topic Re: FMC FTD EIGRP Delay FlexConfig in Network Security

FMC FTD EIGRP Delay FlexConfig

kris_duffy — Fri, 21 Feb 2020 17:06:54 GMT

Hello,

I have been able to create the FlexConfig to configure EIGRP and it is working well with the FTD advertising and receiving routes.

However I have a requirement to add a delay to an interface. When I try to add a delay via FlexConfig to an interface with "delay 5000" FMC returns an error "Unsupported CLI".

Looking though it documentation "delay" on an interface is NOT a blocked command so this should work.

Does anyone know how I could implement delay for EIGRP of FTD?

Below is my FlexConfig

#foreach ($intf in $SYS_FTD_ROUTED_INTF_MAP_LIST)
#if ($eigrpIntfDelayList.contains($intf.intf_logical_name))
interface $intf.intf_hardware_id
delay 5000
#end
#end

Re: FMC FTD EIGRP Delay FlexConfig

1_am_r00t — Mon, 17 Aug 2020 22:31:44 GMT

I'm having the same problem, unfortunately. FMC 2600 + FPR2k / FPR9k (multi instance). Did somebody ever got this to work? I'm not able to find somewhere a bug id that describes this very issue. It's a pity Cisco's (former) proprietary dynamic routing protocol (which is widely used on my campus and we're not planning to get rid of soon) lacks in support on their own hardware ... *sigh*

Re: FMC FTD EIGRP Delay FlexConfig

kris_duffy — Mon, 17 Aug 2020 22:48:41 GMT

Hi,

Yes we got this to work after raising a TAC case. I would suggest raising a case to confirm with TAC that this is still the method as it was a year ago when we implemented it. Were are also using FMC and this still had to be performed on the FTD via the CLI LinaConfigTool. Below is an example.

>expert

>sudo su

>/usr/local/sf/bin/LinaConfigTool ‘interface GigabitEthernet0/0’ ‘delay 5000’

>pmtool restartbyid ngfwManager

>lina_cli

>en

>show run all int G0/0

Re: FMC FTD EIGRP Delay FlexConfig

1_am_r00t — Tue, 18 Aug 2020 07:19:54 GMT

Hi! I did not expect an answer THAT fast, if any at all. We'll definately give TAC a shot and verify this still is the "correct" procedure, although I would appreciate it'll work as designed via flexconfig *facepalm*

I'll try those commands anyway no matter what as we have a spare pair of FTD2110 in staging.

Thank you very much for your reply - I appreciate it very much!