Solved: AMP for endpoints

LSA4 · ‎06-16-2016

Hi Guys

before i start, forgive me for this post, i just need to be pointed in the right direction.

I have installed a ASA5506 at a client site for a POV, behind their edge firewall. The ASA is sitting on the network just monitoring traffic. It picked up malware immediately.

Now the client is looking for malware for endpoints, i have read and read,

I see there are two deployment modes, Cloud Proxy mode and Air Gap mode.

client already has a virtual environment, so what do i need exactly. where will i monitor the endpoints? On FMC? or Cloud

I want an on prem solution. i have read the deployment guide, but i still feel totally lost, someone please guide me...

yogdhanu · ‎06-16-2016

You would get the cloud account credentials when you purchase the amp for endpoint.

For on-prem soulution,

http://www.cisco.com/c/en/us/support/docs/security/sourcefire-fireamp-private-cloud-virtual-appliance/118336-configure-fireampprivatecloud-00.html

http://www.cisco.com/c/en/us/products/collateral/security/fireamp-private-cloud-virtual-appliance/datasheet-c78-733180.html

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-private-cloud/FireAMPPrivateCloudUserGuide.pdf

this should help.

View solution in original post

yogdhanu · ‎06-16-2016

Hi

Endpoint clients will be monitored from Cloud. You can integrate cloud to FMC to check the events there as well.

There is an on-prem virtual appliance for fireamp cloud is available as well.

FMC cannot manage the endpoint AMP clients.

Rate if helps.

Yogesh

LSA4 · ‎06-16-2016

So do i setup a session in the cloud?

What is the SKU for the on-prem solution?

do i just run it on a UCS? What software must i download to the UCS? I am trying to draw this solution in my head to understand it properly. Like i said i am completely lost.

yogdhanu · ‎06-16-2016

You would get the cloud account credentials when you purchase the amp for endpoint.

For on-prem soulution,

http://www.cisco.com/c/en/us/support/docs/security/sourcefire-fireamp-private-cloud-virtual-appliance/118336-configure-fireampprivatecloud-00.html

http://www.cisco.com/c/en/us/products/collateral/security/fireamp-private-cloud-virtual-appliance/datasheet-c78-733180.html

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-private-cloud/FireAMPPrivateCloudUserGuide.pdf

this should help.

LSA4 · ‎06-16-2016

let me do some further reading, thanks for the prompt response..

See you soon :)

LSA4 · ‎06-16-2016

last question, where do i get the ova file from , pic attached

yogdhanu · ‎06-16-2016

Hi

Your accounts team should be able to provide you the link for that.