Access resources to learn everything you need to know about Next-Generation Firewalls.

Installation and Configuration guides

Smart Licensing information

Firewall policy configurations

Deployment best practices

Get started

Here’s the information you need to get started with your Next-Generation Firewall (NGFW), so you can keep your network safer, address advanced threats quicker, and simplify your security operations.

You can't protect what you can't see

You now have the visibility, automation, and flexibility you need to defeat the latest threats.

Watch now (1 min)

How to prepare for your NGFW.

Steps to success

Ready to get started? Take these steps to install, configure, activate licenses, and prepare your Next-Generation Firewall for deployment.

STEP 1

Select your appliance to get your installation guides.

Adaptive Security Appliance (ASA) 5500 -X series

5506-X, 5506W-X, or 5506H-X

5508-X

5516-X

5525-X

5545-X

5555-X

Cisco Firepower NGFW 2100 Series

Cisco Firepower NGFW 4100 Series

Cisco Firepower NGFW 9300 Series

STEP 2

Explore the Smart Licenses available for NGFW and activate them.

STEP 3

Learn about the policy configurations.

STEP 4

Get deployment best practices.

Next Step:

Activate your Smart Licenses

With Smart Licenses you can easily view and manage your Cisco licenses. For your Next-Generation Firewall, there are three licenses available: Threat, URL Filtering, and Malware. Click on the blocks below to learn about the capabilities that each of these licenses can unlock.

Threat

URL filtering

Malware

Threat

With the Threat License, you have access to Next-Generation Intrusion Prevention System (NGIPS), which combines superior visibility with embedded security intelligence, and automated analysis. With NGIPS, you can see and correlate extensive amounts of event data within your Next-Generation Firewall management console.

Activate your license to detect and prevent intrusions and exploits, optionally drop offending packets, and block users from uploading or sending/receiving files of specific types.

Activate your license

Explore More

Next Step:

Configure your firewall policies

You have the industry’s first fully-integrated, threat-focused NGFW. Now you can stop more threats - both known and newly emerging, targeted threats.

There are a wide variety of policies you can configure within your manager. Here are some of the most common practices.

Click on one of the topics below to learn more about these policies.

Access control policies

File policy

Other firewall policies

Access control policies

An access control policy is the primary policy for controlling network traffic. Each on your Next-Generation Firewall devices can have one currently applied policy. Through your access control policy, you can establish rules for allow, trust, monitor and block. Within your access control policies, you can configure Application Visibility and Control (AVC), URL Filtering, and Threat. You can also control traffic based on layer 3 and layer 4 information, as you would with a traditional stateful firewall. Access control policies can also reference a predefined Intrusion policy to provide you with a level of threat protection.

Configure your Access Control Policy (FMC)

Configure your Access Control Policy (FDM)

Next Step:

Prepare for deployment

As you move your Next-Generation Firewall from your testing environment to your production environment, we recommend doing it in phases. Here are some simple best practices to help you get started.

For your initial deployment, start with your traditional firewall. Then, gradually turn on your next-generation features.

If possible, load with a portion of your network traffic first.

For the initial deployment, only turn on the firewall rules that were pre-existing.

Deploy with a safe evaluation configuration:

Configure the intrusion policy to not drop packets.
Make sure all access control policy rules are set to allow, trust, or monitor.
The exception is the default rule, which should be set to block for edge firewalls.

Once you have confidence in the policy configuration, change the actions to drop the appropriate traffic.

Join the Security
Community

Open a case

Get Cisco Security
Implementation services

Welcome to your

Next-Generation Firewall
Resource Center

Access resources to learn everything you need to know about Next-Generation Firewalls.

Get started

You can't protect what you can't see

Steps to success

Next Step:

Activate your Smart Licenses

Threat

URL filtering

Malware

Next Step:

Configure your firewall policies

Access control policies

Next Step:

File Policy

Next Step:

Other firewall policies

Next Step:

Prepare for deployment

For your initial deployment, start with your traditional firewall. Then, gradually turn on your next-generation features.

If possible, load with a portion of your network traffic first.

For the initial deployment, only turn on the firewall rules that were pre-existing.

Deploy with a safe evaluation configuration:

Once you have confidence in the policy configuration, change the actions to drop the appropriate traffic.

Welcome to your

Next-Generation Firewall Resource Center

Access resources to learn everything you need to know about Next-Generation Firewalls.

Get started

You can't protect what you can't see

Steps to success

Next Step:

Activate your Smart Licenses

Threat

URL filtering

Malware

Next Step:

Configure your firewall policies

Access control policies

Next Step:

File Policy

Next Step:

Other firewall policies

Next Step:

Prepare for deployment

For your initial deployment, start with your traditional firewall. Then, gradually turn on your next-generation features.

If possible, load with a portion of your network traffic first.

For the initial deployment, only turn on the firewall rules that were pre-existing.

Deploy with a safe evaluation configuration:

Once you have confidence in the policy configuration, change the actions to drop the appropriate traffic.

Next-Generation Firewall
Resource Center