topic Re: IPS resources on Firepower in Endpoint Security

IPS resources on Firepower

mateens — Thu, 11 Feb 2021 09:20:42 GMT

Hi,

If there are 2 instances for 2 customers on 4100 series firewall. Is it possible to assign specific resources to a specific customer also for IPS?

can anyone provide any cisco documentation ?

Mateen

Re: IPS resources on Firepower

balaji.bandi — Thu, 11 Feb 2021 10:59:02 GMT

here is multi tenancy deployment and configuratiion guide :

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/multi-instance/multi-instance_solution.html

If you got access to cisco Live Presentation look one of the document is good for reference :

BRKACI-3004

Re: IPS resources on Firepower

mateens — Thu, 11 Feb 2021 11:01:00 GMT

Can IPS resources also divided ?

Re: IPS resources on Firepower

balaji.bandi — Thu, 11 Feb 2021 11:32:27 GMT

I have not deployed, yes and hope so.

Re: IPS resources on Firepower

mateens — Thu, 11 Feb 2021 11:35:36 GMT

heard that IPS use shared resources when needed so it is not recomended to run IPS when firepower is shared with other customers. Cannot find any documentation.

Re: IPS resources on Firepower

Oliver Kaiser — Thu, 11 Feb 2021 13:15:14 GMT

You can use multi-instance mode to achieve "real" multi tenancy on FPR4100 / 9300. That way every virtual instance received dedicated cpu cores, memory and disk space. Splitting resources within a single instance is not possible, for example you cannot provision a virtual instance running Firepower Threat Defense and use 20% of the cpu cores for Customer A traffic and 50% of cpu cores for Customer B traffic. For a clean seperation you musst assign a dedicated instance to each customer (... atleast if you really need resource reservations) and a seperate data/control/mgmt plane for each customer