topic Re: @itsupport@protectorfire.com in Network Security

Traceroute through FTD Sensor?

jan.nielsen — Fri, 21 Feb 2020 14:01:43 GMT

Does anyone have an FTD based firewall running, where traceroute through it works ?

In ASA, enabling inspection of icmp/icmp error, allowed traceroute to match icmp replies and allow them, without having to open icmp return packets on the outside interface.

This as far as i can tell, is not the case with FTD, I have no policies allowing any traffic from outside->inside, which is what i wan't. The FTD is not blocking the return packets for http/https or any other regular protocol, however it does seem to be blocking the return icmp packets, it seems like the old-style ASA icmp/icmp error inspection, is not working like it used to.

Anyone having problems with traceroute and FTD also ?

/Jan

There is a bug with 6.1, 6.2

Marvin Rhoads — Mon, 06 Mar 2017 12:30:59 GMT

There is a bug with 6.1, 6.2 (and even the soon-to-be-released 6.2.1) that may apply to your issue:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb40875

The Bug description doesn't say so, but you should be able to use FlexConfig on 6.2+ to add the inspect statements back into the configuration.

I filed this bug after

Dinkar Sharma — Mon, 05 Jun 2017 17:30:43 GMT

I filed this bug after verifying in lab. Yes you can use Flex config to add inspects. The bug has been fixed in 6.2.0.2.

@Dinkar Sharma ,

Marvin Rhoads — Tue, 06 Jun 2017 09:10:39 GMT

dinsharm ,

Thanks for the update. the BugID needs to be updated to show 6.2.0.2 as a known fixed release.

Unfortunately the fix did not make it in to 6.2.1. Maybe 6.2.2...?

Yes, The fix will be

Dinkar Sharma — Tue, 06 Jun 2017 13:21:37 GMT

Yes, The fix will be integrated for 6.2.2. We are also trying to get a document out with details. (Specially for FP2100 devices). I will correct the bug fixed versions.

That's great news Dinkar -

Marvin Rhoads — Tue, 06 Jun 2017 13:32:49 GMT

That's great news Dinkar - thanks.

I look forward to 6.2.2.

OK, thanks for the guidance

itsupport — Mon, 24 Jul 2017 03:05:41 GMT

OK, thanks for the guidance so far. Can someone expand or post a link on how to "use Flex config to add inspects"?.

I tried adding the System Defined, Default_Inspection_Protocol_Enable, to a new Flexconfig policy, however it seemed to do nothing.

@itsupport@protectorfire.com

Marvin Rhoads — Mon, 24 Jul 2017 05:08:46 GMT

[@itsupport@protectorfire.com.au]

Answered in your related post:

https://supportforums.cisco.com/discussion/13338721/configuring-block-ips-isp-5508-fmc

Re: That's great news Dinkar -

Marvin Rhoads — Wed, 04 Oct 2017 18:32:09 GMT

By the way - fix is confirmed for 6.2.2

Fixed yet?

HQuest — Mon, 15 Jan 2018 22:41:29 GMT

... wish I had found this thread earlier. Been bashing my head for quite a few days.
Can anyone confirm this was actually fixed? I'm running 6.2.2.1 on my lab device and the echo reply is still being blocked by the FTD sensor for any hops in the path. It works though for the destination address, but I could then just use a simple ping for that...

Re: Fixed yet?

Leon1 — Tue, 16 Jan 2018 15:43:40 GMT

I have the same f.... problem investigating the whole day for now... I updated from 6.2.0.4 to 6.2.2.1 because I need the VPN Access, but my feeling is that this version has more problems than the 6.2.0. Also I am actual unable to resolve DNS requests through the ASA. But this might be an another problem...

Re: Fixed yet?

Damir Reic — Mon, 22 Jan 2018 14:04:35 GMT

It's not working for me either.

Re: Fixed yet?

Marvin Rhoads — Tue, 23 Jan 2018 19:05:17 GMT

Here's my working configuration that allows both icmp reachability and proper traceroute output (i.e. with first route at FTD firewall reported) from my setup. Basically icmp is being inspected by default but I needed to add the echo replies (both Windows and Unix style) inbound (a platform setting) and also set my policy-map to decrement TTL ( a FlexConfig setup).

Re: Fixed yet?

Leon1 — Fri, 26 Jan 2018 15:56:32 GMT

Thank you! ...but ist there a way to apply this on FTD Device Manager directly?

Re: Fixed yet?

Marvin Rhoads — Wed, 31 Jan 2018 18:42:44 GMT

Sorry but no - FDM does not support FlexConfigs.

Those are one of several configuration options not supported via FDM. Others include:

dynamic routing

AAA server

multiple local users

~~certificates (other than the self-signed one)~~*

PPPoE

Etherchannel

redundant interface

SNMP configuration

correlation policy

centralized management of multiple devices

*limited certificate support is now available - no CSR capability.

Re: Fixed yet?

Leon1 — Mon, 29 Jan 2018 13:00:11 GMT

Thank you again 🙂 haha you have removed the site-to-site VPN from the list, thats correct 🙂

...but I will check that with the certificates double, as I saw an option to upload your own.

Hopefully cisco pushes the development a little bit more for the FTD.

Cheers

Re: Fixed yet?

Marvin Rhoads — Wed, 31 Jan 2018 18:52:08 GMT

Thanks Leon for pointing out the certificate bit. I updated my earlier post to correct it.

I had missed that but found it when I dug into my ASA 5506 running FTD with FDM.

It looks like you can upload but need to generate the key off-box (i.e. no Certificate Signing Request capability). So the super simple GUI requires you also be handy with openssl cli to generate a private key and CSR and then send it off to your CA.

Re: Fixed yet?

hparacha — Wed, 21 Feb 2018 08:53:26 GMT

Hi,

I have FTD's in HA. Do I need to set/change the platform settings for FTD-HA and apply the commands shown in the screenshots? Would appreciate your help!

Thank you!

Re: Fixed yet?

Marvin Rhoads — Fri, 23 Feb 2018 08:48:51 GMT

To make the icmp and traceroute work fully yes, you would apply the bits from the FMC screenshots.

Re: Fixed yet?

Steve Snodgrass — Mon, 16 Apr 2018 19:23:52 GMT

Anyone still have this issue? I have an HA pair of Firepower 2110 running 6.2.2.2 in my lab and I flat-out cannot get traceroute to work through them, even after configuring the ICMP and FlexConfig settings recommended by Marvin. I have the same symptom that Alexandre described - all the traceroute hops fail except for the final one, which does come through.