NGIPS in transparent mode and in inline mode simultaneously

abdulkarim041 — Mon, 08 Mar 2021 13:41:29 GMT

Hi,

Can we configure Cisco NGIPS in transparent mode and in inline mode simultaneously.

Re: NGIPS in transparent mode and in inline mode simultaneously

balaji.bandi — Mon, 08 Mar 2021 13:49:03 GMT

If this is Multi instant - yes you can different instant different mode

but single instant not that I am aware of this supported.

Spooster IT Services — Mon, 08 Mar 2021 17:03:35 GMT

Yes, you can use them simultaneously. Cisco NGIPS/FTD is a unified software image that consists of 2 main engines:

The High-level packet flow is as follow:

As FTD/NGIPS is a combination of ASA and Firepower engines in the backend, FTD/NGIPS provides two Deployment modes and six Interface modes as below:

Two deployment modes:
- Routed (Device Modes inherited from ASA)
- Transparent (Device Modes inherited from ASA)
Six Interface Modes:
- Routed (Interface Modes inherited from ASA)
- Switched (BVI) (Interface Modes inherited from ASA)
- Passive (Interface Modes inherited from Firepower)
- Passive (ERSPAN) (Interface Modes inherited from Firepower)
- Inline Pair (Interface Modes inherited from Firepower)
- Inline Pair with tap (Interface Modes inherited from Firepower)

Here is a high-level overview of the various FTD deployment and interface modes:

FTD interface mode FTD Deployment mode

Routed Routed

Switched Transparent

Inline Pair Routed or Transparent

Inline Pair with Tap Routed or Transparent

Passive Routed or Transparent

Passive (ERSPAN) Routed

In Short:

When you configure an Inline Pair 2 Physical interfaces are internally bridged
Very similar to classic inline Intrusion Prevention System (IPS)
Available in Routed or Transparent Deployment modes
Most of the LINA engine features (NAT, Routing, etc) are not available for flows that go through an Inline Pair Transit traffic can be dropped

*** If you found this as a piece of useful information, please remember to mark this as helpful...