Cisco Firepower 2100 Getting Started Manual page 30

Configure the Device in CDO
• Security Intelligence—Use the Security Intelligence policy to quickly drop connections from or to
blacklisted IP addresses or URLs. By blacklisting known bad sites, you do not need to account for them
in your access control policy. Cisco provides regularly updated feeds of known bad addresses and URLs
so that the Security Intelligence blacklist updates dynamically. Using feeds, you do not need to edit the
policy to add or remove items in the blacklist.
• Access Control—Use the access control policy to determine which connections are allowed on the
network. You can filter by security zone, IP address, protocol, port, application, URL, user or user group.
You also apply intrusion and file (malware) policies using access control rules. Use this policy to
implement URL filtering.
The following example shows how to allow traffic between the inside-zone and dmz-zone in the access control
policy. In this example, no options are set on any of the other tabs except for Logging, where At End of
Connection is selected.
Figure 10: Access Control Policy
Step 9
Locate the Security Database Updates section to create a scheduled task to check and update the security
databases for an FTD device.
When you onboard an FTD device to CDO, part of the onboarding process allows you to Enable scheduled
recurring updates for databases. This option is checked by default. When enabled, CDO immediately checks
for and applies any security updates as well as automatically schedules the device to check for additional
updates. You are able to modify the date and time of the scheduled task after the device is onboarded.
If you are using intrusion policies, set up regular updates for the Rules and VDB databases. If you use Security
Intelligence feeds, set an update schedule for them. If you use geolocation in any security policies as matching
criteria, set an update schedule for that database.
Step 10
Click the Preview and Deploy button in the menu, then click the Deploy Now button, to deploy your changes
to the device.
Changes are not active on the device until you deploy them.
What to do next
• You should register and license your device after you onboard; see
Cisco Firepower 2100 Getting Started Guide
28
Firepower Threat Defense Deployment with CDO
Configure Licensing, on page 29.