Firepower Health Policy Configuration

In this article I'm going to show you how to create Health Policy on Cisco Firepower, This is a very important feature that can help you monitor your devices for many things and you can send to SNMP manager or view locally, ok let's begin:

1. Go to System > Health > Policy

2. This page will require a policy Description > I'm going to use (FMC Initial Health Policy)

3. below the description you can see a list of many sensors that you can either enable or disable them

some of these items you may not need for a license reasons like in my case I dont have URL or VPN license so I don't need to enable these two.

other than that I'm going to enable the following:

1. Policy Run Time Interval (I'm going to use each 5 Minutes) :this will run health check every 5 minutes.

2. AMP status for the endpoints

3. AMP firepower status

4. Appliance Heartbeat > very important to check if devices are online

5. Automatic Application bypass monitoring

6.Backlog Status

7. CPU, Memory, Disk Status, Disk Usage, ....etc.

After Finishing your list, you can save and Apply it to your devices:

Go to Health > Policy > apply option :

this will lead you to the list of devices:










Press apply and Good Luck!

NTP setup on Cisco Firepower

To configure Cisco Firepower with time source protocol like NTP the following steps must be done:

1. Go to System   then Configuration


2. Check if there are currently configured NTP servers by clicking on Time, in my case I have following, (172.16.16.231, 172.16.16.230) while the (127.127.1.1) is local server which means the firepower itself.













3. To Configure new  NTP click on (Time Synchronization)
4. here you can enable NTP by changing (Serve TIme via NTP), add the NTP servers separated by comma "," as in the picture:



5. Save, and Go back to (Time) to see if your Firepower is syncing with the (NTP source).

Blocking Mobile Application with Firepower

Blocking Mobile application on Firepower helps in prevent some of the applications that could be risky or has a low business relativity in some companies, today we are going to create rules on Cisco Firepower that helps blocking "snapchat" as an example

First, there are two ways to block application

1. blocking with rule that uses Objects
2. blocking the application with rule directly

Blocking with Objects:

1. Create the applications filter under Objects
Objects > Application Filters > Add Application Filter


add a name for the application filter, then search for the application you want to add and filter in rule, we will search for snapchat application as you can see from the picture above, add to Rule then save.

2. Adding the Application filter to be blocked by Firepower policy
Policies > Access Control > select the Policy to edit ( in my case it's FMC_Access_policy)



3. add a rule > add a name for the rule (SNAPCHAT-FILTER) tick the enable option, change the action to Block, Go to Applications Tab and search for the object we created earlier (APP-FILTER) which has SNAPCHAT application inside then Click Add to Rule, then Add.

 4. Finally save the new rule from the save option on the right upper side of the page, then click on Deploy, tick the devices you want to apply the rule on and click deploy.




After finishing deployment, you can check your rule by going to > Analysis > Connections>Connection events

Note: you will need to enable logging in the rule in order to see it in the events.


Method two, blocking directly:


This is little bit easier to create, first you need to go and create a rule, go to Policies > Access Control > edit policy > add rule

inside the rule, you just need to name the rule, change the action and choose snapchat from the applications list, then enable logging, and add then save and deploy, check below picture, and also to view your rule working or not, go to Analysis > Connections > Connection Events




Good Luck