topic Re: Subinterfaces using FMC on 4112 in Network Security

Subinterfaces using FMC on 4112

rosarra — Thu, 09 Sep 2021 08:30:02 GMT

Good morning,

a trivial question... how is it possible to create subinterfaces via Firepower Management Center (version 7) on two clustered 4112 Devices?

Maybe I am wrong but I understand that I have to do it via Firepower Chassis Manager and I can only do it if the interfaces are not in an instance.

Please tell me I'm wrong!

Re: Subinterfaces using FMC on 4112

balaji.bandi — Thu, 09 Sep 2021 09:53:47 GMT

what kind of deployment, check the - table 1

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/multi-instance/multi-instance_solution.html#id_20107

Also look at the config :

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp4100/firepower-4100-gsg/chassis_setup.html#concept_twm_t2x_xgb

Re: Subinterfaces using FMC on 4112

Milos_Jovanovic — Thu, 09 Sep 2021 09:57:17 GMT

Hi @rosarra,

You add subinterfaces same way as with standalone or HA devices. From that standpoint, Cluster is not different at all.

Same goes for multi-instance - you can add subinterfaces, for as long as you added entire physical interface (or logical, such as port-channel) to one instance. Difference comes when you want some subnterfaces from the same link to be in Cluster and another to be in HA pair. From that point, you must configure subinterfaces on FXOS level, and assign them to logical devices.

BR,

Milos

Re: Subinterfaces using FMC on 4112

rosarra — Thu, 09 Sep 2021 10:24:11 GMT

Hi Milos,

in a multi instance environment I cannot create a subinterface on interfaces that are part of an instance using Firepower Chassis Manager (I received the following error: Failed to create the subinterface, because the parent interface, 'Ethernet1/3', is in use by a Logical Device.)

Nor can I create them from Firepower Management Center while HA is active.
The solution I found (the one with the least impact) is to disable HA from FMC, configure subinterfaces on both devices and re-enable the HA.
It's a long and not very pleasant process but it's the only one that seems to work for me.

Roberto

Re: Subinterfaces using FMC on 4112

Milos_Jovanovic — Thu, 09 Sep 2021 11:47:40 GMT

Hi Roberto,

This is expected - since you already assigned physical interface to logical device, you can't add VLANs on it anymore from FXOS.

You should add subinterface from FMC - go to Devices / Device Management / Select your device and edit / Interface / Add nIterface / Sub interface. It is possible to add subinterface, even with HA active. What you could be facing is that you maybe already have configuration on Ethernet1/3, and now you want to add subinterface on top of that, which is not supported. For this, you must remove existing interface configuration, save, and then configure it again as subinterface.

BR,

Milos