topic Re: Passing Layer 3 Traffic Through Transparent Mode FTDv in Network Security

Passing Layer 3 Traffic Through Transparent Mode FTDv

Dia — Fri, 21 Feb 2020 15:12:27 GMT

Hi All,

I am doing a new deployment of Virtual Firepower Thread Defense (FTDv) using ESXI and using ACI as bridge domain for my infrastructure.

My problem is the FTDv is running in Transparent mode between 2 routers and these routers will be running IBGP over different links one of them having the FTDv inline, BGP is not forming over this link so any Idea what could be the reason?

Regards

Re: Passing Layer 3 Traffic Through Transparent Mode FTDv

Dennis Mink — Thu, 25 Jan 2018 02:18:40 GMT

BGP requires TCP port 179 to be open between peers. check on your FW to see if this is allowed

Re: Passing Layer 3 Traffic Through Transparent Mode FTDv

Dia — Thu, 25 Jan 2018 02:53:01 GMT

I have a rule to permit any any

Re: Passing Layer 3 Traffic Through Transparent Mode FTDv

Karsten Iwen — Thu, 25 Jan 2018 07:25:44 GMT

Are you using BGP-authentication? Then you need a workaround:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy10017

Re: Passing Layer 3 Traffic Through Transparent Mode FTDv

Dia — Sun, 28 Jan 2018 22:10:54 GMT

Hi Karsten,

Thanks for your feedback that would help in later stage bu actually i am in the stage to establish the BGP without authentication between two BGP speaking routers peering with each other and no BGP running on FTD as it is Transparent.

Regards

Re: Passing Layer 3 Traffic Through Transparent Mode FTDv

sbhadrav@cisco.com — Mon, 12 Mar 2018 20:28:22 GMT

In transparent mode of Firewall, you needs to create bridge groups to the vlans at both (in/out) side of firewall.

Example: Configuration on Inside/outside interfaces:

interface TenGigabitEthernet0/6

    vlan 20
    nameif inside
    bridge-group 1
    security-level 100

interface TenGigabitEthernet0/7

    vlan 30
    nameif outside
    bridge-group 1
    security-level 0

Now please configure "BVI" interface with one IP from the same IP Subnet for which you want to pass traffic through firewall:

interface BVI1

ip address 192.168.10.9 255.255.255.0 standby 192.168.10.10 (any free IP can be assigned from subnet)

Now, please allow interested traffic on ouside Interface via access-list. This will redirect traffic through transparent firewall.

Re: Passing Layer 3 Traffic Through Transparent Mode FTDv

Octavian Szolga — Tue, 13 Mar 2018 08:17:21 GMT

Hi Dia,

I would suggest you change the firewal mode to routed from transparent.

Transparent is more of a headache. You can have the same inline processing of traffic using routed mode with inline pairs, without any need for a BVI interface with IP and so on.

Afterwards, you can create your own rules to permit TCP 179 between peers plus TCP option 19 for BGP authentication.

Thanks,

Octavian