NGFW Foundations: FTD & FMC Lab

Configure and operate Cisco's Next-Generation Firewall from the ground up - access control and application policy, NAT, IPS and URL filtering, SSL decryption, identity-based policy, malware protection, VPN, high availability, and day-to-day monitoring and troubleshooting, all managed through Firepower Management Center (FMC). This course gives you hands-on practice with real Firepower Threat Defense (FTD) and FMC deployments. Designed for security engineers and CCNP Security candidates who need real NGFW build and policy experience beyond slides and simulators.

The launch will be soon
🛡

Course Highlights

🛡

FTD & FMC Management

Master centralized firewall management, Smart Licensing, interface zones, administrative roles, and dynamic updates via Firepower Management Center.

⚙

Access Control & App-ID

Configure Layer 4 port-based policies, Pre-Filter rules, and application-level control (App-ID) to secure traffic flows across routed and transparent modes.

🎯

IPS & Threat Intelligence

Deploy Snort IPS intrusion policies, configure URL Filtering, feed Security Intelligence data, and leverage the Encrypted Visibility Engine (EVE).

👤

SSL Decryption & Identity

Enable SSL/TLS decryption for encrypted traffic analysis and integrate Active Directory to enforce identity-based security policies.

🌐

Site-to-Site & RA VPN

Build robust IPsec Site-to-Site VPN tunnels between FTD gateways and deploy Remote Access VPN using Cisco AnyConnect.

🔄

HA & Migration Tool

Implement Active/Standby Failover for high availability and migrate legacy Palo Alto (PAN) configurations to FTD using Cisco's Firepower Migration Tool.

Real NGFW Build & Policy Experience

Designed for security engineers and CCNP Security candidates who need real Firepower Threat Defense (FTD) and FMC deployment experience beyond slides and simulators.

Gain end-to-end practical skill in configuring, managing, and troubleshooting Cisco's Next-Generation Firewall suite in live network topologies.

  • Centralized FMC Control: Configure interfaces, dynamic routing, NAT, and policies across multiple FTD devices seamlessly.
  • Deep Threat Inspection: Deploy Snort IPS, AMP malware protection, SSL decryption, and Security Intelligence feeds.
  • Vendor Migration & Resilience: Set up High Availability clusters and migrate configurations from Palo Alto (PAN) to Cisco FTD.
[Insert FTD & FMC Lab Topology Diagram]

Exam & Certification Alignment

This course builds practical Cisco NGFW (FTD/FMC) skills that align with the security policy, VPN, and threat defense portions of the Cisco SCOR (350-701) exam and the CCNP Security certification track. Refer to the official Cisco SCOR exam topics on cisco.com for the full certification blueprint.

CCNP Security (SCOR 350-701)

Master core Cisco Security concepts including firewall policy, threat defense, IPS tuning, and encrypted traffic inspection.

Cisco FTD Deployment

Gain practical proficiency in routed/transparent modes, NAT, application visibility, and Advanced Malware Protection (AMP).

FMC Centralized Administration

Learn day-to-day policy management, event correlation, packet-tracer troubleshooting, and automated threat updates.

Technologies Covered

  • ✓ Cisco Firepower Management Center (FMC)
  • ✓ Cisco Firepower Threat Defense (FTD)
  • ✓ Routed & Transparent (Layer 2) Modes
  • ✓ Access Control & Pre-Filter Policies
  • ✓ Application Visibility & Control (App-ID)
  • ✓ Auto NAT & Manual / Static NAT
  • ✓ Snort IPS & Security Intelligence
  • ✓ Encrypted Visibility Engine (EVE) & SSL Decryption
  • ✓ Active Directory Integration & Identity Policy
  • ✓ Advanced Malware Protection (AMP) & File Policy
  • ✓ Site-to-Site IPsec & AnyConnect Remote Access VPN
  • ✓ Cisco Firepower Migration Tool (Palo Alto to FTD)

Modules & Topics

  • Apply Smart Licensing / evaluation license
  • Review configuration, set dashboard widget layout, and check/apply Dynamic Updates
  • Create an admin account with limited access
  • Rename interface zones and create management interface profiles
  • Test device access and internet connectivity
  • Configure routed interfaces and security zones
  • Configure static routing
  • Deploy FTD in Transparent (Layer 2) mode
  • Verify connectivity in both routed and transparent modes
  • Create objects (addresses, services, groups)
  • Configure port-based (Layer 4) policy
  • Configure Pre-Filter policy
  • Create an application-based (App-ID) security policy
  • Deploy policy and verify allowed/blocked traffic
  • Configure Auto NAT (dynamic PAT) and Manual/Static NAT
  • Create and test a QoS policy
  • Create application-based (policy-based) routing
  • Create an Intrusion Policy and tune Snort IPS to stop unwanted traffic
  • Configure URL Filtering and web traffic control
  • Import and apply Security Intelligence feeds
  • Enable the Encrypted Visibility Engine (EVE)
  • Configure Network Discovery and visibility
  • Enable SSL/TLS decryption and encrypted traffic analysis
  • Deploy identity-based firewall policies with Active Directory integration
  • Configure File Policy and Advanced Malware Protection (AMP)
  • Configure Site-to-Site IPsec VPN between two FTDs
  • Configure Remote Access VPN with AnyConnect
  • Configure Active/Standby Failover between two FTDs
  • Set up event correlation and custom alerting
  • Review logging, monitoring, and reporting
  • Perform backup, restore, and system upgrade
  • Troubleshoot using packet-tracer and packet capture
  • Migrate a configuration from Palo Alto (PAN) to FTD using the Cisco Firepower Migration Tool

Start Your Lab Experience

Lab Hours Booking

Reserve access to a dedicated, pre-wired lab environment and use your purchased lab hours whenever it suits you.

Flexible Lab Access
  • Direct access via browser and internet connection
  • Dedicated FMC controller and live FTD gateways
  • Full control over security policies, routing & VPNs
  • Zero hardware required on your side
  • Schedule your lab session for any available date and time
The launch will be soon

Frequently Asked Questions

No. Your lab environment starts with FMC and FTD already deployed and registered, so you go straight into interfaces, policy, and features rather than initial bring-up.
Basic networking and security fundamentals (routing, NAT, ACL concepts) are recommended. No prior Firepower/FTD experience is required.
Yes. Module 2 covers routed-mode interfaces and security zones as well as deploying FTD in Transparent (Layer 2) mode, with connectivity verification in both.
Yes, Module 8 covers Remote Access VPN configuration. Note that the AnyConnect client itself is a separate Cisco download/license and isn't bundled with the lab environment.
Yes. Module 11 introduces the Cisco Firepower Migration Tool and walks through migrating a configuration from Palo Alto (PAN) to FTD.
Lab hours are booked from your account balance. See the Book Hours / Buy Hours options above for current packages and pricing.
Scroll to Top