Build a Cisco Firepower Lab in ESXi

0:06Hello and welcome. My name is Keith Barker. And in this set of videos, you and I get to walk through the process of setting up our own home lab environment for Firepower. Or if you're doing it in an office, I guess it would be called an office lab environment. There are several different ways of getting this done. We could do it using an ESXi host as the parent hypervisor. We could use VMware Workstation or a set of VMware Workstations to support it. We can also do it in other products, like Eve-NG. So in this set of videos, I'd like to walk you through the setting up of this lab environment using an ESXi host, and also the networking, and the behind-the-scenes components that make it all work.

0:43Because it's tough to practice with a technology, such as Firepower, unless you have the gear or the virtualized version of the gear to practice and play with. So the intent of this set of videos that you and I are going to do right now is to walk you through setting up that infrastructure. So that if you choose to, you can build a lab environment using all eval software. So you don't have to buy the software. You can evals for it. And then with that infrastructure setup, you can follow along and do hands-on practice in your own home lab environment as we proceed through these sets of videos.

1:13So if you're ready, in the next video, what we'll do is we'll take a look at our game plan for this lab environment, and then we'll proceed to implement it step by step. I'll see you, my friend, in the very next video.

0:06It's important to have a good idea of where we're going before we just jump in and start configuring things for our lab environment. So in this video, you and I get to take a look at the big picture regarding networks, hypervisor, software that's involved so we can have a really clear idea of where we're going as we're building this lab. So let's use this as our backdrop. And if we're building a lab for Firepower and we're going to use a single ESXi host, some of the software we're going to need is VMware's ESXi software. They have a free version for individuals. You can download it.

0:37It's simply software that gets installed on a computer as a type 1 hypervisor. And then inside of that one physical computer with ESXi, we then create and emulate the entire environment. So as far as some of the software required, we'll need ESXi. And as far as ESXi goes, you can either download a trial or eval version, or you can register yourself for a free version of ESXi. They'll give you a single license for a server that you can then run forever. And as far as running that on a computer, you'd want to make sure that that computer supports the running of ESXi.

1:09So the current flavor of ESXi, as of this recording, is 7.x And so whatever hardware you're planning to run this on, you'd want to make sure that's compatible with 7.x And we have separate videos here at CBT Nuggets about the basic deployment of a single ESXi host. You can check those out if you need details on installing ESXi on a dedicated computer for that purpose. And in the world of ESXi, they refer to these often as a host. An ESXi host-- that's a computer that's running the ESXi hypervisor software that's going to support the whole environment.

1:40And as far as the demos that I'm going to be setting up here and working with, I currently have a host here. It's a blade server. I got it used. And it has 128 gigs of RAM. You don't have to have that much. You don't have to have 128 gigs. But the more RAM you have, the more resources you can give, RAM-wise, to all of these virtual machines. Also, as far as software goes, we'll also need the FMC. So the FMC-- it's an acronym. If you're brand new to it, that's the acronym for Firepower Management Center. Think of it as control central, where we log into the Firepower Management Center, and then the Firepower Management Center, based on what we tell it to do there, will then communicate with the firewalls and actually implement the commands.

2:20And these firewalls are called FTDs, which is an acronym for Firepower Threat Defense. And they are the next-generation firewall and IPS/IDS solution from Cisco Systems. So today, for our current implementations, when we think of Firepower, we're thinking of FTDs-- that's the actual firewalls them self-- and the FMC, which is our Management Center that allows us to manage all of those firewalls. And so this software, as well, you can register and request an eval from Cisco. And when we deploy the FMC and the FTD, they automatically give us the option for an eval period when they're first installed, which is absolutely perfect for a lab environment.

2:57So the ESXi host software, we can get an eval of that. We can get evals of FMC and FTD. Everything over here is going to be running as a VM. So the FTDs are going to be running as a VM on the ESXi host. The Firepower Management Center is going to be running as a VM on the ESXi host. And the networking that we see here on the screen is all going to be provided inside of the ESXi host. And have no fear. I'll walk you through each and every step of getting that set up exactly right, as well. Another element that might be nice, but not required, is some version of Windows Server, which also can be run as a virtual machine in the ESXi hypervisor.

3:33And Windows Server-- we could use that for things like Active Directory, if we want to integrate with Active Directory for user identification. Or if we wanted to use an NTP server, the Windows Server can do that, or it can do DHCP, or NTP, and other features, as well. And then also in our environment, we're going to want to have some VMs that we can pop in on these sites-- so site 3, and site 4, and the headquarters site. And that way, we can test and verify functionality with traffic that's actually going through, or being forced through, or sent through the Firepower Threat Defense appliances.

4:05And those also would be virtual machines all living inside the ESXi host. And so these virtual machines could be Linux. They could be Windows. Whatever we want to deploy there is great. And ideally, we want something that we can use to send traffic through so we can verify our firewalls. So let me clean that up a little bit and let's talk about networking. Regarding networking, at the headquarter location, we're going to use 10.1.0.0 as the IP addressing space with a 24-bit mask. At site 3, we'll use 10.3.0. And at site 4, we'll use 10.4.0. Also, for these three FTDs I have on the screen here, FTD-1 will have the last octet of its IP address always end in .11 And the benefit of that is that whenever we see .11, we'll know it's associated with this FTD, this Firepower Threat Defense device.

4:49And similarly, FTD-3 will have the last octet of .13, and FTD-4 have the last octet of .14. And for the simulated lab internet, I'm going to use this address space, 23.1.2.0 with a 24-bit mask. And I'll have the default gateway for this pseudo-internet here as being .1 So that way, whenever we see the 23.1.2 network, we'll just say, oh, yeah. That's the internet, or the pseudo-internet, inside of our lab environment. To manage all the FTDs, we are going to use the FMC, the Firepower Management Center.

5:20And it's a VM, and it's going to have the IP address of .10. And all of these devices in the lab, I'd like to, for simplicity, connect them to a management network. So the Firepower Management Center on its interface, the .10, will be connected to the management network, which is my home office network. That's the network that I'm currently sitting at. And the benefit of that is that if our PC is sitting on this same network, we can then use our browser to open up sessions with those FTDs if we need to, or to the Firepower Management Center, or do other local configuration and management, because our PC right here is on the 192.168 network.

5:58So in your home network environment, if your primary address space is 172.16.1 and then with a 24-bit mask, for example, use that as your management network. And that way, it'll be easier to get from your PC to any of the devices that we're deploying inside the ESXi host, because logically, the management interface for all those devices is going to be on your same common network that your computer is on right now. So here on the FTD appliances, I have represented an m there for this management interface connected to the management network. And I'll walk you through that as we configure the ESXi hosts to support all this, as well.

6:31And one other element I'd like to talk about for a moment, as far as our design, is let's say we have a client device, a virtual machine, that is using the Firepower Threat Defense as its default gateway, using .11 as the default gateway. And then we're doing NAT, and we're sending traffic out to the pseudo-internet. It would also be great, for the benefit of testing and working with our Firepower, to have real internet connectivity, as well. So in addition, in the lab environment, we're also going to introduce another little virtual router which is running as a VM. And it'lll have ethernet1 that's connected to the 23 network.

7:04And then it'll have ethernet0, which is then connected to another network, which then leads off to the real internet. And so I hear we can do things like PAT, network address translation, as well as routing, so that if we give this router the IP address of .1 on the 23.1.2 network, then FTD-1, FTD-3, FTD-4-- if we tell each one of those devices that their default gateway is using .1 on the 23.1.2 network, and we're doing PAT here at this little virtualized router, then these Firepower Threat Defense appliances can get access to the live, real internet.

7:39And a PC like this one over here, as it goes through address translation, and inspection, and so forth, can actually go out also to the live internet. And that gives us a perfect lab environment to practice with things like URL filtering, reputation filtering, IDS, IPS functionality, as well as next-generation application layer inspection. So that, my friend, is our game plan. And we'll come back to this topology and look at it as we reference and build the pieces. So in the next video, we'll take a look at those exact pieces for an ESXi host to support our lab environment.

8:12I'll see you in that next video in just a moment. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:07And welcome back. In this video, you and I get to take a look at the networking requirements for our lab. And then what we'll do is we'll proceed in the next video to actually implement it on the ESXi host. And so in the lab environment, we're going to need networking for the 10.1.0 network. We're going to need networking for the 23.1.2 network. We're going to need networking for the 10.3 network and the 10.4 network, and also for the management network of 192.168.1. So here's what I propose we do, and let me put these in purple on the-- and I'll just jot up here what we're doing.

0:40So the ESXi-related components, I will place in this color. So to support the management network on the ESXi host, we have a switch, which currently is in place. It comes with-- [LAUGHS] Every time you deploy an ESXi host, it has something called switch0. It's a virtual standard Switch And based on the standard deployment of an ESXi host, this vSwitch0 has a port group for VMkernel adapters. That's like the layer 3 IP address on the ESXi host itself. It also has a port group associated with this switch that's called VM Network that we can then associated with VMs that want to connect out to the outside world.

1:16So what we'll do is we'll use switch0. And I took the default port, I just renamed it-- and I'll walk you through this. I'm just going to rename the port group on that standard switch to Management 192. And that way, any virtual machines that need to pugin to the 192.168.1 management network, we can just associate with that port group, and boom. It's there. So the FMC will have one interface in that port group. And FTD-1 will have an interface associated with that port group, and FTD-3 and FTD-4. And if we deploy a Windows Server, we can plug it into that port group, as well.

1:50So for the management network, we'll use switch0, and we'll have a port group named Management 192. And again, that's on the ESXi host that's providing this virtualized environment. Let's go from left to right, then. So for the 10.1.0 network, I recommend that we create, on the ESXi host, a whole new switch. And let's call that switch HQ 10.1 That'll be the name of the switch. And we can also create a port group called HQ 10.1 Net, or something similar. And the way it works in VMware with vSphere is that you associate a virtual machine with a port group, which is associated with a switch.

2:26So we'll create a switch called HQ 10.1, and a port group that's like a very similar name. And that way, when we connect to it, we'll know exactly where it goes. So anytime we have a device, including this Firepower Thread Defense appliance in this interface, or a VM that we want to connect to the 10.1 network, we can just connect it logically in ESXi to this port group, and it'll be a nice happy place for anybody who wants be on the 10.1.0 network. So we have switch0 that we're going to work with. We're going to create a brand new switch called 10.1 to support this network.

2:56And for site 3, we'll do a similar thing. Let's create a virtual switch on the ESXi host and let's call it Site 3 10.3 or something similar. And then we'll also create a port group with a similar name. And then any time we need to connect a device, a virtual machine, to the 10.3 network, we'll just associate its network interface card-- like this one right here on the Firepower Thread Defense number 3 appliance. We can just associate it with that port group, and it'll be in 10.3. If we have a client machine or some other device, we can do the same thing and just associate them with that port group.

3:28And boom, that device will then be in network 10.3. And we'll do the same thing over here for site 4. We'll create a brand new standard switch on the ESXi host. We'll call it something like Site 4 10.4. And then we'll create a port group with a very similar name. And then we can connect this interface, when we get to it, for the FTD-4. We'll connect that interface to that port group. And that will allow this interface to be involved with this 10.4 network, and any other devices that we have in the place and associate with that 10.4 network via this port group.

4:00So that's 1, 2, 3, 4 switches-- one that's already there and three that we're going to create. Let's also simulate the internet here by creating another standard switch. So the switch on the ESXi host, we'll call it Lab Internet or something similar. We might add the 23 on there just to remember what it is. And then once we deploy the Firepower Threat Defense appliances, we'll take these interfaces, respectively, associate them with this port group, and then they will all be on this 23.1.2 network logically.

4:30And there's definitely one more that we want to add, and that is going to be supporting our router. So we're going to deploy a little VM as a router in ESXi. It's going to have two interfaces. One of those interfaces is going to connect here to the lab internet. So we already got the switch for that. And the other interface, I'm going to have it connect over to this management network. And the reason for that is that off of this 192.168.1 network, I actually have a default gateway of .1, which leads out to the real internet.

5:00So effectively, this router, going through my real router in my home office, if it does NAT or PAT on behalf of the lab traffic, it can allow that traffic to go out to the internet. So now that I've said that, we don't actually have to create any new switches, because we're going to have this switch already and we're going to have this switch already. But we are going to need to plugin that virtual machine, the router, into both those networks so it can provide default gateway services off of the pseudo-internet. And then one last virtual switch that I'd like to create. I'd like to create a virtual switch, again, on the ESXi host.

5:33And I'd like to name it Parking Lot. And what we can do is we can take any interfaces on these Firepower Threat Defense appliances-- which they have a whole bunch of interfaces. We'll take a look at that in a little bit. But we can assign the ones that we're not actively using to this vSwitch Parking Lot with a port group of the similar name. And that way, we can associate-- let's say we have interfaces 5, 6, 7, 8, 9, and so forth that we're not using. We can just plug them all into the Parking Lot Port Group. And that way, unused interfaces aren't accidentally in our production or our pseudo-production network environments here.

6:06And later, if things change, if we want to start using some of those interfaces, we can reassign them from the Parking Lot, just as a place to park, over to the actual networks we want them to belong to. So that, my friend, is our game plan for the networking portion that we need to setup on the ESXi host. And with this plan in place, in our next video, what we're going to do is jump in the interface for an ESXi host in my lab environment. I'm going to use ESXi-2, which happens to be available. And we're going to configure the networking to support this on ESxi-2. So if you are following along and doing this on an ESXi host, you won't want to miss the next video, because we're going to implement the networking.

6:41I'll see you there in just a moment. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:07It is time. It is time to go to the interface-- the graphical user interface-- on our ESXi host and modify and/or create the switches to support our networking that we discussed in the previous video. So without further ado, let's log into my ESXi host number 2. So we're going to log into the ESXi host. If you need any help in the installation of ESXi itself, just check out the first two or three videos of our vSphere courses, and that'll walk through that process, as well. So I mentioned earlier, but it's worth mentioning again, that all of this software-- ESXi, the FTD, the FMC, Windows, everything else-- you can get eval versions from the vendors respectively for those.

0:43And that can be a great way, and an affordable way, to do some labbing and testing without having to invest in the licenses themselves. So I'm going to login as root to this ESXi host. And let me make the font a little bit bigger here. And here's the Recent Tasks down here. Let me minimize that by clicking this bad boy right here. And what version am I running? I'm running 7.0 Update 2 on this ESXi host. And it doesn't have to be version 7. You can run 6.0, or 5.5, or 6.7, or 7.x.

1:15So the interface may change slightly, based on the flavor of ESXi you're using, but the concepts are going to be the same. And I'm logged in now to this ESXi host called ESXi-2. So in the navigation panel over here on the left, let's click on Networking. And let's start by looking at what we have. So let's click on Virtual switches up here. So I've got networking selected over here, Virtual switches, and vSwitch0 is what we get by default when we deploy a brand new ESXi host. So if we open that up-- and it shows me over here my port groups on the left.

1:45And so there's a default management port group for a VMkernel adapter. This is how the ESXi host, with its manageable IP address, how it communicates out on the real network to talk to other devices. So I've got this port group for VMkernel adapters. And then by default, we're going to have a port group called VMnetwork. And what I did was I just clicked on the little edit pencil here, and I changed it, calling it Mgmt Network 192, so that when I see it, I'll know what this port group represents. And regarding security for this port group, I went and I specifically specified everything for accept, because I don't want the hypervisor in the background with any of its security settings to cause a problem for anything that we're implementing in the lab.

2:25So here, I want the hypervisor and the virtualized switch not to get in the way, but simply to provide basic networking. So I'm not going to make any changes there. So I'll click on Cancel. And then over here, it's showing us that these two port groups are logically connected out to the physical world on vmnic0. So that's my one physical network card that is connected to the 192.168.1 network, my home network that I'm currently sitting at right here. So this is the port group that we're going to use if we need to connect anything, like the Firepower Management Center, or the management interfaces of our Firepower Threat Defense Appliances.

3:00Any devices we need to connect to the management network, we'll simply associate with this port group called Mgmt Network 192, and then they'll have that uplink that puts them on that same network with everybody else on that same network. So that's one switch down and a bunch to go. So let's go back to Networking. We'll click on Virtual switches. And based on our game plan, we need a virtual switch for headquarters, for site 3, for site 4, for the internet, and for the parking lot. So we'll start by going to Virtual switches, clicking on add standard virtual switch right here.

3:31Let's create the network for the headquarters site. So we'll call this switch HQ, and we'll call it 10.1.0.0. And the thing about the switch is we're not going to give it any uplinks. So here where it says Uplink, I'm going to click on the little x here. And I want a switch with no directly connected uplinks, because when we're done, we'll be using the FTD to forward traffic off of the local network to our pseudo-internet. And then for security here, also, in all the new switches I'm going to create, I'm going to make sure that they Accept-- meaning, not Reject-- the Accept is selected on all these switches that we're creating so that the switching on the ESXi hosts and the forwarding there doesn't get in the way of anything we're doing in the lab itself.

4:13So with that set, we'll click on Add. So here's what I propose we do. Let's create all of our switches first, and then we'll go back and we'll create the port groups, associate them with those switches to support the networking. So our next one, let's do site number 3. So we'll click on Add virtual switch. We'll call this site 3 Net 10.3.0.0, just so that when we see it, we'll know exactly what it is. I'm not going to give it any physical uplinks. And for security, I'm going to say Accept, Accept, Accept, and click on Add.

4:43We have HQ. We have site 3. Let's create another switch for site 4. So we'll name it Site 4 Net 10.4.0.0. And no Uplink for you. And Security, wide open. And add. So let's take a look. We've got the management port group, which is on vSwitch0, which is already done. We've got the switch for headquarters site 10.1. We've got Site 3, Site 4. Let's also create one for our pseudo-internet.

5:14So we'll click on Add virtual switch. We'll call this Lab internet. And we'll put a number on it there so we remember what it is. No Uplinks, and then Security is wide open, and Add. And let's also create a switch as a parking lot for any interfaces that we're not using. So one more switch. Add standard virtual switch. We'll call this Parking Lot Not Used. No Uplinks. And for Security-- I guess security on this one won't matter because we're not expecting traffic to move.

5:45But I'm going to say Accept everywhere here. Click on Add. And let's do a quick check. So vSwitch0 for management, HQ, Site 3, Site 4, Lab Internet, Parking Lot. Fantastic. Next, let's create port groups for those brand new switches that we just created. So with Networking on the left selected on the ESXi host, we'll click on the Port groups tab, and we'll click on Add. And let's create one for HQ. We'll call it HQ 10 Net. I'll just put PG there for Port Group.

6:16And we're going to associate that with the switch called HQ. And the security, it'll inherit from the parent switch, which we already opened up. So we'll click on Add. Let's create another port group. So with Port groups still selected, we'll click on Add port group. We'll call this Site 3 Net 10.3.0.0 PG-- for Port Group, just so we can see what it is. And then we'll associate this with our Site 3 switch. So think of a port group like a section of ports that are associated with this switch, because that's what they are.

6:49And then because there's a section of ports, we can also describe or setup certain attributes for that group of ports, such as, what security do we want to use? What VLAN do they belong to? And so forth. So that looks good. We'll click on Add. Well, let's create another port group for site 4. So we'll call this Site 4 Net 10.4. And we'll associate this with Site 4 switch, and Add. And let's see, what else do we need?

7:21Oh the pseudo-internet-- we need some port groups there so we can connect to that switch. So we'll click on Add port group. And we'll call this Lab Internet 23.1.2.0 PG. And we're going to associate that with the Lab Internet switch right there, and Add. And let's also create a port group for the Parking Lot. Add port group. We'll call it Not Used Parking Lot PG. And then we'll associate it with our Parking Lot switch, and click on Add.

7:51And I think we've got all the networking in place. Let's just do a quick check. So we've got a switch and a port group supporting our management network, which is vSwitch0 and the Mgmt Port Group there. We've got a switch and port group for the 10.1 network, A switch and a port group for site 3, a switch and a port group for site 4. We've got a switch and a port group for the lab internet. And we also have one for the parking lot. That's it. We've done it. So now we've done a huge chunk towards our infrastructure on the ESXi host portion to support our lab environment.

8:21One other thing I'd like to do-- and let's do it the next video-- is I'd like to inject into this topology, as part of the infrastructure, another router that's going to be able to route between the pseudo-lab internet, and the production internet. So we'll do all that, including the design and where that fits in, in the next video. So I'll see you there in just a moment. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:06Setting up a lab environment can be a little bit of work on the frontend. But it's so worth it, because once it's installed and working, we can practice with it and the technology, and bring stuff up and tear stuff down. We're not messing with the production environment. It's a lot of fun and a lot of good practice. One of the aspects that I absolutely love about a lab environment is that whenever we can, if we can connect it or integrate it with the live internet, oh, my gosh. It's so good. So in this video, we get to do exactly that. I'd like to walk you through the step-by-step process for deploying a tiny little VM as a router to support that integration between our lab environment and the real internet.

0:41And here's our game plan to pull that off. We already have some virtualized switches and port groups to support the lab internet, which is the 23.1 network address space, and also the 192.161 network. And on my 192.161 network-- let me change the color here-- I've got a default gateway of .1 that leads off to the real internet. So this device is doing PAT. And there's probably one or two other devices in the line that are doing NAT PAT. But eventually, it gets to the internet, based on the 192.168.1 network and the default gateway at .1.

1:13So if we want to have our pseudo-lab internet connect to the real lab internet, here's what I propose we do. Let's add another virtual appliance-- a VM, really-- running VyOS, V-Y-O-S. And I'm going to be using version 1.2.1. It's free. It doesn't cost a dime. And we're going to do that by logically connecting it to ethernet0 interface to the port group associated with the 23.1.2 network. So it's going to have a leg or a Ethernet connection. And we'll give it the IP address of .1. So anybody who's on this pseudo-internet, if they use 23.1.2.1, they're going to be pointing to this router interface.

1:46And then this router can have connectivity over to our management network. So this would be ethernet1. And over here, we could just use an IP address that's available. In my lab environment, I have .80. But you can also configure this interface to be a DHCP client if you wanted to. And then we configure routing. If we're doing it statically, we'd configure this router to use .1 as a default gateway. And then we can also setup network address translation. Or more likely, we'll go ahead and do PAT-- Port Address Translation. So the traffic source from the 23.1.2 network, if it's using .1 as the next hop, this router can not only forward to the live internet, but it also can provide port address translation to swap out this address with the address it's using on this interface, which has then connectivity through a few more PAT devices out to the real internet.

2:33But long story short is that this one little VM can be the link between our lab internet and the live internet. And so what I'd like to do is walk you through deploying this virtual machine on the ESXi host. And I'm going to be using VyOS 1.2.1. And you can download this little VyOS virtual appliance from the VMware Marketplace. It's available other places online, as well. It's open source. It's free. And it's super easy to configure. So what we get to do right now is I'm going to walk you through the steps for both deploying and configuring this beautiful little VyOS router.

3:05So here, back at our ESXi host, using the GUI to manage it, I'm going to go to Host, right click, and we're going to Create/Register a Virtual Machine. So we'll click there. And it's asking me, do you want to create new virtual machine the hard way, or you do want to deploy it from an OVF or on OVA file format? From the VMware Marketplace, I downloaded the VyOS appliance, which is the VyOS router. So if you have an ISO port, you could do a new virtual machine and deploy it that way. But because it's already packaged for me and ready to go, I'm just going to select this option, and click on Next.

3:39Then it's asking us, what we want to name it? I'm going to call this Vyos Router. That way, when I see it in the inventory here in my ESXi host, I'll remember what it is. And then I'm going to click here to select the files for it. So prior to this demonstration, I googled, found, and downloaded the VyOS appliance. And here it is-- vyos-1.2.1.ova, which is a format that VMware, both VMware Workstation and vSphere, recognize for deployment of a VM. So with it selected here, I'm going to click on Open. And then click on Next to continue.

4:11It's asking me what datastore on this ESXi host do we want to use. And on the ESXi host, it has a datastore that's on top of a non-flash drive. And then I've got one that's SSD, which is faster. So I'm going to put everything on the ESXi host-- as far as virtual machines, I'm going to put it all on the SSD. So I'm going to select that datastore on the ESXi host as a storage location for the files supporting this VM, and click on Next. It's asking me here about the network mappings. Effectively, it's saying, OK, I've got two interfaces, LAN and WAN.

4:42And where do you want to connect those? So the way I have it setup, the LAN interface is going to go to the 23 network. That's going to end up being ethernet0. So I want to grab the port group associated with our pseudo-internet, which is right here, Lab Internet 23. And the WAN connection which leads up to the real internet is our management network. So I want to choose the port group that supports that, which is Mgmt Network 192. So LAN is going to be the ethernet0 adapter. WAN is going to be our ethernet1 adapter on the virtual appliance.

5:12It's next asking what kind of resources do we want to throw at this. In a lab environment, we don't need a ton of CPU and we don't need a ton of RAM. So we'll select Small, which is going to give it 1 virtual CPU and 512 megabytes of RAM. We're going to do the Thin provisioning. And what that means, if it allocates like 5 gigs of space or 1 gig of space for a virtual disk drive, it won't actually use the full amount unless it's really using it. So we could allocate it like a 10-gig drive. If it's thin provisioned and we're only using 500 megabytes, it's only going to really tie up 500 megabytes on the datastore.

5:44So we'll choose thin. And then it says, do you want to this on automatically? And I'm going to say no to that, because I want to check my work. And we'll click on Next. Because it's an OVA and it's all been packaged, that gave us the opportunity to put in information such as what password do we want to use. I'm going to use my lab password here. And that way, when we log into this little virtual router, we're going to login with the username of vyos-- V-Y-O-S-- and then whatever password we specified here. And then for its IP addresses, it's asking me about-- oh, it's just one IP address. So this is going to be the IP address on the LAN interface.

6:16In our case, that's the 23 network. So I'm going to give it 23.1.2.1, and the mask is going to be a 24-bit mask. That's how we spell 24 bits in dotted decimal. It's not going to have a Default Gateway for this interface. So what I'll do is I'm going to hold off on the Default Gateway until I configure the 192.168 address. And for DNS servers, I'm going to give it 8.8.8.8. Also, you know what? Let's give it a default gateway of 192.168.1.1.

6:48And until we configure the other interface, ethernet1, with an IP address, it really won't be able to use that default gateway, because it can't reach it with only one interface. So we'll just play it by ear and see how that comes up, and I'll walk you through any problems if they arise. So with that in place, we'll click on Next. We'll confirm our settings. That looks good. And we'll click on Finish. So if we bring up the task by clicking on Recent tasks down here, it's now showing us the deployment of that virtual machine, which is our little VyOS router. It says it's done deploying.

7:19And so if we click up here on Virtual Machines, and there's our VyOS router. If we click on it, the first interface is connected to the port group for the pseudo-internet, and the second adapter, which is ethernet1, is connected to our management network. So that looks good to me. Let's power it on. So with this selected, we can just click on Power on here, or Power on here, or right click and Power on here. There's a whole bunch of options to power that bad boy up. He is up and running, or will be here in a moment. And I'm going to open up a console to him. So based on the flavor of ESXi you're using, if you just click here, you can open up a console there.

7:55Or if you have the VMware Remote Console installed on your computer, you could right click and hover over Console. And from here, you could just click on Launch remote console. Either way, you want a console to this device so we can look at it, configure it, and work with it. So here is that console that it just brought up. And it wants me to log in, so I will as vyos and the password I specified during the setup. Then we'll do a show configuration.

8:25There we go. And there's also context-sensitive help, too. So if you don't know exactly what to type in, do a question mark. So we'll do show configuration. So this shows us that ethernet0 has the address of 23.1.2.1 with a 24-bit mask. ethernet1 has no IP address at the moment. We'll configure that. It's got a default route with a next hop of 192.168.1.1. That's great. Once we do configure ethernet1 with the 192.168.1 address, it'll be able to reach that next hop for the default gateway and actually work. And we'll press Enter to go down one line at a time.

8:56There's the name-server using a Google DNS server. So to configure this VyOS router, one of the best things to do would be to find a quick start guide. So I'm just going to type VyOS-- I did this about 10 minutes ago-- VyOS quick start. And I'm going to just use this option right here, which is going to walk us through the basic configuration for VyOS. So right here, it says, type in configure to go into configuration. Once you make changes, type in commit to commit those. And then if you want to save those so it reboots with those settings, click on Save.

9:27All right, awesome. So I'm going to scroll down to where it says how to set an IP address, right here. So if we type in configure-- and I just typed in conf for short, and it accepted that. The prompt changes to a pound symbol to tell us that we're in configuration mode, if you will. On a Cisco router, that's what we would call it. And then from here, we can do a set interfaces and ethernet. And we want to configure ethernet1. And that's the interface facing our 192.168.1.1 network. And we want to configure an address.

9:59And the address we want to use is 192.168.1.80. That address, the .80, I'm not using on my home network, so it's safe. And I'll just make sure I'm not using the same address on two different devices. And we'll give it a 24-bit mask. That looks good. And then the other thing we're going to need eventually, too, is we're going to need port address translation or NAT. And so in the startup guide, If we go to the startup guide and just scroll down a little bit, here it has information on setting up NAT. So this is the router. This is ethernet0 that's on the 23 network.

10:31And we're in the process of configuring ethernet1. Once we do a commit, it'll be real. And ethernet1 is going to our 192.168.1 network. And it's using .80, based on this command right here. And what we want to do is set up NAT, so anybody who sends a packet this way, if their source address is coming from the 23.1.2 network, we want to do PAT. Effectively, you want to translate it using whatever IP address is on this interface and then forward it along its way. So to pull that off, the commands are right over here on the right. So let me leave the drawings up there and let's set nat source rule.

11:07And I'm going to use 100. And the outbound interface is going to be eth1, based on our diagram right there. And as far as who can be translated, set nat source rule 100 source address. Anybody coming from the 23.1.2 network with a 24-bit mask-- if that's your source address, I am willing to translate you. That's what this rule says. And then third, we need to specify what we're going to translate that address into. And if we want to overload on that .80 address, we're going to use the command set nat source rule 100 translation address masquerade, like that.

11:48And that basically means we're doing PAT against that .80 address on that e1 interface. So to make this real, to put it in action, we'll type in commit. And good, no errors. Then if we want to make sure this comes up this way next time we reboot this VM, we'll type in save. Perfect. And then we'll type in exit. If everything's working, we should be able to ping our default gateway, 192.168.1.1. Then we'll do a Control-C. Because we have an interface, e1, and because our routing is in place with the default route, we should be able to ping an internet address, like 8.8.8.8.

12:24That works. And also, because we specified a name server in our installation of this VM, we should also be able to do name resolution. So if we typed in ping www.cisco.com-- yeah, sure enough. I'm always surprised when it works the first time. So that just shows us that DNS is working, and name resolution and internet connectivity is there. And this is going to be part of our infrastructure as part of our lab. And here's how it fits in. If we have a Firepower Threat Defense appliance, and we have a client back here who's using the Firepower Threat Defense as the default gateway to get traffic out to the internet, this FTD can do its magic of inspection and filtering, and things like NAT and PAT.

13:04So from the FTD's perspective and the client's perspective here, they're just sending traffic from and RFC 1918 address space, who's then, by the FTDs, doing translation once we have policies applied. Does the translation, forwards it, and if the traffic is going to the internet, the next hop will be .1 on this router, who can then do port address translation itself and forward the packet onto the real internet. So this router has now become part of our infrastructure for our home-based lab, all sitting within one beautiful system called an ESXi host.

13:37So let's do a quick inventory check. We did the networking on the ESXi host in the previous two videos. We now implemented the VyOS router as a part of our integration for our home lab to connect to the internet. And in the next video, I'd like to take a look at another resource that we very well may want as part of our infrastructure for a home-based lab. And we'll take a look at that in more detail in the next video. I'll see you there in just a moment. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:06As part of our infrastructure for the lab, it's often handy to have a server that can do things like NTP-- Network Time Protocol-- or Active Directory integration, or DNS. So guess what kind of a server that's going to be? Well, in the lab, I'd like to walk you through setting up a virtualized Windows Server-- again, you can use an eval copy, no worries there-- as part of our lab infrastructure. And that way, if we're doing labs and you think, oh, I want to practice with something like Active Directory integration, you have a server sitting there in your lab environment that you can use to actually practice that and verify that it works.

0:39So in this video, I'd like to walk you through the integration of a Windows Server into our lab environment. And let's talk about where we're going to put this. We're going to create a new virtual machine, the Windows Server. And logically, we're going to place its network interface card into a port group associated with our management network. And then for this VM server, which is going to give be on 192.168.1, I'm going to give it the IP address of .100, because two reasons. One is it's easy to remember that address if we need to point to that server. And secondly, it's also not used currently on my home network of 192.168.1.

1:13So let's take a look at how to deploy a Windows Server as a VM on the ESXi host and then connect it to this network. So back here at the ESXi host, let's right click on Host. And from the dropdown, we'll select Create/Register VM. If you have an OVF or an OVA for a Windows Server, fantastic. Use it. It'll be much easier to deploy. I currently just downloaded an ISO for an evaluation version of Windows Server, and so that's what I'm going to use. I'm going to choose the slightly longer process by clicking on Create a new virtual machine, clicking on Next.

1:45I'm going to name this Win Lab Server. And I'm going to use the latest version of the virtualized hardware in the EXSi. And I"m going to specify this is for Windows. And I'm going to specify that the Windows version is Windows Server 2019, just like that. So this part right here does not cause Windows Server 2019 to be installed. But instead, it's just giving VMware an idea of what type of guest operating system is going to be running in the VM. So that way, VMware, when we deploy this VM, it can make some guesstimates regarding how much RAM and CPU it should give it.

2:18And we can tweak those, as well. So we'll click on Next to continue. It's asking me, where do I want to store this VM's files? I'm going to use the datastore called ESXi-2-SSD-1. Click on Next. It's now giving me the recommendations. So because I've got plenty of CPU and RAM, I'm going to give it more than what it's asking for. So VMware's going to do a great job of managing all the resources. And one change I am going to make, also, is I'm going to go to under Hard disk. And so what I'm going to do here is by specifying Thin provisioning, I'm asking ESXi, please, even though we're provisioning 90 gigs of disk space for this virtual machine, don't tie all that space up unless it's actually needed.

2:54So if the VM is only using like 10 or 20 gigs of disk storage, it's only going to tie up that much physical disk storage on the ESXi host. So in a lab environment, whenever possible, which is almost always with ESXi, choose thin provisioning. And that way, you can conserve the physical disk space on the ESXi host. So with that done, we'll scroll down just a little bit. And for the Network Adapter right here, I want to plug that into our management 192. And that way, it's going to be connected to the right network. And for the Drive, I want to tell this virtual machine when it boots up, I want it to boot up to an ISO file that I currently have on the ESXi host.

3:32So previously, I did some browsing on the datastore on this ESXi host. I created a folder. I called that folder Images and Files. And in that folder, I uploaded a couple files. I upload an ISO for a version of Linux. I also uploaded a Windows Server ISO image. So I'm going to select it there from the datastore. Click on Select. And I'm going to expand that and make sure that the check is there for Connect, and also Connect at power on. So that way when it boots up, I can hit key and boot off of that CD to start the install of Windows Server.

4:02So that looks good. We'll click on next. Here's a summary. That looks good to me. Click on Finish. And then if we click on VMs, we have our Windows Lab Server right there. So I'm going to click on that. And I'm going to right click here and hover over Console, and say I want to Launch a remote console. And you might say, Keith, it's not even running yet. How come you're bringing up a remote console? And the answer is I want to be able to press Space bar when this thing first boots up so I can boot to the CD-ROM that it believes it has connected to it.

4:32So right here in the remote console, I'll click on Go, and then put my mouse in there and hit Space. There we go. And what I just did is told it to boot. Oh, I missed it. I forgot to click inside. All right, I'm going to cancel that. Power it off. Yes, nothing's installed yet. And let's do that one more time. Let me do that one more time. I'm going to bring up a console again. So here's the remote console. I'll start it up. I'm going to click in the space this time and hit Space.

5:03There we go. Now it's loading from the ISO. We can also tweak those settings to give us a few more minutes to choose to boot from CD. But now that it's installing, we'll just follow the install process for Windows. I'll click Next a few times. Click on Install now. I'll select I want a Desktop Experience, because we want a graphical user interface to play with. So I'm going to choose the Windows Server 2019 Evaluation (Desktop Experience). Click on Next, and accept. Next. Custom Install. Choose the drive.

5:34This is the 90-gig drive from this VM's perspective. Click on Next, and it's off to the races. So I'm going to let that finish. Once it's done, I'll configure its only interface that we gave it to have the IP address of 192.168.1.100 with the default gateway of .1. And then this guy is connected directly on the management network and we can use it then. So if we want to install Active Directory, or Certificate Services, or anything else on this Windows Server, those services can then be leveraged by our Firepower environment. So we'll let this install continue in the background.

6:06And in the next video, as we put the components together for our lab environment, I'd like to walk you through the initial placement and deployment of the Firepower Management Center device as a VM in EXSi. We'll do that in the next video. See you there in just a moment. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] And welcome back. In this video, we're going to deploy in our lab environment, the FMC, the Firepower Management Center. Think of it like the single place to go if we need to manage our entire Firepower environment, through the Firepower Management Center, the FMC. This is going to be run as a VM. And although in this video we're not going to walk through all the details for how to configure policies and push them out and so forth, we'll save that for the other sets of videos.

0:31In this video, I'd like to walk you to the deployment, up to the point where we have a functional working Firepower Management Center that we can then use in our lab environment. So let's take a look at where this Firepower Management Center is going to sit in our lab topology, and then we'll deploy it together. So for our Firepower Management Center, we're going to deploy it as a VM on the ESXi host, and so we're going to deploy it from a template. And I'll show you that here in a moment. And we are going to associate it single interface with the management network. So when it ask us for this VM, where do you want to plug this into, for Networking, we're going to choose the port group associated with the 192.168.1 management network.

1:10So let's go to our ESXi hosts and deploy this VM. So here we're sitting at the ESXi host that we're using for the lab. I'm going to right-click on the host from the dropdown. We're going to select Create/Register VM. And it's asking us, do we want to create a new virtual machine, or do you want to deploy a new virtual machine from an OVF and OVA file. Now the actual appliance that we get from Cisco for the Firepower Management Center, they package it for us all ready to go. So I'm going to select this deploy a virtual machine from an OVF or OVA, click on Next.

1:43Now it's asking me to name it. So let's call this FMC for the Firepower Management Center, and then we're going to click here to select the files, or if we had another window open, we could drag and drop them from our computer. So I also downloaded the files for the FMC, the virtual appliance. And we could drag them over here, or just click here and select them. So after some extraction of the files, I extracted some VMDKs, which are hard disks, some OVFs, which are the information for the virtual machines, and then the MF is the hashes. It's a manifest file. So there's two sets of files. There's one option here, and I'll go ahead and highlight them.

2:16And that's if we're going to be deploying these on an ESXi host stand only, which we're doing right now. And the other option here with the Vi, is if we are going to deploy the virtual machine in a vSphere environment using vCenter. So because we're on a standalone ESXi host, I'm going to go ahead and select the disk, hold down my Control key, grab the OVF for ESXi. And we don't need the manifest file, but if you do select it, it won't even care. So I'm going to select the very top one here, VMDK, hold down the Shift, and select these three, with the two specific options for ESXi.

2:47Click on Open, and it's just brought in the disk and the OVF. And the MF is just for validation of the files. It doesn't actually get included as part of the deployed VM. So with the name specified and the OVF information, the hard disk specified that I got from Cisco, we'll go ahead and click on Next. I'm going to store these virtual machines files on the same SSD data store. Click on Next. I want to do thin provisioning and I want to plug this guy into the management network, management network 192. And it's going to power automatically, and we'll click on Next, and that all looks good.

3:21So we'll go ahead and click on Finish. And if we bring up recent tasks, it's going to show us deploying that virtual machine, this FMC. So this deployment of the virtual machine, this part of it where we're deploying the VM to ESXi, they'll take a few minutes, not a big deal. But what takes a little bit longer is, once this is deployed and then we power it up-- and we told it to power up automatically-- that powering up, that initial power up of the FMC, that could take 20 to 30 minutes for it to go through all of its gyrations.

3:52So I just wanted to be aware of that, because the first time we deploy this in any virtualized environment, it took so long I thought, it's failing, it's failing, it's not continuing. When in reality, I just wasn't patient enough after the VM was up and running for it to fully initialize. And the reason I tell you that is I don't want you to make the same mistake of just getting impatient, thinking, oh, it's not working, what's wrong. Just give it some time. All right, so from an ESXi host perspective, it's deployed and it is powering up. Let me go ahead and minimize the tasks there. Let's go to virtual machines here on the left. There's our FMC right here.

4:24I'll go ahead and click on it. And then we can click right here to go ahead and open up a console to it. So it's right here that we need to be patient and wait for it to finish. And when it's done with all of its magic about the initialization of the database and everything else getting set up, it'll prompt us for a login. And it's at that point we're going to log in as admin, with a default password for a Firepower Management Center server. And that is capital A-D-M-I-N-1-2-3 for the initial log in, after it's ready for us. And so here's what I propose we do.

4:54I'll let this go ahead and run for 20, 30, 40 minutes as it does all its initial setup. And while it does that, let's you and I go to the next video. And in the next video, we'll walk through the deployment of our FTDs, the Firepower Threat Defense appliances, also as VMs in our virtualized lab environment. So I'll see you in that next video in just a moment for the deployment of the FTDs. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:06And welcome back. If we had a manager that had nobody to manage, what do we call that manager? I think maybe lonely? Well, with a Firepower environment, we want to have a Firepower Management Center to manage what? To manage our Firepower Threat Defense appliances. So in this video, I'd like to walk you through deploying three VMs, which are going to represent our three FTDs, one at headquarters site, and then FTD number 3 at site 3, and FTD 4 at site 4. And that way, we'll have them available and ready for us in our lab environment, so we can go to work in creating policies and doing all the magic that Firepower brings to the table.

0:42So let's take a look at the big picture as far as where they fit in. Then I'll walk you through the deployment of our FTDs. And so in our topology, we've got FTD-1, FTD-3, and FTD-4. And if you're thinking, Keith, where's FTD-2? Later on in the videos, we'll deploy FTD-2 with high availability for FTD. And that's why I'm going to leave that little FTD-2 spot open for our HA discussions, which are coming up in separate sets of videos. So far the deployment of this virtualized lab inside of an ESXi host, when we deploy these three FTDs, they are going to need to have one connection that goes out here to the lab internet, which is our port group representing that.

1:22So there'll be one on each of them there. And they're also going to need a connection over to the HQ network for FTD-1, and to site 3 for FTD-3, and for site 4, and their respective port group there for site 4. And because we're putting each of these FTDs also on the management network of 192.168 for management purposes, we're also going to want to connect the management interface or interfaces to that network, as well, in that port group. So as we go through the deployment of these three FTDs, what I'll do is I'll walk you through those interface assignments as they come up, so you can see exactly which interfaces need to go to which port groups to make this topology happen.

2:02So back at our ESXi host, which is providing all the magic for this lab, let's right click on Host. From the dropdown, we'll select Create/Register VM. And then we'll select Deploy a machine from an OVF or OVA file. Cisco, when they provide the virtualized images for the FMC, as well as the FTD, they are going to be packaged in this virtualization format. So it makes it very easy to deploy. So I've downloaded, from Cisco, the files for the virtual edition of an FTD. And that's what I'm going to point to when it asks me, hey, where are the files?

2:35So we'll click on Next. So we'll call this FTD-1. And them I'm going to here in this big section so I can browse for the actual files for this. So I'll click here to select files. And then under a folder called FTD, Extracted, I've got the Firepower Threat Defense appliance VM files, which are these three right here. And the ones with VI, that's if we were going to deploy them using vCenter. But in our case, we're just using a standalone ESXi host. So the VMDK is the hard disk file.

3:07The MF is the Manifest File, which includes some hashes for validation of the files. And then the OVF is the configuration file. So with those selected, we'll click on Open. And it's going to use the VMDK and the OVF, and we'll click on Next. And then I'm going to store this on the ESXi host on this datastore with the SSD drive. Click on Next. And now here's where it gets interesting. Look at this. We've got-- that's a whole bunch of interfaces. So from the perspective of getting the right interfaces into the right port groups, let me walk you through where we're going to want to put these.

3:40And I also want to tell you that the first time I did this, I didn't get this all correct. So after a couple of goes and looking at the documentation, which is always a great solution, let me share with you information about these interfaces. So I see the FTDV interface in a Google search, and I found this document from Cisco regarding the Firepower Threat Defense Virtual, which is the virtual appliance. And I scrolled down to Interfaces. And here in table 4-- let me make a little bit bigger here, as well. Here in this table, it's showing us the interfaces.

4:12So effectively, what we want to do is we want to take the first two interfaces-- these are in order-- which they're calling adapter 1 and adapter 2. And in our hypervisor environment, that's literally what it's going to be called. And we're going to want to put both of those into our management network. So we'll take interface 1 and 2 and associate those with the 192 network for management. And also in our topology, because I want gig 0/0 to be connected to our pseudo-internet, I'm going to specify that adapter 3 should connect to the 23 network port group for our pseudo-lab internet.

4:42And then network adapter 4 on our ESXi host, which is going to be gigabit-ethernet 0/1, I want that to go to my local network. So that would go-- on FTD-1, it would be the HQ network. On FTD-3, it would be the site 3 network. And on FTD-4, it would be the site 4 port group to put those interfaces-- in this case, it's going to be gig0/1-- from the FTD's perspective, in the correct network. So that's our game plan. And all the other interfaces, including adapter 5 and beyond, we'll just put all of those in the parking lot, meaning the port group associated with our parking lot switch.

5:20And then if we need them in the future for things like high availability or more interfaces, we can bring them out of the parking lot and put them into our production lab environment. But initially, we want to set them up like this. So the first two, we want to put in our management network. So I'll select those port groups. The next one is our outside interface, and so that outside interface is going to be our lab pseudo-internet. So I'll switch the port group there. And then 0-1, and this is FTD-1, is going to be on HQ Net.

5:50And then for FTD-3 and FTD-4, they would actually choose Site 3 and Site 4, respectively. So I'm going to choose the correct port group here. And then for the rest of these interfaces, I'm going to say, Not Used Parking lot, Not Used Parking Lot, Not Used Parking Lot, et cetera, all the way down. And with those correctly selected-- let me just check my work. Mgmt Network, the pseudo internet for Gig0-0, and 0-1 will be the HQ 10 network for FTD-1. Fantastic. And the rest, we're not using at the moment.

6:20And then for the Deployment type, we can select how much we want to throw at this. If you have 128 gig, or 256 gig, or a terabyte server of RAM, just go crazy. But for a lab environment, if you don't have a ton, you might want to choose lower is better. For my lab environment, I have a whole bunch of cores and a whole bunch of RAM. So I'm going to say for this FTD, just go hog wild with 12 cores and 24 gigabytes of RAM. And the cool thing is, with a hypervisor like ESXi, if those devices-- if this VM is not using those resources, it's not going to tie up those resources.

6:54So there's not a lot of harm to give it a little more than what it might actually need. Then I'm going to do Thin provisioning, and I'm going to tell it to Power on automatically. And we'll click on Next. I'll confirm my work here. That all looks good. And we'll click on Finish. And if we click on Recent tasks, it can show us the deployment of that virtual machine, which in our case is FTD-1. And the process for doing FTD-3 and FTD-4 is exactly the same as for FTD-1. So we don't need to walk through that whole process again. The big difference would be for the deployment of the VM for FTD-3, we'd want the 0/1 interface to connect to the site 3 inside network of 10.3.

7:33And for the FTD-4, that 0/1 interface would connect to the site 4 switch and port group to put it in the right network. So the process is the same for those two, so I'll do that off-camera, because it's identical to FTD-1, with the exception of that one port group. So to complete our lab environment, in the next video, I'd like to walk through just the basic connectivity and integration of the Firepower Management Center, from the previous video, and the Firepower Threat Defense appliances from this video. And that'll give us a basic foundation for a working Firepower lab that we can then play with and work with going forward.

8:07So I'll see you in the next video for that integration. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:07In the previous video, we deployed our FTDs-- the Firepower Threat Defense Appliances-- as VMs. Before that, we deployed the FMC as a VM. To integrate those so we can have the FMC manage the FTDs, we need to do a few things, including give everybody an IP address on the management network, and then also associate the FTDs that they should be managed by our FMC. So to verify that we have a functional lab on our hands, what we're going to do in this video is integrate the FTDs with the FMC. And then once that's in place, boom.

0:39We now have a great framework for a lab environment that we can use to practice going forward. So what we'll want to do on these FTDs is in the initial config, which I'll walk you through, we're going to want to configure this guy with an IP address of .11 on its management interface, and this guy, .13, and this guy, .14. And on the Firepower Management Center, we want to give it .10. And then we want to tell the FTDs that they're going to be managed by this Firepower Management Center, like that. So let me bring in the players. Here's FTD-1. There's the console for it.

1:10And here is FTD-3. And I'll size them up here in a bit. And here's FTD-4. And here is the FMC. And that way, they're in a similar position as they were in the diagram. And I'll see if I can make these a little bit bigger, as well. Let's go and start up here on FTD-1. And the reason why we're going to start on FTD-1 is because the Firepower Management Center is still initializing. So let's start with FTD-1. So the default username and password on an FTD, as well as on the FMC, is admin as the user, and the password is Admin123.

1:48Press Enter. And we are now logged into FTD-1. And here, I'm going to press Enter to accept the end user license agreement. Hit Space bar a few times to go all the way down to the bottom. And then press Enter to agree to the end user license agreement. In fact, let me minimize the other windows just for a moment. And that way, we can focus on the initial config for FTD-1. So let me bring that down to the middle and make that a little bit bigger. There we go, much better. Now it's asking for a new password.

2:18So we can set the password to whatever you want in your lab environment. I'm going to set mine. Press Enter. Confirm the password. Press Enter. Do I want to configure IPv4? Yes, I do. If it's in brackets, you can just press Enter. That'll accept it. And do I want to configure IPv6? There's an n in brackets, so we can press Enter to select that. And then how do we want to configure IPv4? We're going to do it manually based on our plan. And we are going to use-- this is FTD-1-- 192.168.1.11, based on our plan, with a 24-bit mask.

2:52Enter. And a default gateway of 192.168.1.1. And that's my default gateway on my home network. And press Enter. And we'll call this FTD-1. I'm going to call it nuggetlab.com. So if you have DNS in your home lab, as well, you can set all that up for name resolution. And then it's asking for a comma-separated list of DNS servers. If you have a DNS server in your home lab, you could point to it. Right here, it's pointing to the OpenDNS or the Umbrella servers on the internet, which is fine. Press Enter. I'm not going to provide any search domains.

3:23Next it's asking, do you want to manage this Firepower Threat Defense appliance locally? Meaning, do you want to connect to it directly and manage it by yourself? Or if we say no, do we want to use the FMC, the Firepower Management Center? Which we do. So we're going say no to being managed locally. Press Enter. Then it's asking us, do you want this to be a routed layer 3 routing firewall, or do you want to be like a bridge in the night, like a bump in the wire-- transparent mode? And the default is routed. I'll press Enter to accept that. And we'll have further discussions in our configuration videos about routed versus transparent, but we're going to start off with routed.

3:57And then it's giving us instructions for how to allow this Firepower Threat Defense Appliance to be managed by a Firepower Management Center. And we're going to use the command configure manager add, and then the hostname, if it's resolvable, or the IP address, followed by the key that the manager would also have to supply in order for it to work. So for us, we're going to type in configure manager and then add. And the manager's address is 192.168.1.10.

4:27That's our Firepower Management Center. And then we just specify a key that we want to use. So it doesn't really matter too much about the key we use right here, as long as we use the same key at the FMC when we try to bring this FTD along with us as a managed device. So we'll press Enter. It says it was successfully configured. We can also do a show managers. Press Enter just to verify. So here it says the FMC is at 192.168.1.10, that we have a key specified, and it's pending, meaning we haven't had that manager reach out to us yet.

4:58But hey, we're willing. And we're going to repeat this process on FTD-3 and FTD-4. We'll assign the IP address of .13 to FTD-3 and .14 to FTD-4. And we'll configure each of them to be willing to be managed by the FMC. So in the background right now, I'm going to configure FTD-3 and FTD-4 with their respective IP addresses, and also telling them to wait for the FMC to contact them so they can be managed by the Firepower Management Center.

5:28OK, so finally, the FMC has also finished its initial bootup and installation of the database and everything else. So on the FMC, we're going to do the initial bootstrap by logging in as Admin with the default password of Admin123. Press Enter. And again, this is on the FMC. We'll press Enter. Hit Space bar a few times. Press Enter to accept the end user license agreement. And then we'll specify a password, and then we'll confirm the password.

5:59Press Enter. And we'll call this fmc.nuggetlab.com. Press Enter. We're going to do a manual configuration of the management interface on the FMC. And it is going to be 192.168.1.10, based on our plan, with a 24-bit mask. Looks good. Default gateway of .1 looks good. DNS servers using OpenDNS, which is now Umbrella. Press Enter. It's going to resolve these NTP servers and use that for NTP. That's fine. And if we had a lab environment where we had a Windows Server acting as a time server, as well, we could all point to that specific IP address in your lab environment, if you desire.

6:38So I'm going to hit a y for yes. Press Enter. And then to integrate the three FTD appliances with this Management Center, we're simply going to open up a browser to 192.168.1.10 and finished the configuration from there. So here from my computer that I use every day, right here on the 192.168.1 network-- so I have reachability to the whole management network from my computer-- I'm going to https://192.168.1.10 and press Enter. So because FMC is currently using a certificate that's self-signed, my browser doesn't trust it.

7:11That's OK. I'll click on Advanced and Proceed. And here, we're going to login as admin. I'll supply the password, and we'll click on Log In. So here, with 6.7, this is the first pop-up that comes up. And it's giving us the opportunity of licensing it, or check this out. We'll click this radio button to start the 90-day evaluation period right here. So we'll start the evaluation, and we'll click on Save. And then if we want to bring in the three FTDs, we go to Devices. And from the dropdown here, we click on Device Management. And that was the screen that we were currently looking at, but I want to show you how to get there.

7:44And then over here on the right, we'll simply click on Add. And from the dropdown, we'll click on Device. And then we'll bring in those three amigos. So the first one's at 192.168.1.11. That's FTD-1. We'll give the name of FTD-1. And if you have local DNS services all setup and working, you could resolve it by name. And the key that we're going to use is the key we specified on the FTD, which is Cisco123. And then we're using the same password here. It's going to require an initial access control policy. There is none by default. So from the dropdown, we'll say Create new policy.

8:18Let's call this Starter ACP, for Access Control Policy. And regarding this policy, instead of blocking traffic or doing IPS, let's tell it just to do Network Discovery, which is pretty darn cool. That way, it can tell us what's going on. And we'll click on Save. So now that it knows what policy to use for access control, let's also enable Malware, Threat, and URL Filtering, because, hey, we got a 90-day license. Let's use it. And we'll click on Register. And then what we'll do is we'll do the same exact process to bring in FTD-3 at .13 and FTD-4 at .14.

8:51So FTD-1 is on its way. Let's bring in FTD-3 and 4. So we'll click on Add, and we'll put in the IP address 192.168.1.13 for FTD-3. And for the display name, we'll call it FTD-3. And we use the same key over there, as well. So I'll supply that key. And we'll use the same policy-- the same Starter policy we just created. And we'll enable Malware, Threat, and URL Filtering. And we'll click on Register. So FTD-3 is on its way in, and let's bring in FTD-4, as well.

9:26So here under Devices, with Device Management, we'll click on Add up in the upper right-hand corner. Click on Device. And we'll specify it's 192.168.1.14 for FTD-4. Display Name-- we'll give it as FTD-4. That will be for site 4. We'll put in the Key that we used over there for registration. We'll use the Starter Access Control Policy. We'll enable Malware, Threat, and URL Filtering services, and click on Register. So now FTD-4 is in place, and we now have a base infrastructure for practicing, playing, and working with a Firepower environment.

10:03So using the ESXi host is one way of doing it. And as we've demonstrated, that's my intent as we go forward to the other sets of videos. As we take a look at configuring Firepower and working with it, I'm going to be using this ESXi host-based lab. But it's not the only option. So if you don't have a host with a whole bunch of RAM that can support it, and you have a couple of computers laying around, there's also an option with VMware Workstation to build a lab. And I've got a separate set of videos just on how to put it together with VMware Workstation. Or if you want to use EvE-NG, I've also got a set of videos on that, as well.

10:35So I would encourage you, even if you're only going to use one lab environment-- you don't need all three-- I would encourage you to take a peek at those other ones, as well, because you'll get some more ideas and a better reference point on where things are. And then once we have a lab environment in place that we can practice with, I'd like to walk you through how it works-- the logic, access control policies, intrusion policies, malware policies, file inspection policies, SSL-intercept, and how that works and why we would do it. And having the lab available to you to practice with is a big part of reinforcing all those skills.

11:06So I would encourage you to choose one of the three options for a lab environment-- ESXi host, multiple machines with VMware Workstation, or using EvE-NG-- and then following along with me as we continue through the rest of the videos. So that's it for this set of videos regarding building a lab with one ESXi host. I appreciate you joining me, and I'll see you in the next set of videos. Until then, I hope this has been informative for you, and I'd like to thank you for viewing.