topic Re: Firepower NGFW 2110 interfaces can you make them access ports? in Network Security

Firepower NGFW 2110 interfaces can you make them access ports?

dan hale — Fri, 21 Feb 2020 15:34:34 GMT

HI All, is it possible to connect lets say a host or server directly to one of the 1GB copper or SFP interfaces and use that port as an access port?

I know typically the firewall ports are routed ports but, you can also make these ports trunking/sub-interfaces but, I would think you would need the host NIC to have a way to interpret the frames/vlans from the 2110.

Has anyone been able to connect to one of the 2110 interfaces and use as a switchport?

Thanks,

Dan

Re: Firepower NGFW 2110 interfaces can you make them access ports?

Bogdan Nita — Thu, 29 Mar 2018 07:34:48 GMT

Hi Dan,

I never actually tried it on the firepower, but should be similar to the ASA BVI setup.

About Routed Firewall Mode

In routed mode, the Firepower Threat Defense device is considered to be a router hop in the network. Each interface that you want to route between is on a different subnet.

With Integrated Routing and Bridging, you can use a "bridge group" where you group together multiple interfaces on a network, and the Firepower Threat Defense device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. The Firepower Threat Defense device routes between BVIs and regular routed interfaces. If you do not need clustering or EtherChannel or redundant member interfaces, you might consider using routed mode instead of transparent mode. In routed mode, you can have one or more isolated bridge groups like in transparent mode, but also have normal routed interfaces as well for a mixed deployment.

https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

HTH

Bogdan

Re: Firepower NGFW 2110 interfaces can you make them access ports?

dan hale — Thu, 29 Mar 2018 18:39:45 GMT

Thanks for pointing me in the right direction however, it looks like creating BVI's is not supported on the 2100's.

"you cannot configure bridge groups on Firepower 2100 series or Firepower Threat Defense Virtual devices."

https://www.cisco.com/c/en/us/td/docs/security/firepower/622/fdm/fptd-fdm-config-guide-622/fptd-fdm-interfaces.html#id_35464

Thanks,

Dan