topic Re: Static Routes for FTD - Three sperate interfaces in Network Security

Static Routes for FTD - Three sperate interfaces

t3chH0und — Tue, 31 Aug 2021 16:35:04 GMT

Hello All.

I have an FTD running 6.6.4. - the current interface config:

1. Inside Zone - Interface 10.10.10.1 (network 10.10.0.0)

2. Outside Zone - Interface 10.20.20.248 (network 10.20.20.0)

3. Route - any-ipv4, outside, global, 10.20.20.1, false, 1

Need to add two more interfaces:

1. DMZ Zone - Interface 10.40.40.254 (network 10.40.40.0)

2. DMZ Zone - Interface 10.50.50.254 (network 10.50.50.0)

3. I need routes that will allow data from my inside zone (network 10.10.0.0) to these networks (10.40.40.0 and 10.50.50.0) also.

What would my routes be? I do not have a spare to test with, so I am worried that I will block myself by adding a incorrect route.

Any help would be greatly appreciated.

Re: Static Routes for FTD - Three sperate interfaces

Karsten Iwen — Tue, 31 Aug 2021 16:44:17 GMT

You don't need any additional routes. The firewall is aware of these networks when it has an IP in that new net. But you need to allow this communication in your security-policy.

Re: Static Routes for FTD - Three sperate interfaces

t3chH0und — Tue, 31 Aug 2021 16:50:37 GMT

Thank you. I added the interfaces; however, a traceroute to the 10.40.40.0 or 10.50.50.0 networks stills routes to the outside interface, not the new interfaces. When that happened, I assumed I needed a new static route. So by allowing in my policy, the date should route to the new interfaces?

Re: Static Routes for FTD - Three sperate interfaces

Karsten Iwen — Tue, 31 Aug 2021 16:59:28 GMT

The moment the interface is in place and active, traffic should not be routed to outside any more. Without an allow rule, traffic should be dropped.

Are the interfaces active? Do you see them on the CLI with "show interface ip brief", "show route"?