keep IP consistency and enable VPN reliability.

Define and verify manual policy NAT on Cisco FTD using policy net rules that translate a source to a destination IP based on destination conditions, applying if-else style translation.

Configure a span port to copy traffic to the FTD in passive mode, where the IDS detects intrusions and logs events for monitoring, reporting, and audit without blocking.

Configure and verify Cisco FTD inline and inline tap modes, enabling next-generation IPS, access control and intrusion policies to inspect, block, and log traffic in a paired inside/outside interface setup.

Configure and verify Cisco FTD transparent mode by bridging two interfaces at layer 2, creating a bridge group with a bridge-virtual-interface, and assigning the same IP range.

Configure redundant interfaces to pair two physical ports into an active and standby link, ensuring no downtime. The standby adopts the active MAC address to preserve ARP entries.

Explains redundancy and high availability concepts for ftd, detailing failover, active/standby versus active/active limitations, clustering, prerequisites like identical model and interfaces, and the roles of failover and state links.

Configure and verify active/standby high availability for Cisco FTDs via FMC, register two devices, set failover and stateful links, and enforce access control and net policy for seamless failover.

Explain multi instances in FTD as hardware-based partitioning, contrasting it with security context, and outline its requirements, including FTD 6.3+, specific devices, and non-virtual deployment.

Explain quality of service principles, including bandwidth, delay, jitter, and packet loss, and apply classification, marking, policing, queuing, shaping, and congestion management to prioritize sensitive traffic.

Configure and verify quality of service (QoS) in FTD, create a policy, apply it from inside to outside, and validate with file transfers and browser traffic using FMC and CLI.

Explore the basics of cryptography, including plain text, ciphertext, encryption, decryption, and terminology, with examples like the Caesar cipher and vinegar cipher.

Explain symmetric and asymmetric encryption, from plaintext to ciphertext, compare fast same-key methods with secure key exchange to slow public-key cryptography, illustrated by AES and RSA.

Learn cryptography basics: hash functions for data integrity, md5 and sha flavors, and hmac; and review symmetric encryption like des, 3des, and aes.

Learn how IPsec provides confidentiality, integrity, and authentication for site-to-site and remote-access VPNs, compare ESP and AH, and explore NAT-T and tunnel versus transport modes.

Explains Diffie-Hellman group concepts for VPN key exchange, showing how prime numbers, generators, and private keys derive a shared secret, with elliptic curves as stronger options.

Explore how SSL and TLS provide authentication and confidentiality for web traffic and emails, including the handshake, certificates, public keys, and TLS versions 1.2 and 1.3.

Explain internet key exchange under IPsec, covering IKE versions 1 and 2 and the two-phase process for site-to-site VPNs, including main, aggressive, and quick modes.

explain ike phase 1 with main mode and aggressive mode, showing six packets in main mode (four unencrypted, two encrypted) and three in aggressive mode, plus phase 2 quick mode.

Learn policy based and route based site-to-site vpn configurations on Cisco ngfw threat defense, including virtual tunnel interfaces and encryption domains. Compare topology options and the policy vs route differences.

Register two ftd devices with the same fmc and configure a policy-based site-to-site vpn using ike version 1 with pre-shared key, encrypting 192.168.1.0/24 to 192.168.2.0/24.

Explain why NAT exemption with identity net and policy net is essential for site-to-site vpn encryption. Demonstrate a lab setup translating private IPs to public ones to enable internet access.

Configure and verify Cisco AnyConnect remote access VPN on FTD, using SSL-based and client-based options, RADIUS authentication with ISE, a VPN pool, split tunneling, and certificate provisioning.

Explore the three Cisco FTD command line interface modes—regular FTD mode, leaner diagnostic mode, and expert mode—and how to access them via SSH, Telnet, console, or auxiliary.

Master troubleshooting for Cisco FTD using top-down, bottom-up, and follow-the-traffic-path approaches; define problems, gather facts, create action plans, implement, observe, and document results.

Learn to use Cisco FTD's advanced troubleshooting in FMC, exploring CLI and GUI tools, including ping, traceroute, show commands, packet tracer, packet capture, and generating downloadable troubleshooting files.

Master Cisco packet tracer for proactive troubleshooting of Firepower threats by simulating packet flows through gui and cli, validating ACLs, net rules, route lookups, IPS/IDS, and IP options.

Master packet capture on Cisco FTD using CLI and GUI; perform traffic captures for firepower engine and other engines, apply filters (host, dst, vlan), and save or download pcaps.

Explain the difference between firepower engine and firewall engine using pre filter policy and fastpath, and use capture traffic to show which engine handles ICMP traffic.

Learn to monitor and report with Cisco FMC using dashboards and widgets, switch dashboard views, and Context explorer to generate risk and standard reports in HTML, PDF, or CSV.

Learn how the Cisco threat intelligence director integrates third-party intelligence via taxi, enabling an extra line of defense by using observer and indicator concepts to block or monitor threats.