Cisco Firepower 1010 Getting Started Manual page 157

Threat Defense Deployment with CDO
Before you begin
• You can configure SSH internal users at the CLI using the configure user add command. By default,
• You need network objects that define the hosts or networks you will allow to make SSH connections to
Procedure
Step 1 Select Devices > Platform Settings and create or edit the threat defense policy.
Step 2
Select Secure Shell.
Step 3 Identify the interfaces and IP addresses that allow SSH connections.
Use this table to limit which interfaces will accept SSH connections, and the IP addresses of the clients who
are allowed to make those connections. You can use network addresses rather than individual IP addresses.
a) Click Add to add a new rule, or click Edit to edit an existing rule.
b) Configure the rule properties:
c) Click OK.
Step 4
Click Save.
You can now go to Deploy > Deployment and deploy the policy to assigned devices. The changes are not
active until you deploy them.
Deploy the Configuration
Deploy the configuration changes to the threat defense; none of your changes are active on the device until
you deploy them.
there is an admin user for which you configured the password during initial setup. You can also configure
external users on LDAP or RADIUS by configuring External Authentication in platform settings.
the device. You can add objects as part of the procedure, but if you want to use object groups to identify
a group of IP addresses, ensure that the groups needed in the rules already exist. Select Objects > Object
Management to configure objects.
Note You cannot use the system-provided any network object. Instead, use any-ipv4
or any-ipv6.
• IP Address—The network object or group that identifies the hosts or networks you are allowing to
make SSH connections. Choose an object from the drop-down menu, or add a new network object
by clicking +.
• Security Zones—Add the zones that contain the interfaces to which you will allow SSH connections.
For interfaces not in a zone, you can type the interface name into the field below the Selected Security
Zone list and click Add. These rules will be applied to a device only if the device includes the selected
interfaces or zones.
Deploy the Configuration
Cisco Firepower 1010 Getting Started Guide
155