topic Re: Enable stun protocol inspection - FTD2110 in Network Security

Enable stun protocol inspection - FTD2110

TJ01 — Wed, 24 Nov 2021 11:30:56 GMT

Hi ALL

Any option to enable stun protocol inspection for specific rules only in FTD2110

If not do we need to enable it in global policy ... what are supportive commands to enable this protocol

This is what we see atm

> show service-policy inspect stun

Globaly policy:

Service-policy: global_policy

Class-map: inspection_default

Re: Enable stun protocol inspection - FTD2110

Marvin Rhoads — Wed, 24 Nov 2021 13:04:02 GMT

Since STUN protocol inspection is a legacy ALG (application layer gateway) inspection type and not exposed directly in the FMC (or FDM) GUI, we need to use a Flexconfig object to modify it. That can be done by creating a custom Flexconfig object and assigning it in your Flexconfig policy.

FMC Flexconfig Object for STUN

Flexconfig Policy

Re: Enable stun protocol inspection - FTD2110

TJ01 — Thu, 25 Nov 2021 04:06:42 GMT

Thanks Marvin for your quick response on this ... What other options to enable this protocol if we using Firepower Device Manager instead - Sorry I am new to cisco ftd so still unable to find the option to use this protocol ... this is the only object type I got in FDM

Only able to see stun option to use in application filter but access rule is allowing for all application ..

Re: Enable stun protocol inspection - FTD2110

Marvin Rhoads — Fri, 26 Nov 2021 07:25:13 GMT

In FDM, we setup FlexConfig via the following screens:

FDM Home Page

FDM FlexConfig Object

Once you have created the object (similar to how it is done in FMC), specify it in your FlexConfig policy and deploy.

Re: Enable stun protocol inspection - FTD2110

TJ01 — Tue, 30 Nov 2021 04:06:05 GMT

Thanks Marvin, Is it applicable to specify interfaces and/or good practice for enabling an inspection of protocol ?

As we are defining the inspection under the global policy which is enabled on all interfaces ... will adding the interfaces limit this inspection on specified interfaces ?

Re: Enable stun protocol inspection - FTD2110

Marvin Rhoads — Tue, 30 Nov 2021 12:35:35 GMT

We normally use a global policy. It is applied globally with "service-policy global_policy global".

If you only want to apply the inspection to a given interface (or interfaces) then you would define it in a differently named policy-map and apply it with a separate service-policy.