topic Re: Replacing 5506 with FPR 1010 in Network Security

Replacing 5506 with FPR 1010

Lee Dress — Thu, 06 Aug 2020 13:47:28 GMT

We are upgrading all of our 5506x devices to FPR 1010 in the very near future.

I would like to be able to manage the access policies with my FMC the same way we do with our 5506 devices

My FMC is on my LAN inside the corporate office.

if you tell an FPR 1010 to become managed by your FMC, do you have to build the VPN tunnels in FMC, or are they still managed from the device like the ASA is?

here's my current configuration summary

ASA 5516 -> outside facing

ASA 5506 -> connect via IKEv2 tunnel to ASA 5516 outside interface

the sfr modules on the 5506 devices talk through the Ikev2 tunnel to the FMC to get their policies.

I don't know how I would build a VPN tunnel with FMC if it's inside the LAN behind the 5516

thanks for any advice.

Lee

Re: Replacing 5506 with FPR 1010

Rob Ingram — Thu, 06 Aug 2020 13:59:01 GMT

Hi,
Assuming you run the FTD software on the FPR1010 instead of ASA software, then all configuration interfaces, routing, VPN etc is configured on the FMC (unless you use FMD for local management or CDO for cloud based management).

If you place the FPR1010 behind another firewall you'd have to permit inbound traffic (udp/500, udp/4500, esp) through the 5516. Instead of doing that, why not replace the 5516 with the FPR1010? Running FTD software you get all the latest NGFW features.

HTH

Re: Replacing 5506 with FPR 1010

Lee Dress — Thu, 06 Aug 2020 14:18:30 GMT

the 5516 is my main corporate firewall used for everything. I don't think an FPR1010 would be able to handle the traffic a 5516x would.

it connects all of my remote offices to corporate, is the main anyconnect portal, has two outside interfaces going to 2 different ISPs, a DMZ, etc,etc...

it also has 3 offices that run asa 5508 connected to it.

that device is not going to be replaced.

I am running FTD on my one FPR1010 that I currently have.

I've setup a test VPN Tunnel as if it was in one of the "home offices" that some of my employees have. I used the FTD on the device to configure that, but I want to use my FMC to be able to manage the traffic policies. this is the way the 5506 devices are configured.

Re: Replacing 5506 with FPR 1010

Rob Ingram — Thu, 06 Aug 2020 14:38:37 GMT

Ok understood.
Yes, so FMC will manage the FTD for VPN and the Access Control Policies configuration.

Re: Replacing 5506 with FPR 1010

Lee Dress — Thu, 06 Aug 2020 15:05:15 GMT

I don't think you are seeing my point (unless I don't understand)

I would like the VPN portion of the FPR1010 to run locally, and manage the policies by the FMC.

I don't know how I would point a remote FPR 1010 to my internal FMC to build a VPN Tunnel.

Re: Replacing 5506 with FPR 1010

Rob Ingram — Thu, 06 Aug 2020 15:19:09 GMT

Ok. The FMC will only manage all the configuration for the FTD. You don't terminate the VPN on the FMC, when you run the VPN wizard on the FMC you define the FTDs to setup a VPN tunnel between - the remote 1010 and the local 1010. The FMC just configures the devices and pushes out the configuration.

Example:-

https://www.youtube.com/watch?v=W2EECB7yOaw

Re: Replacing 5506 with FPR 1010

Marvin Rhoads — Thu, 06 Aug 2020 18:21:50 GMT

When you build a VPN tunnel in an FMC-managed FTD device and the remote end isn't managed by FMC it's known as an "Extranet" device. You just enter its IP address in the VPN definition and the parameters for the FTD end to match what's setup in that remote device.

Re: Replacing 5506 with FPR 1010

mumbles202 — Fri, 07 Aug 2020 16:42:58 GMT

Is the question how you'd manage the FTD appliance via the FMC that's across a vpn when you have to build the vpn from within the FMC and push it out to the FTD so it knows how to build the tunnel (sort of the chicken and the egg scenario)? If you have a spare public ip at each location you could manage the FTD via that ip. If that's not possible you might be able to get away w/ configuring the device using a temp ip on your lan, just use something like this on the device:

configure manager add DONTRESOLVE my_key ftd_remote1

Then add it to the FMC using the temp ip and the nat-id. Build everything out like it should be and deploy it to the box. Once the FTD has the correct configuration, disconnect it from the LAN, login locally to the device and update the management interface ip and default gateway as required. Once the device gets onsite, go into the FMC, change the host ip address on the Devices tab. If the vpn comes up and there is connectivity the device should check in.

I'd give it a try in a lab if possible but I think that should work.

Re: Replacing 5506 with FPR 1010

Marvin Rhoads — Fri, 07 Aug 2020 18:45:12 GMT

Your latter method was what they taught us in Cisco field engineer training as a valid method. They recommend to unmanage it once disconnected from the staging site and change the management IP (in FMC) to the new one.

Once you've deployed and done the "configure network" to change the management address and gateway on the remote end it should, as you noted, "check in". Once that is verified I'd deploy once more to make sure everything syncs from FMC.

Re: Replacing 5506 with FPR 1010

mumbles202 — Fri, 07 Aug 2020 20:22:23 GMT

Yes, forgot to mention disabling the management of the box under devices until it is ready to check in again. I've used it in the past to do a couple of sites and had good success with it.

Re: Replacing 5506 with FPR 1010

Lee Dress — Fri, 07 Aug 2020 21:02:30 GMT

I will try all of this in a lab next week.

problem is, my 1010 doesn't terminate to another 1010. it terminates to an asa 5516x with firepower.

all I want to do is run the VPN via the local device, and manage the policies with FMC.

if that won't work I'll probably need another 1010 to terminate all of my 1010 devices and keep my ASA devices on a different public IP.

Re: Replacing 5506 with FPR 1010

Lee Dress — Fri, 07 Aug 2020 21:06:13 GMT

I have been anle to create a vpn between an ASA and the FPR1010 using the local management of the 1010 and the 5516x.

I'd like to keep that part as is and manage the access control url and malware policies in FMC the was the asa 5500x devices do it.

Re: Replacing 5506 with FPR 1010

mumbles202 — Fri, 07 Aug 2020 22:17:58 GMT

Ah. I don't think that's possible. As far as i know FTD is either FMC managed or the on-box. Going from 1 to the other wipes the configuration and you start from scratch. That might have changed but that's what it was the last I heard.

Re: Replacing 5506 with FPR 1010

Marvin Rhoads — Sat, 08 Aug 2020 12:00:35 GMT

Correct - switching an FDM- (or CDO-) managed FTD device to being FMC-managed will wipe out any existing configuration other than the basic management interface setup that's done out of the box.

Re: Replacing 5506 with FPR 1010

Lee Dress — Wed, 12 Aug 2020 16:33:49 GMT

his blew up in my face.

the device lost it's mind. I tired to fall back to local management, but the config was gone.

I tried a factory reset after that and now I can't get any interfaces to work except the management interface on the FPR1010

and because I don't even know how to understand any of the new language I can't figure out how to get it to work at all. I was able to program the management interface, but when I try to login it says "application cannot be opened" try again or reimage with the latest release.

and I can't find documentation on that.

this is not a straight ASA 5506x replacement (which is what I was told by Cisco sales of course)

I'm slightly disheartened. and by slightly I mean completely.

thanks cisco!