Tim's Technology Journey Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
=====Engineer Howto -  Firewalls - 9300 Conversion from 5585=====
This document will cover the process to convert existing Cisco 5585 ASA firewalls to the Cisco Firepower 9300 firewalls.

====High-level Overview====
  * Day 1	Verify cabling and hardware. Input system and admin context configuration to each FW. Verify remote connectivity; Terminal Server (TS) if necessary. Begin upload of contexts (~100) per each FW; no method to bulk upload.
  * Day 2	Complete context upload. "Activate" each context on each  FW (This is involves deleting each context config from the system config then re-applying the config on each FW) Verify F5 pools are up for each context. Troubleshoot any downed pools
  * Day 3	Complete security hardening. Begin CSM rediscovery
  * Day 4	Complete CSM rediscovery.


====9300 Workflow====
  - Reference this document to configure the 9300 chassis from fresh out of the box.
    - {{:cisco:asa:9300_conversion_from_5585:implementation_guide_cisco_firepower_9300_integration.docx |_Cisco Firepower 9300 Implementation Guide}}
  - Work start
    - Verify customer traffic isn't traversing the device.
  - On the mgmt-sw, the following commands can be used to form a template to change the port descriptions: Note: The F5 and 9300 mgmt connections all belong in VLAN 99.
    - <code>show config | display set | match f5</code>
    - <code>show inter desc | match f5</code>
    - <code>show config | display set | match TenGigabitEthernet 0/0/0</code>
    - <code>show configuration interfaces ge-0/0/0 | display set</code>
    - Then modify the description. Refer to another site's descriptions.
  - Port testing is very important.
  - Make sure the removable trays in the back of the 9300 chassis can be removed. No power cords in the way.
  - Back a backup of the 5585 configs.
  - Enable ASDM and create a .cfg of the system context
    - <code>changeto context system
copy running-config disk0:/system.cfg</code>
    - To enable ASDM access, on the firewall:
      - <code>changeto context admin
conf t
http server enable
http 192.168.0.0 255.255.255.0 mgmt !(Note: mgmt has to be replaced with whatever the management interface's nameif is defined as)
ssh 192.168.0.0 255.255.255.0 mgmt
wr
end
exit</code>
    - Make sure http is allowed via AAA
      - <code>show run | i http</code>
      - Example: **aaa authentication http console global-tacacs LOCAL** (Note: http has to be present)
  - Log into each 5585 FW and download all the CFGs
  - After all CFGs are downloaded AND the traffic is failed over, the 5585 can be replaced with the 9300. Port test the copper and fiber. Modify switch interface descriptions, modify Mgmt SW descriptions, and modify TS Menu

====Modify the 5585-formatted .cfg Files to 9300-formatted====
  - Make a backup of the 5855 directory and rename it for the 9300 conversions. ie: a1-9300
  - Open Notepad++ and close all documents, but save any you need. File-->Close All
  - Open the directory with all the contexts that are to be modified.
  - Select the admin.cfg and system.cfg files
    - Delete the following lines in the admin context:
        * enable password
        * username admin
    - Delete the following lines in the system context:
        * enable password
        * boot system
        * ntp
        * username admin
        * Delete the admin context
          * <code>context admin
allocate-interface Management0/0 
config-url disk0:/admin.cfg</code>
  - Open the directory with all the contexts that are to be modified.
    - Select all files. CTRL+A
    - Unselect the admin.cfg and system.cfg (already are open in Notepad++)
    - Right-click and select Edit with Notepad++
      * This will open all files within Notepad++
      - <code>Search for ** and make sure all passwords are visible</code>
        - Search-->Find
          - <code>Find what: **</code>
          - Make sure **In selection** is not checked and the Search Mode is **Normal**
          - Find All in All Opened Documents
      - This next section will cover modifying the interface names.
        - Search-->Replace
        - The following table will define the A1 firewalls<WRAP>
^ Find what ^ Replace with ^
| Management0/0 | Ethernet1/8 |
| TenGigabitEthernet0/6 | Ethernet1/1 |
| TenGigabitEthernet0/7 | Ethernet1/2 |
| TenGigabitEthernet0/8 | Ethernet1/3 |
</WRAP>
        - The following table will define the A2 firewalls<WRAP>
^ Find what ^ Replace with ^
| Management0/0 | Ethernet1/8 |
| TenGigabitEthernet0/6 | Ethernet1/5 |
| TenGigabitEthernet0/7 | Ethernet1/6 |
| TenGigabitEthernet0/8 | Ethernet1/7 |
</WRAP>
        - File-->Save All
        - Close all contexts except the system context
        - Make a backup of the system context called contexts.txt
        - In the System context:
          - Search-->Mark
          - Find what: **config-url disk0**
          - Select Bookmark line
          - Click on Mark All
          - Search-->Bookmark-->Remove Bookmarked Lines
          - Save the context file
        - In the backup System context file, called contexts.txt
          - Search-->Mark
          - Find what: **config-url disk0**
          - Select Bookmark line
          - Click on Mark All
          - Find what: **context**
          - Select Bookmark line
          - Click on Mark All
          - Search-->Bookmark-->Remove Unmarked Lines
          - The only lines left are the context and config-url lines for each context.
          - Delete any extra lines at the top and bottom of the file.
          - Save the context.txt file
      - Now all contexts, except the backup System context can be added to the 9300.

====Add the Customer Contexts to all CSMs====
  * The next section will be done in the CLI
  - For the admin and System contexts, just copy/paste into the CLI.
  - For the System context, paste a few context sections back in at a time and save often.
    - When the System context and all the tenant context files are added to the 9300, the backup System context file can be copy/pasted in, one context at a time.
  - Upload customer CFGs to respective 9300 FW via ASDM
  - Diagram of the 9300
    * {{:cisco:asa:9300_conversion_from_5585:firepower_firewall_integration_diagram.png?1000|}}

====Generate Crypto Keys and SNMP configs====
  * The next section will be done in the CLI for all contexts
  * All crypto keys will be regenerated in all contexts.
  - Do one context at a time. The branch-1 context will be used as an example throughout. Commands are in bold. Please make sure you perform the following under the context you're working on. 
    - Log into the context to regenerate the crypto keys
      - <code>changeto context branch-1
conf t
crypto key generate rsa modulus 2048
yes !(yes is just to overwrite any existing keys)
wr</code>
  - Complete the hardening checklist
  - Verify network monitoring devices can communicate with the firewalls.
  - Do one context at a time. The branch-1 context will be used as an example throughout. Commands are in bold. Please make sure you perform the following under the context you're working on. 
    - Log into the context to regenerate the crypto keys and rebuild the snmp-server config
      * Replace **pass123** with the correct password in the template below
      * Replace the snmp-server IP and site name with the correct variants in the template below
  - Could use a copy of the context.txt file and replace **config-url** with the crypto key and snmp config sections
  - <code>changeto context branch-1
conf t
clear config snmp-server
crypto key generate rsa modulus 2048
yes !(yes is just to overwrite any existing keys)
snmp-server group globalgroup v3 priv
snmp-server user branch-1 globalgroup v3 auth sha pass123 priv aes 128 pass123 
snmp-server host mgmt 192.168.24.15 poll version 3 branch-1
snmp-server host mgmt 192.168.24.16 poll version 3 branch-1
snmp-server host mgmt 192.168.24.17 version 3 branch-1
snmp-server host mgmt 192.168.24.11 trap version 3 branch-1
snmp-server host mgmt 192.168.24.13 poll version 3 branch-1
snmp-server host mgmt 192.168.24.27 poll version 3 branch-1
snmp-server host mgmt 192.168.25.15 poll version 3 branch-1
snmp-server host mgmt 192.168.25.16 poll version 3 branch-1
snmp-server host mgmt 192.168.25.17 version 3 branch-1
snmp-server host mgmt 192.168.25.11 trap version 3 branch-1
snmp-server host mgmt 192.168.25.13 poll version 3 branch-1
snmp-server host mgmt 192.168.25.27 poll version 3 branch-1
snmp-server location branch-1
snmp-server contact global
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps memory-threshold
snmp-server enable traps cpu threshold rising
snmp-server enable traps ikev2 start stop
snmp-server enable traps nat packet-discard
snmp-server enable traps config
wr</code>
  - **Make sure this is done for all contexts, to include those not in CSM**

====Activate contexts====
  - In the System context, add the config-url command under each context
  - Use the context.txt from above to accomplish this
  - Note: this should be done one context at a time and save often
====Verify Contexts====
  - Verify LB pools are all up
    - Local Traffic-->Pools-->Statistics
    - Change Partition to All
    - Change Status to display Offline
    - Expand all Offline contexts
    - Take a screenshot of all the offline contexts to include all pages
    - Save those screenshots on the share drive
    * {{:cisco:asa:9300_conversion_from_5585:pool_list_1.png?400|}}
    * {{:cisco:asa:9300_conversion_from_5585:partition_all.png?400|}}
    * {{:cisco:asa:9300_conversion_from_5585:offline_pools.png?400|}}
    * {{:cisco:asa:9300_conversion_from_5585:expand_pools.png?400|}}
    * {{:cisco:asa:9300_conversion_from_5585:no_offline_pools.png?400|}}
    * {{:cisco:asa:9300_conversion_from_5585:offline_pools_shown.png?400|}}

====CSM work====
  - Determine shared policies
    - Two Options:
      - Option 1: Click through each shared policy and take a screenshot and save it to OneNote to reference later.
        - On a1
          - Change Host name if needed
          - Change "5585" to "9300"
          - Change rackel section if needed
          - Delete the ending part that says sec/pri standby/active, if present
          - Click Save
        - Repeat for all firewalls
        - Reassign all shared policies to all four firewalls.
          * Use the screenshots as reference
          - Right-click on the first local policy for that device and select **Assign shared policy**
            - Assign the appropriate policy
          - When done, File-->Submit
          - When done, File-->Deploy
      - Option 2: Legacy method
        - On a1
          - Change Host name if needed
          - Change "5585" to "9300"
          - Change rackel section if needed
          - Delete the ending part that says sec/pri standby/active, if present
          - Click Save
        - On a2
          - Change Host name if needed
          - Change "5585" to "9300"
          - Change rackel section if needed
          - Delete the ending part that says sec/pri standby/active, if present
          - Click Save
          - Hold Ctrl and left-click on both a1 and a2 to highlight them
          - Right-click and select Discover Policies on Devices
          - Click Finish
          - When done, click on b1 and reassign the shared policies to a1/a2
          - When done, File-->Submit
          - When done, File-->Deploy

====Appendix A: Configure ASA for ASDM====
  - If you can't connect to a device via asdm due to versioning differences, just copy over the asdm-7181-152.bin file from the share drive. (Replace file with the one approved for installation.)
  - This .bin file is copied to the ASA via the CLI using SSH and authenticating via your network account.
    - Via WinSCP, copy asdm to jumpbox, /var/tmp
  - On the ASA via the CLI:
      - <code>changeto context system
copy scp://john.doe@192.168.1.2//var/tmp/asdm-7181-152.bin disk0:/asdm-7181-152.bin</code>
  - On the ASA via the CLI:
    - changeto context system
      - <code>conf t
asdm image disk0:/asdm-7181-152.bin</code>

====Troubleshooting Notes====
  - Device not discovering
    - <code>c9300-fw-a1/branch-1(config)# show run ssl
ssl cipher default low
ssl cipher tlsv1 low
ssl cipher tlsv1.1 low
ssl cipher tlsv1.2 low
ssl cipher dtlsv1 low
ssl cipher dtlsv1.2 low</code>
    - Removed all those and CSM can communicate with it now.

==== Backlinks ====
[[cisco:asa:|Engineer Howto - Firewalls]]\\ 
[[cisco:asa:|Engineer Howto - Firewalls]]\\ 
[[engineer_howto:|Engineer HowTo]]\\
Tim's Technology Journey Wiki

User Tools

Site Tools

Page Tools
