topic Re: Route Internet Through VPN - FTD in Network Security

Route Internet Through VPN - FTD

Scott_22 — Wed, 24 Jun 2020 01:30:54 GMT

What needs to happen to route all internet traffic through a site to site tunnel with the exception of a couple of subnets that should route normally? This is utilizing the Firepower 4100 platform.

Re: Route Internet Through VPN - FTD

Marvin Rhoads — Wed, 24 Jun 2020 01:37:39 GMT

Assuming the "normally routed" subnets also need to transit the VPN to reach the remote site, you would require Policy-based routing (PBR). Normal routing is based on the destination address. You need to add the source address in the criteria.

Here's a decent guide that steps you through how to do it:

https://www.slideshare.net/redouanemeddane/policybased-routing-using-flexconfig-firepower-threat-defense

(The Cisco configuration guide is a bit weak in this area.)

Re: Route Internet Through VPN - FTD

Scott_22 — Wed, 24 Jun 2020 12:24:54 GMT

This is perfect! If I'm using this for VPN traffic, is the route-map still assigned to the outside interface used to establish the tunnel? Also, is a 2nd rule needed to route all other traffic normally, or does a single rule suffice?

Re: Route Internet Through VPN - FTD

Scott_22 — Thu, 25 Jun 2020 16:00:36 GMT

After discussing this with TAC, it was determined that the best method is as follows:

Create an extended ACL with the following two entries:

1. Deny - Denies traffic that should be routed from the source to destination traffic through normal means

2. Allow - Allows all traffic that is not denied access to traverse the tunnel

This ACL is then applied to the Site to Site tunnel - think crypto map ACL in ASA code.

We are working to deploy this configuration now and I will post my results.

Re: Route Internet Through VPN - FTD

mohamed_farok — Sun, 26 Jul 2020 13:08:40 GMT

how you can make this ACL on FTD