topic Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn in Network Security

FMC (PPPOE) to FTD (PPPOE) site to site vpn

diogo_1203 — Fri, 21 Feb 2020 16:40:56 GMT

Hello guys,

Is it possible to make a vpn site to site the FMC (dynamic ip PPPoE) to FTD (dynamic ip PPPoE)?

Thanks....

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

shaps — Mon, 21 Jan 2019 16:01:16 GMT

Hi
Not sure about the specifics of the Firepower config, however I dont see a reason why you cannot, the only limitation is the IP may change but this can be addressed by using DDNS.

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

Nico.Sauerbrey — Tue, 22 Jan 2019 21:49:13 GMT

Hi diogo,

not sure if i understand your problem.

do you mean u have a ftd managed by an FMC on SiteA and one standalone ftd (probable managed by FDM) on SiteB?

in this case u wont be able to configure PPPoE on the FDM, so this wont work (You cannot configure PPPoE for IPv4. If the Internet interface is connected to a DSL, cable modem, or other connection to your ISP, and your ISP uses PPPoE to provide your IP address, you must use Firepower Management Center to configure these settings).

the FMC is a management-vm or physical appliance and its only usecase is to adminstrate FTD-Sensors. The FMC itself doesnt establish site2site-vpns or have a pppoe-config on its mgmt-interface.

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

Abheesh Kumar — Wed, 23 Jan 2019 05:55:37 GMT

Hi,
Can you brief your setup...???

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

diogo_1203 — Fri, 25 Jan 2019 12:26:50 GMT

Hello Nico,

I'll try to explain it better. Attached is my topology.

In site A I have an ASA5506 with FTD being managed by the FMC, the FTD Outside interface is connected to the router R042 which in turn performs the NAT. The RV042 fa0 / 1 interface receives the ip address via PPPoE from the ISP.

In site B I have an ASA5506 with FTD being managed locally by FDM, the FTD Outside interface needs to receive the ip address via PPPoE from the ISP, but I could not do it by CLI or FDM, according to the Cisco documentation, this does not it's possible.

I need the FTD on site B to receive the ISP's PPPoE address, manage the FTD via FMC on site A, and after all this will still close a site-to-site VPN between site FTD A and site FTD B.

With pure ASA5506 I can make the VPN site-to-site with both sites receiving IP via PPPoE, but I can not use this scenario as a definitive solution. I need it to work with the FTDs being managed by the FMC on site A.

Thanks Nico!

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

diogo_1203 — Fri, 25 Jan 2019 12:30:06 GMT

Hello Shaps,

I am not able to configure the interface by CLI or FDM so that it receives PPPoE from the ISP, in the beginning it is a limitation of the equipment.

Thanks

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

diogo_1203 — Fri, 25 Jan 2019 12:36:32 GMT

Hi Abheesh,

I have not done any PPPoE configuration yet, as there is no option for this in FDM or CLI.

I'm looking for alternatives, in the comment above I put the topology and gave a summary about it.

Thanks.

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

Nico.Sauerbrey — Tue, 29 Jan 2019 13:37:15 GMT

Hi diogo,

sry for the late response, been busy at work.

As u mentioned by yourself u can't use FTD with FDM on Site B because it doesnt support PPPoE. So install an FMC in Site B.

The real problem is, that u have to configure a Site To Site VPN under Devices, where u can add vpn (firepower threat defense device) and choose point to point and under node B Extranet where u have to add an ip address. See the Problem? u cant use an dns and the endpoint on the other site gets an ip via pppoe, so it can change on every reconnect via isp.

In other words your config wont work if site A and site B dont have static ip addresses.

Re: FMC (PPPOE) to FTD (PPPOE) site to site vpn

diogo_1203 — Tue, 29 Jan 2019 19:54:58 GMT

Hi Nico,

yes, I saw that it will not be possible to configure the way the ASA appliances are today.

Thanks for the answer.