Skip to main content

 

 

Cisco Defense Orchestrator

Apply Firepower Threat Defense Templates

About Applying Firepower Threat Defense Templates

Applying a Firepower Threat Defense (FTD) template to create a new FTD overwrites entirely any existing configuration on the FTD including any staged changes that have not yet been deployed from CDO to the device.

Note that when you apply a template, the device configuration will be completely overwritten by theconfiguration on the template. Anything on the device that was not included in the template will be lost.

Applying the template to a device is a three step process. 

  1. Apply the template to the device.
  2. Review device and network settings.
  3. Deploy the changes to the device.

Prerequisites

The following conditions must be met prior to applying a template:

  • When using a template, be sure that any changes you have made to the template have been committed and that the template is in the "Synced" state on the Devices & Services page.
  • When using an FTD device as a template, be sure that any changes on CDO that you intended to deploy to the device have been deployed and that there are no changes from the FDM console that have not been deployed and then read back into CDO. The device must show a Synced state on the Devices & Services page.

Apply Template to Firepower Threat Defense Device

Important: Before you deploy the changes to the device, continue to the next procedure, Reapply Device and Network Settings

You can use change request tracking to apply a tracking label to your changes before you apply the template. Use the following procedure to apply an FTD template:

  1. (Optional) Before you begin, make a template of your FTD device before you apply another template to it. This gives you a configuration backup you can reference when you need to reapply device and networking settings.
  2. In the CDO navigation bar, click Devices & Services.
  3. Use the Devices & Services filter and search field to find the FTD device or template to which you are going to apply the template. 

Note: If you change the name of the template at this point, you are applying a full device configuration or template to DeviceName. Deploying this change to DeviceName will overwrite the entire configuration running on that device.

  1. In the device Actions pane on the right, click Apply Template.
  2. Select the desired template or an existing onboarded FTD device to use as a template.
  3. Map Interfaces
    Map References. Confirm or change the mapping of interfaces between the template and the device. Note that you cannot have more than one template interface mapped to a single device interface; if the interface configuration is not supported, you cannot continue and apply the template. 
  4. Fill Parameters. Customize the parameter values for the device you are applying the template to. 
  5. Review. Review the template configuration.
  6. Click Apply when you are ready to overwrite the existing device configuration with the configuration in the template.

Review Device and Networking Settings

When creating an FTD template, CDO copies the entire device configuration into the template. So, things like the management IP address of the original device are contained in the template. Review these device and network settings before you apply the template to a device:

  1. Review these FTD device settings to ensure that they reflect the correct information for the new FTD device: 
  1. Review the Firepower access control policy to ensure that rules reference the new FTD's IP addresses where appropriate. 
  2. Review inside_zone and outside_zone security objects to ensure they reference the correct IP address for the new FTD.
  3. Review NAT policies to ensure they reference the correct IP addresses for the new FTD.
  4. Review Interface configurations to ensure that they reflect the correct configuration for the new FTD.

Deploy Changes to the Device

Review and deploy now the changes you made, or wait and deploy multiple changes at once.

 

Related Topics

 

  • Was this article helpful?